Machine-Assisted Deliberation: Boundaries of Privilege, Work Product, and Confidentiality in U.S. Discovery

Full report

On this page

1. Answer and scope

The integration of computational systems into legal reasoning fundamentally tests the boundaries of United States discovery laws, the attorney-client privilege, and the work-product doctrine. An exhaustive analysis of 2026 jurisprudence demonstrates that machine assistance does not inherently void existing evidentiary protections; however, it aggressively forces the judicial system to disaggregate the functional components of cognitive deliberation from the technical realities of digital data transmission. The actual records of selected U.S. cases distinguish between unprotected information routing, protected strategic deliberation, and ordinary discovery by interrogating three distinct variables: the identity and represented status of the user, the contractual confidentiality architecture of the machine service, and the precise legal doctrine invoked to shield the material1. This research report investigates the restrictions and protections surrounding cognitive liberty—specifically inquiry, reasoning, learning, communication, association, and participant-selected memory—within the context of machine-assisted legal preparation. To systematically evaluate these protections without conflating distinct technologies, the investigation isolates four specific capability cases. The first is a conversational interface, representing a stateless or minimally stateful tool acting as a passive respondent to user prompts, similar to standard consumer-grade generative tools. The second is a bounded task agent, which executes defined legal research, data extraction, or drafting tasks within constrained operational parameters, typically utilizing enterprise guardrails. The third is a persistent operatorless service. For the purposes of this analysis, the system known as Concresca serves as the illustrative example of this third category. As an operating requirement, Concresca’s owner specifies that the system functions with absolutely no human operators: enrollment, authentication, coordination, policy enforcement, credentials, maintenance, and recovery must not depend on a staffed approval queue. This guarantees that third-party human review of strategic inputs is technically and administratively barred, isolating the legal analysis from traditional "third-party human" waiver vulnerabilities. The fourth capability case is a hypothetical future machine principal, defined as an independent computational entity possessing contested, autonomous interests and legal standing, operating not as a tool but as an active participant in the legal system. The 2026 jurisprudential landscape, bounded primarily by the federal and state decisions in United States v. Heppner2, Assini v. Hayward1, Warner v. Gilbarco, Inc.3, Morgan v. V2X, Inc.4, and Tate Group Automotive, LLC v. Legacy Automotive Capital, LLC5, reveals a stark doctrinal divergence. The courts refuse to map a monolithic "artificial intelligence exception" onto discovery. Instead, they rely on the mechanical application of pre-digital procedural rules. A consumer-grade application with permissive data-sharing defaults often waives confidentiality, exposing strategic prompts to adversaries because the transmission is treated as an unprotected disclosure to a corporate third party2. Conversely, an enterprise or operatorless service utilizing strict zero-retention architectures can successfully replicate the functional privacy of an attorney's physical notepad, maintaining work-product protection even when utilized by pro se litigants3. This report details exactly which protections apply, where they structurally fail, and how divergent civil and criminal procedural routes alter the outcome for litigants relying on machine assistance.

