New Decisions Draw a Map of Privilege in the “New Frontier of AI”

Two recent district court rulings address an increasingly pervasive question for attorneys and their clients: What are the implications of putting confidential or privileged information into generative AI tools?

Those who use AI tools for legal advice or to generate meeting minutes now face a significant risk that otherwise protected communications will become available to the opposing side. Careful review of these rulings and application of their borders shows what may be, and what is not, protected.

In one of these cases, United States v. Heppner, a defendant named Bradley Heppner exchanged written submissions with a generative AI tool owned by Anthropic named Claude regarding Heppner’s legal defenses. When the government sought inspection of what Heppner submitted to Claude, he argued the submissions were privileged attorney-client communications and work product.

The court rejected Heppner’s arguments. A decision from a different court, Warner v. Gilbarco, however, left the door open to at least some protections.

Heppner Rejects that Claude Communications Are Privileged

Heppner argued that because he communicated with Claude while preparing to speak with his attorneys and subsequently shared Claude’s outputs with those attorneys, the communications were privileged. The court rejected this argument on the following grounds:

• No Attorney. The district court found that the communications were not attorney-client privileged because Claude is not an attorney.
• No Legal Advice. Relatedly, because Claude is not an attorney, Heppner could not claim that he communicated with Claude for the purpose of obtaining “legal advice.” In fact, when asked whether it could provide legal advice, Claude responded: “I’m not a lawyer and can’t provide formal legal advice or recommendations,” and promptly referred the user to seek a lawyer.
• No Confidentiality. The court also noted that Anthropic explicitly states Claude is not confidential and that the chatbot may “disclose personal data to third parties in connection with claims, disputes or litigation.” Confidentiality, however, is an express requirement of the privilege. In making this point, the court agreed with a recent decision in In re OpenAI, Inc., Copyright Infringement Litig., which noted that a user has no substantial privacy interests in conversations with a publicly accessible AI platform where the platform’s records are retained in the normal course of business.

Work Product Protection Has a Rocky, but Potential, Path

The Heppner court also rejected arguments that the communications were protected as work product because, finding they did not qualify as such because they were not prepared “by or at behest of Counsel.” In coming to this conclusion, the court relied upon the fact that the defendant’s attorneys were not involved in the act or strategy of using Claude merely by receiving the information that Heppner had produced: “While the AI Documents did ‘affect’ counsel’s strategy going forward, they did not ‘reflect’ counsel’s strategy at the time that Heppner created them.”

Heppner, however, did not close the gates completely on the notion that communications with generative AI tools could be protected in other instances, and the Warner decision expressly found that work product could apply.

• An Attorney “Agent.” The Heppner court contemplated that, “had counsel directed Heppner to use Claude, Claude might arguably be said to have functioned in a manner akin to … a lawyer’s agent within the protection of the attorney-client privilege.” The court reiterated this distinction in its discussion of the work product doctrine, stating that “Heppner was not acting as his counsel’s agent when he communicated with Claude” because the Claude communications were not “prepared by or at the behest of counsel” and did not “reflect defense counsel’s strategy.” The fine point the court drew in coming to this conclusion, however, suggests that generative AI has the ability to adopt the role of a “highly trained professional” acting as an “agent” of a lawyer, and that in this case, protection could exist over the use of an AI tool with counsel’s guidance.

• Preserving Work Product. A second recent district court case, Warner v. Gilbarco, Inc., went further, finding work product could apply, but in a very specific instance. In Warner, the plaintiff represented herself and the defendants’ attorneys persistently sought discovery concerning Warner’s use of third-party AI tools. Warner acknowledged that she used a “drafting interface” to prepare protected work product. In that circumstance, the Warner court found that, to the extent relevant AI communications existed, such communications were part of the plaintiff’s thoughts and mental impressions in litigating her case and were protected work product. In coming to that conclusion, the court also drew the distinction that many courts—including the Sixth Circuit, Southern District of New York and the D.C. Circuit—have found that work product (distinct from attorney-client communications) must be waived as to the adversary, rather than to the general public. Therefore, the use of AI on its own did not break the confidentiality of plaintiff’s work product.

Main Takeaways

While the Heppner court noted that “the implications of AI for the law are only beginning to be explored,” these two decisions provide some waypoints.

First, savvy clients should keep in mind that information put into generally available AI products is not confidential. Even if not absolutely open to opposing parties, this should give one pause before exposing legal advice to AI tools. That specifically includes AI notetakers that video meeting software now routinely offers. Equally, in discovery of opposing parties, it could be of significant value to inquire into whether they take advantage of such tools and then seek production of whatever inputs the opposing parties provided.

Second, the loss of confidentiality destroys a claim of attorney-client privilege. Clients should be extremely cautious before exposing portions of protected materials to AI. Indeed, through subject-matter waiver, even limited exposure could lead to the loss of the privilege entirely.

Third, where one is acting without an attorney, one may be able to protect their AI-enhanced materials as work product.

Fourth, following the track set forth in Heppner, an extremely careful use of AI at the behest of counsel, could be argue to retain protection. The key here would be that AI must be shown to be the equivalent of an attorney’s agent.

As the Heppner court aptly stated, generative AI “presents a new frontier in the ongoing dialogue between technology and law.” These cases provide some markers, but are not likely the ultimate destination on the use of AI. We expect court guidance to continue to emerge on these issues.

---

This document is intended to provide you with general information regarding how privilege and confidentiality may apply to use of AI in litigation. The contents of this document are not intended to provide specific legal advice. If you have any questions about the contents of this document or if you need legal advice as to an issue, please contact the attorneys listed or your regular Brownstein Hyatt Farber Schreck, LLP attorney. This communication may be considered advertising in some jurisdictions. The information in this article is accurate as of the publication date. Because the law in this area is changing rapidly, and insights are not automatically updated, continued accuracy cannot be guaranteed.