Litigation Minute: Generative AI Data, Attorney-Client Privilege, and the Work-Product Doctrine

Date: 23 February 2026

What You Need to Know in a Minute or Less

As generative AI (GenAI) tools become embedded in legal and business workflows, courts are grappling with questions regarding how attorney-client privilege and the work-product doctrine apply to GenAI data, including prompts, outputs, and activity logs. While recent decisions confirm that GenAI data may constitute discoverable electronically stored information (ESI) (discussed in a previous Litigation Minute), a separate and equally important question is when those materials may be protected from disclosure.

Recent case law makes it clear that courts will apply traditional privilege and work-product principles to this new category of ESI. Whether a privilege or protection applies will turn on how, why, by whom, and under what conditions GenAI tools are used.

Attorney-Client Privilege and GenAI

Attorney-client privilege protects confidential communications between lawyers and clients made for the purpose of seeking or providing legal advice. GenAI systems themselves, however, are neither lawyers nor clients, and communications with artificial intelligence (AI) tools are not privileged by default even when legal in nature.

Privilege may apply where GenAI is used under the direction and supervision of counsel to facilitate the provision of legal advice, similar to other nonlawyer assistants—but only where there is a reasonable expectation of confidentiality and that confidentiality is preserved. But is there a reasonable expectation of confidentiality when using GenAI?

United States v. Heppner, No. 25-cr-00503-JSR ECF 27 (S.D.N.Y. Feb. 17, 2026) addressed this specific issue. There, the defendant entered factual and legal prompts into a publicly available GenAI tool to analyze his potential legal exposure. He later shared the AI-generated analyses with his defense counsel. Federal agents seized his computer and the ESI it contained during a search of his residence, and the government moved to compel its production.

Judge Jed S. Rakoff held that the AI-generated content was not protected by the attorney-client privilege or the work-product doctrine. The court’s opinion emphasizes that:

The GenAI platform was a third-party tool for which there was no expectation of confidentiality;
The GenAI materials were not created at counsel’s direction, and by implication, were not created to facilitate the provision of legal advice; and
Transmitting AI-generated content to a lawyer after the fact did not retroactively render it privileged or protected.

The decision reinforces that the attorney-client privilege only applies to confidential communications between a lawyer and client to facilitate the provision of legal advice—it does not extend to documents that later become useful to counsel. The decision also highlights the heightened risk posed by unsupervised or exploratory GenAI use, particularly where public tools are involved.

The Work-Product Doctrine: GenAI Use in Anticipation of Litigation

The work-product doctrine protects materials prepared by or at the direction of counsel in anticipation of litigation, including heightened protection for material reflecting counsel’s mental impressions, conclusions, or legal strategy.

In the GenAI context, courts are beginning to distinguish:

GenAI data created at counsel’s direction to analyze claims, defenses, or litigation strategy, which may qualify as work product; and
GenAI data created independently for business or exploratory purposes, which generally does not.

In Heppner, the court rejected work-product protection because the AI-generated materials were not prepared at counsel’s direction and did not reflect defense counsel’s strategy. The ruling underscores that GenAI data is not work product simply because it addresses legal issues.

By contrast, in Tremblay v. OpenAI, Inc., the court reached a different conclusion. There, plaintiffs alleging copyright infringement conducted targeted presuit testing of ChatGPT to evaluate potential claims. Plaintiffs produced the prompts they relied upon in their complaint, but refused to produce additional prompts and outputs, arguing they reflected counsel’s mental impressions and litigation strategy. No. 23-cv-03223-AMO, 2024 WL 3748003 (N.D. Cal. Aug. 8, 2024).

The court agreed in part, holding that unused prompts, account data, and testing results constituted opinion work product prepared in anticipation of litigation. Importantly, the court rejected the argument that producing some AI interactions waived protection for all related materials, limiting waiver to the specific prompts and outputs affirmatively relied upon in the pleadings.

Privilege waiver considerations

Heppner and Tremblay focus primarily on whether privilege or work-product protection attach in the first instance. It is equally important to remember that such protection is easily waived where confidentiality is not maintained. If sensitive data is loaded to GenAI tools that permit data retention, reuse, or training, the waiver risk is heightened considerably.¹

Going forward, courts evaluating privilege claims over GenAI data are likely to focus on the open or closed nature of the AI platform used, the existence of contractual or policy-based confidentiality protections, and whether counsel directed or supervised the AI use.

Practical Tips to Preserve Privilege and Work-Product Protection When Using GenAI

Use Secure GenAI Tools

Use closed, enterprise platforms with terms of service that limit the service provider’s ability to store user inputs, review inputs for quality control purposes, and retain or use inputs to train or improve the GenAI model.

Supervise and Document AI Use

Treat GenAI like a supervised assistant. Prompts and outputs should be generated at counsel’s direction and reviewed by counsel.

Limit and Label

Avoid including otherwise privileged information in prompts and clearly label protected materials as privileged or work product protected; recognizing labels alone are not dispositive.

Remember the Metadata

GenAI activity logs and metadata could independently raise work-product concerns and reveal litigation strategy, such as when counsel investigated particular issues.

Consider Nonwaiver Agreements

Address GenAI data in ESI agreements and seek Rule 502(d) orders to mitigate waiver risk.

Prevent Privilege Challenges

Privilege logs should explain what the GenAI created data is, how it was created, who created it, and under what confidentiality controls it was created.

Looking Ahead

As Heppner illustrates, courts are applying established discovery doctrines to cutting-edge tools. Privilege disputes involving GenAI data will turn on supervision, purpose, and reasonable expectations of confidentiality.

Litigators should address these issues early, coordinate with e-discovery and information-governance teams, and counsel clients that casual or unsupervised GenAI use can generate discoverable—and unprotected—material.

¹ Importantly, confidentiality standards governing work product are less stringent than attorney-client privilege. Work-product protection is generally waived only when disclosure is made to an adversary, or to a third party in a manner that substantially increases the likelihood that the material will reach an adversary. In Warner v. Gilbarco, Inc., No. 2:24-cv-12333 (E.D. Mich. Feb. 10, 2026), the court denied a motion to compel discovery into a party’s use of GenAI tools in connection with the litigation, holding that AI-assisted internal analysis and drafting were protected by the work-product doctrine and that use of ChatGPT did not waive that protection absent disclosure to an adversary. When would information entered into publicly available GenAI systems be considered “reasonably likely to be obtained by an adversary”? Emerging case law will likely shape how waiver principles apply in this context.

Julie Anne Halter

Seattle

Alexa Stemmler