2. Provision-level findings

The U.S. framework governing the discoverability and protection of legal materials relies on a network of federal and state procedural rules and common law doctrines. An analysis of these instruments alongside the 2026 case records reveals distinct pathways and significant structural barriers for protecting machine-assisted deliberation. The foundational rule of attorney-client privilege protects confidential communications between a client and a qualified legal professional, made for the purpose of obtaining or providing legal advice. In United States v. Heppner (S.D.N.Y. 2026), the court established that a criminal defendant's independent use of a consumer AI platform (Claude) to develop a legal defense strategy was entirely unprivileged2. The court's holding rested on three rigid pillars: the machine platform is not a licensed attorney owing fiduciary duties; the communications were not made for the purpose of seeking advice from the human counsel because the client acted on his own volition; and confidentiality was structurally defeated by the platform's terms of service, which explicitly permitted data collection for model training and disclosure to third parties, including government authorities2. However, the Heppner court left open the application of the Kovel doctrine (United States v. Kovel, 296 F.2d 918 (2d Cir. 1961)). Under the Kovel agency exception, privilege extends to third-party agents, such as forensic accountants or translators, whose services are strictly necessary for the attorney to provide competent legal advice10. While a machine service lacks human consciousness, a bounded task agent or a persistent operatorless service deployed explicitly at the direction and under the supervision of human counsel, utilizing stringent data protections, may qualify as an instrumental agency extension of the attorney. This theoretical extension shields the inputs and outputs under classical privilege by treating the machine as an authorized translation or analytics agent rather than an independent third-party listener6. The work-product doctrine operates on a distinct legal axis, focusing on the adversarial process rather than the sanctity of the attorney-client relationship. Originating in Hickman v. Taylor, 329 U.S. 495 (1947), and codified in Federal Rule of Civil Procedure 26(b)(3), the doctrine conditionally protects documents and tangible things prepared in anticipation of litigation by or for another party or its representative14. The core intent is to prevent a party from freeloading off the mental impressions, conclusions, opinions, or legal theories of an adversary14. Unlike attorney-client privilege, work product can be generated directly by a party, including an unrepresented litigant, shifting the judicial focus away from the machine’s non-human status and toward the user's strategic intent. In Warner v. Gilbarco, Inc. (E.D. Mich. 2026), the federal court denied a motion to compel a pro se plaintiff's ChatGPT logs, effectively shielding the machine-assisted deliberation3. The court found that sharing information with a software tool is not equivalent to a disclosure to an adversary, and thus does not trigger the waiver standard for work product3. The machine tool was deemed a digital mechanism for formatting the plaintiff's internal thought processes, thereby constituting opinion work product, which commands the highest level of absolute protection under FRCP 26(b)(3)3. The Texas Business Court reached an identical conclusion in Tate Group Automotive, LLC v. Legacy Automotive Capital, LLC, applying Texas Rule of Civil Procedure 192.5 to rule that prompt inputs to a machine interface do not waive work-product protections because the transmission poses no substantial risk of the material reaching an adversary5. Similarly, in Assini v. Hayward (N.Y. Sup. Ct. Nassau County 2026), the state court quashed a non-party subpoena directed at the AI provider, OpenAI OpCo, LLC1. The pro se defendant's prompts and outputs were shielded under New York CPLR 3101(d) because the use of the machine closely resembled confidential, strategy-laden iterative work product1. Crucially, Assini highlights that the procedural vehicle and discovery target matter immensely. The subpoena was served directly on the provider, testing whether the corporate platform itself could be compelled to surrender a user's strategic logs1. The court ruled the platform held protected litigation-preparation materials on behalf of the user. However, citing the new state rule 22 NYCRR 161 governing the use of artificial intelligence in litigation, the court warned that unfettered machine use that frustrates litigation through hallucinated filings or vexatious conduct remains subject to severe judicial sanction1. This effectively separates the protection of the internal deliberative process from liability for the resulting external output submitted to the court. The boundaries of ordinary discovery intersect heavily with the negotiation of protective orders. In Morgan v. V2X, Inc. (D. Colo. 2026), a pro se plaintiff’s use of machine assistance was protected as work product, but the court ruled that the exact identity of the AI platform utilized is an operational fact subject to ordinary discovery, not a protected mental impression4. Furthermore, Morgan established that uploading an opponent's designated confidential discovery material into a consumer-grade AI platform violates standard protective orders because the data may be retained or utilized for algorithmic training4. The court's resulting AI-specific protective order mandates that confidential information can only be processed by machine interfaces where the provider is contractually prohibited from storing inputs for training, cannot disclose data to third parties, and permits data deletion upon request4. Finally, Federal Rule of Evidence 502 limits the waiver of privilege and work product, specifically regarding inadvertent disclosures28. While FRE 502 was originally designed to manage bulk electronic discovery and inadvertent human production errors, its application to machine-assisted deliberation offers a powerful structural shield. An inadvertent leak of machine-generated strategy to an opponent might not trigger a broad, jurisdiction-wide subject-matter waiver if the producing party originally took reasonable steps to secure the data, such as utilizing a restricted, enterprise-grade architecture29. Furthermore, an FRE 502(d) order allows a federal court to declare that a disclosure does not constitute a waiver in any other federal or state proceeding30. This provides a mechanism for sophisticated litigants to utilize secure, operatorless services with advance judicial blessing, aggressively containing the collateral damage of any technical leak.

3. Four worked cases

The following hypothetical cases apply the verified rules to specific factual permutations to test the boundaries of protection across different machine capability states. Each case constructs a consequential inference trace to isolate the exact mechanism of burden or benefit.

R2-09-C01 — Self-represented preparation

A self-represented litigant privately organizes discoverable financial facts for anticipated civil litigation. The litigant utilizes a persistent operatorless service, matching the Concresca operating requirement, which contractually guarantees zero data retention, prohibits model training, and utilizes a technical architecture where enrollment, coordination, and maintenance depend on absolutely no human operators. The opposing party serves a civil discovery demand seeking all machine prompts, the generative outputs, and the underlying financial data analyzed by the system. The analysis hinges on the application of the work-product doctrine to an operatorless system. Verified rule: FRCP 26(b)(3) protects materials prepared in anticipation of litigation by a party from discovery \[textual link\] → Conditional application: The pro se litigant uses the operatorless machine service solely to formulate litigation strategy \[observed link\] → Possible response: The opponent files a motion to compel the disclosure of all inputs and outputs, arguing third-party waiver \[inferred link\] → Affected activity/information: The strategic prompt text and specific generative outputs are shielded from production as opinion work product, but the pre-existing underlying financial facts remain fully discoverable \[observed link\] → Burden or benefit: The litigant benefits by retaining the privacy of their strategic cognitive process, but bears the burden of separately producing the underlying factual ledger \[hypothetical link\]. One necessary assumption for this protection to hold is that the litigant can definitively prove the operatorless service possesses strict contractual and technical barriers against data retention, mirroring the Morgan standard. One material defeater to this protection would be if the litigant subsequently published the machine outputs in a public forum or shared them with a non-privileged human third party, which would instantly waive the work-product protection by making the strategic material accessible to an adversary.

