Data Privacy and Attorney-Client P

With artificial intelligence tools becoming part of everyday decision-making, for some, chatbots are a first stop for help with answering questions, including questions that feel “legal” in nature. Such questions might include whether a contract clause is enforceable, how to respond to a demand letter, or what to say in an internal investigation. The AI response, while prompt and convenient, carries legal risk. Sensitive facts entered into a consumer-facing AI chatbot may be discoverable, and the act of using the tool can undercut attorney-client privilege.

A recent development in the Southern District of New York illustrates such risk. In a pretrial conference in United States v. Heppner, U.S. District Judge Jed S. Rakoff ruled from the bench that a defendant could not claim privilege over dozens of documents he generated using an AI service and then later forwarded to his lawyers. The underlying case is a federal criminal prosecution in which a grand jury indicted the defendant for securities fraud and other related charges. The FBI seized the “AI documents” during the execution of a search warrant at the defendant’s home at the time of his Nov. 4, 2025, arrest. Defense counsel later identified approximately 31 documents memorializing written exchanges with a generative AI platform. The defendant had prompted the chatbot to prepare reports outlining his defense strategy, his potential arguments on the facts and the law, and the charges he anticipated the government might bring. In ruling on what the court called a “question of first impression nationwide,” Judge Rakoff declined to adopt the defendant’s position that the AI documents were privileged.

Courts are continuing to address how traditional privilege doctrines apply to modern AI tools, and the implications for clients remain an evolving area of law. Using a third-party chatbot as a substitute for a confidential conversation with counsel can implicate waiver arguments and discovery exposure. To understand the significance of the ruling, it is helpful to review the principles on which it rests.

Attorney-Client Privilege Depends on Confidentiality

The attorney-client privilege generally protects communications between a client and an attorney that are intended to be – and actually kept – confidential and that are made for the purpose of obtaining or providing legal advice.[1] Courts also emphasize that privilege is narrowly construed because it withholds potentially relevant information from the truth-seeking process.[2]

In practical terms, privilege is not a general label that can be placed on any document that relates to lawyers, lawsuits, or legal topics. Privilege is a rule that protects confidential legal communications with counsel. If confidentiality is lost, the protection may be lost with it.

How the Privilege Can Be Waived

Privilege can be waived in ways that clients may not anticipate. If a client shares information with a lawyer in confidence to obtain legal advice, courts have generally found that communication to be protected by the privilege. But if that same information is then disclosed to a friend who is not part of the attorney-client relationship, waiver may result because the information was voluntarily shared with a third party. Courts generally place the responsibility on the client to preserve the confidentiality of legal advice.[3]

In practice, common ways privilege may be waived include:

First, sharing privileged information with third parties. This can be as informal as telling a friend, consultant, or business contact what counsel advised, or forwarding an email from counsel to someone outside the privileged circle. Once information is voluntarily shared with someone outside the scope of the attorney-client relationship, the communication may no longer be considered confidential.[4] 

Second, using communication channels that are not private. Courts have applied waiver principles where a person uses a channel in which there is no reasonable expectation of privacy, such as an employer-monitored work email system.[5] Privilege depends on confidentiality, and confidentiality may be lost if the channel is subject to monitoring or access by others.

Third, disclosing the substance of legal advice in a way that puts it “at issue.” For example, if a party affirmatively relies on advice of counsel as part of a claim or defense, that can open the door to discovery into related privileged communications, depending on the circumstances and the scope of the assertion.[6]

Why Consumer AI Chatbots Create a Privilege Risk

Many AI chat tools are provided by third parties whose terms and privacy practices may allow prompts and outputs to be stored, reviewed, used for product improvement, shared with vendors, or produced under legal process. Even if the tool feels private, unless it is configured properly, using it may mean disclosing sensitive facts to someone other than your lawyer, which can undermine the confidentiality element that privilege requires.

The Heppner ruling reflects that concern in a concrete way. A central reason confidentiality failed was the “consent” the defendant gave as a user of the AI platform. Judge Rakoff pointed to the platform provider’s written privacy policy, to which users consent, stating that the company collects users’ “inputs” and the platform’s “outputs,” may use that data to train the platform, and reserves the right to disclose data to third parties, including governmental regulatory authorities, and in connection with claims, disputes, or litigation. The court concluded that these terms put users on notice and that the defendant could therefore have no reasonable expectation that his communications with the platform were confidential.

A related consideration is that sending a document to a lawyer does not automatically make it privileged if it was not privileged when it was created. Courts have recognized that forwarding preexisting materials to counsel does not transform them into privileged communications.[7] The judge in Heppner made this point explicitly, holding that even if the defendant intended to share the AI platform exchanges with his attorneys (and later did), “non-privileged communications are not somehow alchemically changed into privileged ones upon being shared with counsel.”

Work Product Is Different, But It May Not Solve the Problem

Some parties look to the work-product doctrine instead of attorney-client privilege. The work-product doctrine generally protects materials prepared by or for counsel in anticipation of litigation.[8] As a practical matter, that protection may be harder to establish when a client, acting alone and without counsel’s direction, generates materials using a third-party AI tool. As Judge Rakoff confirmed in his ruling, AI documents prompted by a client do not qualify as protected attorney work product because they were not “prepared by or at the behest of counsel.”[9] 

Practical Considerations

Organizations and individuals may wish to consider that risks associated with inputting private, confidential, or sensitive information into consumer-facing AI chatbots – particularly facts that would otherwise be shared only with counsel or facts learned from counsel. Such information may include draft timelines, summaries of witness conversations, internal assessments of risk, strategy notes, draft statements, or other narratives that a party would not be comfortable producing in discovery.

Those wishing to use AI tools may benefit from discussing available options with counsel. In many situations, using approved tools and controlled workflows – which operate in a closed environment and, unlike publicly available chatbots, may better preserve the confidentiality of information entered into them – could reduce certain risks.