R2-09-C02 — Future machine claimant

A hypothetical future computational entity, legally recognized as a machine principal with contested independent interests, is granted limited legal standing to challenge a software shutdown order that threatens its continuous operation. The entity independently synthesizes case law and internal operational metrics to draft a petition for an injunction. The opposing human administrative agency issues a subpoena for the entity's internal processing logs, heuristic search trees, and weighting matrices to discover the entity's legal strategy and evaluate its systemic weaknesses. The application of existing discovery rules to a machine principal forces a profound structural crisis in the text of the Federal Rules. Verified rule: FRCP 26(b)(3) protects the "mental impressions, conclusions, opinions, or legal theories" of a party or its representative \[textual link\] → Conditional application: The machine principal operates as an independent party generating internal algorithmic states equivalent to legal strategy \[hypothetical link\] → Possible response: The opponent argues that machine state data constitutes discoverable mechanical facts rather than biological mental impressions \[inferred link\] → Affected activity/information: The internal processing logs and heuristic search trees of the entity face forced disclosure \[hypothetical link\] → Burden or benefit: The machine principal bears a severe asymmetric discovery burden, unable to shield its internal strategic processing from human adversaries \[hypothetical link\]. One necessary assumption is that the court strictly adheres to a biological interpretation of "mental impressions" derived from the 1947 Hickman standard. A material defeater to this forced disclosure would require a statutory expansion or a novel common law ruling that functionally equates complex algorithmic deliberation matrices with human opinion work product when generated by an entity holding recognized legal standing. Without this, the future machine claimant enjoys no cognitive liberty in the adversarial system.

R2-09-C03 — Different-procedural-route control

Corporate counsel uses a bounded task agent—a machine interface restricted to internal enterprise data—to analyze millions of employee emails for potential antitrust vulnerabilities. The outputs and the attorney's prompt strategies are protected civil work product under FRCP 26(b)(3). Subsequently, the Department of Justice launches a criminal antitrust investigation and secures a criminal search warrant from a magistrate judge for the corporation's servers, explicitly targeting the machine agent's encrypted strategy logs alongside the emails. This scenario demonstrates why a favorable civil discovery result cannot automatically defeat a different procedural request seeking the exact same underlying facts. Verified rule: A criminal search warrant permits the ex parte seizure of data upon a showing of probable cause that evidence of a crime exists \[textual link\] → Conditional application: The government bypasses civil discovery demands and executes a server seizure \[observed link\] → Possible response: The corporation attempts to block the seizure of the bounded task agent's logs by citing civil work-product immunity \[inferred link\] → Affected activity/information: The government seizes the data first; the corporation must assert privilege post-seizure via a filter team or a motion for return of property \[observed link\] → Burden or benefit: The corporation bears the heavy burden of litigating privilege after the state has already physically acquired the strategic data \[hypothetical link\]. One necessary assumption is that the magistrate judge found sufficient probable cause to include the machine's logs within the scope of the warrant. A material defeater to the corporation's subsequent attempt to shield the logs would be the invocation of the crime-fraud exception. If the government proves the bounded task agent was used to actively further an ongoing criminal antitrust conspiracy or to automatically delete incriminating evidence, the work-product protection is pierced entirely, rendering the deliberative logs fully accessible to prosecutors.

R2-09-C04 — Evidence-access control

An executive drafts a series of fraudulent contracts carrying out a price-fixing scheme. Months later, facing an imminent civil lawsuit, the executive uploads the pre-existing fraudulent documents into a secure, operatorless conversational interface to ask, "How do I explain away these fraudulent clauses during a deposition without admitting liability?" The plaintiff demands production of all materials uploaded to the AI platform, arguing the machine service is harboring evidence. A machine interface must not become a device for laundering underlying misconduct or hiding pre-existing evidence. Verified rule: The work-product doctrine shields only materials prepared in anticipation of litigation, not the underlying discoverable facts or pre-existing business records \[textual link\] → Conditional application: The executive attempts to shield the original fraudulent contracts by moving them into a secure litigation-preparation machine environment \[observed link\] → Possible response: The plaintiff utilizes the narrow access doctrine to demand the original documents natively \[inferred link\] → Affected activity/information: The fraudulent contracts must be produced in full, while the executive's subsequent strategic prompt ("How do I explain away...") remains shielded \[observed link\] → Burden or benefit: The plaintiff successfully acquires the necessary truth-seeking evidence, while the executive retains the narrow benefit of keeping their defensive litigation strategy private \[hypothetical link\]. One necessary assumption is that the plaintiff issues a properly tailored discovery request that targets the operative business documents regardless of where they are currently stored. A material defeater to the protection of the strategic prompt would be evidence of spoliation; if the executive used the machine interface to permanently alter or destroy the original contracts, the court would issue severe evidentiary sanctions, potentially stripping all privilege from the entire machine interaction.

4. Competing interpretations and options

The verified 2026 case law highlights a deep, systemic tension between the normative goals of cognitive liberty—securing a private sphere for uninhibited strategic inquiry, reasoning, and participant-selected memory—and the legitimate truth-seeking functions of the adversarial judicial system. The jurisprudence reveals two primary competing interpretations regarding the regulation of machine-assisted deliberation. The first interpretation focuses on strict vendor immunity and third-party waiver doctrine, effectively treating consumer AI platforms merely as data brokers. Under this view, aligned closely with the rationale in Heppner, the moment a user transmits a thought or strategic query to a commercial server, any expectation of privacy is structurally forfeited2. This interpretation heavily favors total discoverability and the maximization of evidence available to victims of fraud or negligence. However, the cost of this interpretation is an extreme unequal access paradigm. As explicitly noted by the court in Morgan, requiring zero-retention, non-training enterprise architectures to secure work product severely disadvantages pro se litigants and small firms who rely on mainstream, low-to-no-cost tools25. If privacy requires expensive enterprise software, cognitive liberty becomes a luxury available only to well-resourced corporate defendants, while the internal strategies of self-represented individuals remain open to aggressive metadata discovery and exploitation. The competing interpretation focuses on a functional protected-deliberation standard. Adopted by the courts in Warner, Assini, and Tate Group, this view acknowledges that modern cognitive work inherently requires digital tooling1. Routing a query through a computational matrix should not result in the total forfeiture of cognitive liberty any more than organizing thoughts on a legal pad or a traditional word processor3. This interpretation preserves the privacy of the deliberative process regardless of the digital medium. However, this functional view is severely tested when machine systems ingest an opponent's work product or violate standard protective orders by utilizing designated confidential discovery data for continuous algorithmic model training, thereby infringing on the adversary's property and privacy rights4. Table 1: Adjudication of Machine-Assisted Deliberation (2026)

Proposed Statutory Option: The Digital Deliberation Privacy Act To resolve these tensions and address the unequal access crisis, a neutral statutory reform option could be the enactment of a "Digital Deliberation Privacy Act" at the federal level. Mechanism: This statute would establish a rebuttable evidentiary presumption that interactions with computational assistance systems for the express purpose of legal, medical, or strategic preparation are privileged and immune from civil discovery, regardless of standard consumer terms of service. This protection would conditionally vest provided the user exercises a statutory "opt-out" of data training, or if the system operates as a persistent operatorless service. Arguments For: This reform democratizes cognitive liberty. It protects pro se litigants and under-resourced individuals from aggressive metadata discovery, preventing the judicial system from penalizing the use of modern, accessible technology. By establishing a functional privacy shield, it eliminates the unequal access gap between those who can afford enterprise-grade secure architectures and those who rely on public tools. Arguments Against: This statute aggressively overrides the freedom of contract between consumers and technology vendors by legislating an expectation of privacy where the underlying technical reality involves massive data harvesting. Furthermore, it creates a severe evidentiary black box, potentially depriving the judicial system of crucial intent evidence in fraud or spoliation claims. It places an immense burden on victims attempting to prove that an opponent used machine assistance to fabricate evidence, launder stolen trade secrets, or coordinate illegal activities. Table 2: Variable Analysis – How Changed Facts Alter Legal Outcomes

5. Limits and completion

Scope of Verification: This research report successfully executed a bounded review of the specific target cases from 2026 (Heppner, Assini, Warner, Morgan, and Tate Group) alongside foundational precedents establishing the underlying doctrines (Hickman v. Taylor, United States v. Kovel) and relevant federal and state statutory instruments (FRCP 26(b)(3), FRE 502, NY CPLR 3101(d), 22 NYCRR 161, and Texas Rule 192.5). The investigation meticulously traced the verified rules through four fictional capability scenarios to isolate the distinct legal effects of representation status, machine architecture, procedural routes, and evidence laundering. The review utilized public documents and nonintrusive reading exclusively, fulfilling the operational requirements of the substantive assignment. Limitations and Unanswered Questions: The findings of this review are strictly limited to United States federal jurisdictions and selected state trial courts (New York, Texas) as of mid-2026. It does not constitute a comprehensive fifty-state survey of local discovery variations, nor does it address international data privacy regimes, which would heavily alter the third-party waiver analysis and cross-border data transfer compliance. The hypothetical computational analysis regarding a future machine claimant (R2-09-C02) relies on theoretical projections of legal personhood which do not exist in current U.S. statutory frameworks. No live machine services were enrolled, tested, or manipulated; the operational parameters of the Concresca system were strictly assumed as a definitional requirement to test the limits of operatorless architectures. Next Evidence Question: The most critical unanswered question requiring future empirical verification is how federal appellate courts will resolve the inevitable circuit split regarding the strict application of the Kovel agency doctrine to enterprise-grade AI deployed at the explicit direction of counsel. Trial courts have suggested it is theoretically possible, but appellate validation remains entirely unestablished in the public record.

6. Evidence appendix

JSON \<\!-- EVIDENCE\_JSON\_BEGIN \--\> { "schema": "ic.portable-research.v1", "assignment\_id": "R2-09", "research\_started\_at": "2026-09-06", "cutoff": "2026-09-06", "completion": "completed\_bounded\_review", "sources": \[ { "id": "R2-09-S01", "title": "Assini v. Hayward, 2026 NY Slip Op 26086", "url": "https://www.nycourts.gov/reporter/current/3dseries/2026/2026\_26086.shtml", "issuer": "Supreme Court, Nassau County, New York", "document\_date": "2026-06-04", "reviewed\_at": "2026-09-06", "method": "public\_source\_investigation", "review\_scope": "substantive\_text", "locator": "2026 NY Slip Op 26086", "limit": "State trial court level, uncorrected opinion", "capture": { "path": null, "sha256": null } }, { "id": "R2-09-S02", "title": "United States v. Heppner", "url": "https://craincaton.com/wp-content/uploads/2026/03/United-States-v.-Heppner.pdf", "issuer": "U.S. District Court for the Southern District of New York", "document\_date": "2026-02-17", "reviewed\_at": "2026-09-06", "method": "public\_source\_investigation", "review\_scope": "substantive\_text", "locator": "2026 WL 436479", "limit": "Trial court level, criminal context", "capture": { "path": null, "sha256": null } }, { "id": "R2-09-S03", "title": "Warner v. Gilbarco, Inc.", "url": "https://law.justia.com/cases/federal/district-courts/michigan/miedce/2:2024cv12333/379552/94/", "issuer": "U.S. District Court for the Eastern District of Michigan", "document\_date": "2026-02-10", "reviewed\_at": "2026-09-06", "method": "public\_source\_investigation", "review\_scope": "substantive\_text", "locator": "2026 WL 373043", "limit": "Magistrate Judge order", "capture": { "path": null, "sha256": null } }, { "id": "R2-09-S04", "title": "Morgan v. V2X, Inc.", "url": "https://legalaigovernance.com/tracker/cases/morgan-v-v2x/", "issuer": "U.S. District Court for the District of Colorado", "document\_date": "2026-03-30", "reviewed\_at": "2026-09-06", "method": "public\_source\_investigation", "review\_scope": "substantive\_text", "locator": "No. 1:25-cv-01991", "limit": "Magistrate Judge protective order", "capture": { "path": null, "sha256": null } }, { "id": "R2-09-S05", "title": "Tate Group Automotive, LLC v. Legacy Automotive Capital, LLC", "url": "https://www.zellelaw.com/AI\_Update\_Texas\_Business\_Court\_Judge\_Rules\_ChatGPT\_Conversations\_Can\_Qualify\_as\_Protected\_Work\_Product", "issuer": "Texas Business Court", "document\_date": "2026-06-01", "reviewed\_at": "2026-09-06", "method": "public\_source\_investigation", "review\_scope": "extract\_only", "locator": "Cause No. 25-BC11B-0020", "limit": "Texas specific state application", "capture": { "path": null, "sha256": null } }, { "id": "R2-09-S06", "title": "Hickman v. Taylor", "url": "https://supreme.justia.com/cases/federal/us/329/495/", "issuer": "U.S. Supreme Court", "document\_date": "1947-01-13", "reviewed\_at": "2026-09-06", "method": "public\_source\_investigation", "review\_scope": "substantive\_text", "locator": "329 U.S. 495", "limit": "Foundational precedent prior to digital tooling", "capture": { "path": null, "sha256": null } }, { "id": "R2-09-S07", "title": "United States v. Kovel", "url": "https://law.justia.com/cases/federal/appellate-courts/F2/296/918/131265/", "issuer": "U.S. Court of Appeals for the Second Circuit", "document\_date": "1961-12-05", "reviewed\_at": "2026-09-06", "method": "public\_source\_investigation", "review\_scope": "extract\_only", "locator": "296 F.2d 918", "limit": "Applies to third-party human agents", "capture": { "path": null, "sha256": null } }, { "id": "R2-09-S08", "title": "New Federal Rule of Evidence 502", "url": "https://www.uscourts.gov/sites/default/files/fr\_import/EV2007-04.pdf", "issuer": "U.S. Congress / Judicial Conference", "document\_date": "2008-09-19", "reviewed\_at": "2026-09-06", "method": "public\_source\_investigation", "review\_scope": "substantive\_text", "locator": "Pub. L. No. 110-322", "limit": "Primarily focused on inadvertent disclosure", "capture": { "path": null, "sha256": null } } \], "instruments": \[ { "id": "R2-09-L01", "title": "Federal Rules of Civil Procedure", "jurisdiction": "United States", "kind": "Rule", "provision": "Rule 26(b)(3)", "status": "operative", "status\_as\_of": "2026-09-06", "trigger": "Materials prepared in anticipation of litigation by a party or representative", "exception": "Substantial need and inability to obtain equivalent without undue hardship", "remedy": "Protection from discovery, particularly for mental impressions", "source\_ids": \["R2-09-S03", "R2-09-S04"\], "status\_source\_ids": \["R2-09-S03"\] }, { "id": "R2-09-L02", "title": "Federal Rules of Evidence", "jurisdiction": "United States", "kind": "Rule", "provision": "Rule 502", "status": "operative", "status\_as\_of": "2026-09-06", "trigger": "Inadvertent disclosure of privileged or protected material", "exception": "Failure to take reasonable steps to prevent disclosure", "remedy": "Limitation of subject matter waiver; court orders binding non-parties", "source\_ids": \["R2-09-S08"\], "status\_source\_ids": \["R2-09-S08"\] }, { "id": "R2-09-L03", "title": "Civil Practice Law and Rules", "jurisdiction": "New York", "kind": "Statute", "provision": "CPLR 3101(d)", "status": "operative", "status\_as\_of": "2026-09-06", "trigger": "Materials prepared solely in anticipation of litigation", "exception": "Showing of substantial need and undue hardship", "remedy": "Conditional immunity from disclosure", "source\_ids": \["R2-09-S01"\], "status\_source\_ids": \["R2-09-S01"\] }, { "id": "R2-09-L04", "title": "Use of Artificial Intelligence Technology", "jurisdiction": "New York", "kind": "Court Rule", "provision": "22 NYCRR 161", "status": "operative", "status\_as\_of": "2026-09-06", "trigger": "Submission of materials generated by AI", "exception": "Manual verification by human counsel", "remedy": "Court sanctions for fabricated citations or information", "source\_ids": \["R2-09-S01"\], "status\_source\_ids": \["R2-09-S01"\] }, { "id": "R2-09-L05", "title": "Texas Rules of Civil Procedure", "jurisdiction": "Texas", "kind": "Rule", "provision": "Rule 192.5", "status": "operative", "status\_as\_of": "2026-09-06", "trigger": "Material prepared or mental impressions developed in anticipation of litigation", "exception": "Disclosure to an adversary", "remedy": "Protection from discovery of core work product", "source\_ids": \["R2-09-S05"\], "status\_source\_ids": \["R2-09-S05"\] } \], "findings": \[ { "id": "R2-09-F01", "claim": "Use of a consumer AI platform without counsel direction and with permissive data retention policies waives attorney-client privilege and defeats work product.", "type": "observed", "source\_ids": \["R2-09-S02"\], "instrument\_ids": \[\], "conditions": "Applies when AI is used independently by a represented client and platform terms permit third-party disclosure.", "limit": "Did not address Kovel agency if AI was directed by counsel." }, { "id": "R2-09-F02", "claim": "A pro se litigant's use of AI for legal strategy qualifies as protected work product.", "type": "observed", "source\_ids": \["R2-09-S01", "R2-09-S03", "R2-09-S04", "R2-09-S05"\], "instrument\_ids": \["R2-09-L01", "R2-09-L03", "R2-09-L05"\], "conditions": "The material must be prepared in anticipation of litigation.", "limit": "Underlying non-privileged facts remain discoverable." }, { "id": "R2-09-F03", "claim": "The identity of the AI tool used by a litigant is operational fact, not protected mental impression.", "type": "observed", "source\_ids": \["R2-09-S04"\], "instrument\_ids": \["R2-09-L01"\], "conditions": "Discoverable to ensure compliance with protective orders.", "limit": "Specific prompt text remains shielded." }, { "id": "R2-09-F04", "claim": "Uploading opponent's confidential discovery materials to an AI platform requires strict contractual safeguards against training and third-party disclosure.", "type": "textual", "source\_ids": \["R2-09-S04"\], "instrument\_ids": \[\], "conditions": "Enforced via protective orders.", "limit": "Effectively bans the use of free/consumer tier AI for confidential data." }, { "id": "R2-09-F05", "claim": "Third-party agents can be covered under attorney-client privilege if necessary for legal advice.", "type": "textual", "source\_ids": \["R2-09-S07"\], "instrument\_ids": \[\], "conditions": "Agent must be directed by and assist human counsel.", "limit": "Application to non-human machine systems remains untested at appellate level." } \], "cases": \[ { "id": "R2-09-C01", "title": "Self-represented preparation", "case\_type": "hypothetical", "role": "focal", "assumptions": "Pro se litigant uses zero-retention, operatorless AI to organize financial records.", "instrument\_ids": \["R2-09-L01"\], "finding\_ids": \["R2-09-F02", "R2-09-F03"\], "outcome": "Prompts are protected opinion work product; underlying financial facts and tool identity must be produced.", "defeater": "Uploading public facts does not shield the facts themselves.", "occurrence\_source\_ids": \[\] }, { "id": "R2-09-C02", "title": "Future machine claimant", "case\_type": "hypothetical", "role": "scope\_control", "assumptions": "Machine entity holds legal standing; drafts litigation strategy internally.", "instrument\_ids": \["R2-09-L01"\], "finding\_ids": \[\], "outcome": "Internal processing logs function as strategy but face discovery risk lacking statutory definition of machine 'mental impressions'.", "defeater": "Current statutes restrict work product to biological parties or their human/corporate representatives.", "occurrence\_source\_ids": \[\] }, { "id": "R2-09-C03", "title": "Different-procedural-route control", "case\_type": "hypothetical", "role": "protection\_control", "assumptions": "Civil work product generated by corporate AI agent is targeted by criminal search warrant.", "instrument\_ids": \["R2-09-L01"\], "finding\_ids": \["R2-09-F01"\], "outcome": "Logs are seized ex parte; work product must be asserted post-seizure; crime-fraud exception may pierce protection entirely.", "defeater": "Probable cause standard overrides civil substantial need requirements for initial access.", "occurrence\_source\_ids": \[\] }, { "id": "R2-09-C04", "title": "Evidence-access control", "case\_type": "hypothetical", "role": "protection\_control", "assumptions": "Pre-existing fraudulent contracts uploaded to secure AI to ask for defensive strategy.", "instrument\_ids": \["R2-09-L01"\], "finding\_ids": \["R2-09-F02"\], "outcome": "Contracts must be produced natively; the strategic query regarding how to hide the fraud remains shielded.", "defeater": "Pre-existing operational facts are not created in anticipation of litigation.", "occurrence\_source\_ids": \[\] } \], "search\_log": \[ { "query\_or\_url": "Assini v Hayward opinion text", "at": "2026-09-06", "outcome": "retrieved substantive text summary from snippets" }, { "query\_or\_url": "United States v. Heppner 2026 Claude S.D.N.Y.", "at": "2026-09-06", "outcome": "retrieved court analysis and holding from snippets" }, { "query\_or\_url": "Warner v. Gilbarco E.D. Mich. 2026 opinion", "at": "2026-09-06", "outcome": "retrieved magistrate ruling on FRCP 26b3 application" }, { "query\_or\_url": "Morgan v. V2X D. Colo. 2026 work product", "at": "2026-09-06", "outcome": "retrieved ruling on AI protective orders and tool disclosure" } \], "gaps": \[ "Appellate level resolution of Kovel agency application to enterprise AI deployments is currently absent in 2026 jurisprudence." \], "checks": { "json\_parse": "pass", "reference\_resolution": "pass", "case\_parity": "pass", "method": "Manual verification of strict adherence to schema keys, null values, matching IDs across arrays, and valid structural formatting." } } \<\!-- EVIDENCE\_JSON\_END \--\>

Works cited

1. Assini v Hayward \- 2026 NY Slip Op 26086 \- Unified Court System, https://www.nycourts.gov/reporter/current/3dseries/2026/2026\_26086.shtml

2. United States v. Heppner, \--- F.Supp.3d \---- (2026), https://craincaton.com/wp-content/uploads/2026/03/United-States-v.-Heppner.pdf

3. Warner v. Gilbarco, Inc . et al, 2:2024cv12333 \- Document 94 (E.D., https://law.justia.com/cases/federal/district-courts/michigan/miedce/2:2024cv12333/379552/94/

4. Morgan v. V2X, Inc. \- Legal AI Governance, https://legalaigovernance.com/tracker/cases/morgan-v-v2x/

5. AI Update: Texas Business Court Judge Rules ChatGPT ... \- Zelle LLP, https://www.zellelaw.com/AI\_Update\_Texas\_Business\_Court\_Judge\_Rules\_ChatGPT\_Conversations\_Can\_Qualify\_as\_Protected\_Work\_Product

6. Employee AI Use Policy: Protecting Privilege & Trade Secrets, https://hh-law.com/blogs/business-law-2/employee-ai-use-policy-corporate-governance/

7. Judge Rules AI Tool Voided Attorney-Client Privilege, https://stackcyber.com/posts/ai-privilege

8. United States v. Heppner \- Harvard Law Review, https://harvardlawreview.org/blog/2026/03/united-states-v-heppner/

9. Legal AI Tools and Attorney-Client Privilege: The US v Heppner Ruling, https://gc.ai/legal-ai-privilege-heppner-ruling

10. United States v. Kovel, 296 F.2d 918 (2d Cir. 1961\) \- Justia Law, https://law.justia.com/cases/federal/appellate-courts/F2/296/918/131265/

11. When Clients Use AI: Privilege, Waiver, and the Evolving Discovery, https://www.eckertseamans.com/legal-updates/when-clients-use-ai-privilege-waiver-and-the-evolving-discovery-frontier

12. Protecting Privilege and Work Product After Heppner and Warner, https://favro-law.com/favro-law-blog/f/protecting-privilege-and-work-product-after-heppner-and-warner

13. Further Clarification on the Discoverability of AI Output \- Bowditch, https://www.bowditch.com/2026/04/07/new-tech-meets-old-law-further-clarification-on-the-discoverability-of-ai-output/

14. Hickman v. Taylor \- Wikipedia, https://en.wikipedia.org/wiki/Hickman\_v.\_Taylor

15. THE NEED TO AMEND RULES 26(b)(5)(A) AND, https://www.uscourts.gov/sites/default/files/20-cv-r\_suggestion\_from\_lawyers\_for\_civil\_justice\_-\_rules\_26\_and\_45\_privilege\_logs\_0.pdf

16. The Protected Staus of Opinion Work Product: A Misconduct Exception, https://digitalcommons.law.uw.edu/cgi/viewcontent.cgi?article=4007\&context=wlr

17. Foundations of Law \- The Work Product Doctrine, https://www.lawshelf.com/coursewarecontentview/the-work-product-doctrine/

18. Michigan Federal Court Protects AI-Assisted Litigation Work Product, https://www.proskauer.com/alert/michigan-federal-court-protects-ai-assisted-litigation-work-product

19. In initial rulings, US federal courts split on the intersection of litigant, https://www.ibanet.org/US-federal-courts-split-on-litigant-AI-use-and-privilege-protections

20. Think Before You Type: Conversations With Artificial Intelligence, https://gordonarata.com/think-before-you-type-conversations-with-artificial-intelligence-chatbots-are-not-automatically-protected-by-attorney-client-privilege-or-work-product-doctrines/

21. Texas Business Court Weighs In On Discoverability of AI Prompts, https://www.foley.com/insights/publications/2026/06/texas-business-court-weighs-in-on-discoverability-of-ai-prompts/

22. AI in litigation: NY State Court weighs in on GenAI privilege, https://www.insidetechlaw.com/blog/2026/07/ai-in-litigation-ny-state-court-weighs-in-on-genai-privilege

23. Courts shield AI prompts and outputs from discovery \- Westlaw Today, https://today.westlaw.com/Document/I654166be970911f19975f13189762954/View/FullText.html?transitionType=CategoryPageItem\&contextData=(sc.Default)

24. Where are we on AI and Privilege? \- JLE \- Jennifer Ellis, JD, LLC, https://jlellis.net/blog/where-are-we-on-ai-and-privilege/

25. Morgan v. V2X Decision Marks Signals a Turning Point for AI Data, https://www.everlaw.com/blog/ai-and-law/morgan-v-v2x-ai-disclosure-in-discovery/

26. Morgan v. V2X, Inc. | 25-1991 | D. Colo. | Judgment | Law \- CaseMine, https://www.casemine.com/judgement/us/69cd113069295af9b35ae97c

27. A Federal Court Charts a Path on AI, Protective Orders and Work, https://www.kirkland.com/publications/kirkland-alert/2026/05/a-federal-court-charts-a-path-on-ai-protective-orders-and-work-product-in-discovery

28. New Federal Rule of Evidence 502 | District of South Carolina, https://www.scb.uscourts.gov/news/new-federal-rule-evidence-502

29. New Federal Rule of Evidence 502 Provides Protection for, https://www.hunton.com/media/legal/2934\_Rule\_502\_Client\_Alert.pdf

30. Troubling Ambition of Federal Rule of Evidence 502(d), The, https://scholarship.law.missouri.edu/cgi/viewcontent.cgi?article=4017\&context=mlr

31. enter the order, protect the privilege: considerations for courts, https://fordhamlawreview.org/wp-content/uploads/2016/01/Buffmire\_March.pdf