Attorney-Client Privilege and AI Legal Research Tools
AI tools with broad data-use terms destroy attorney-client privilege the moment you type.
Whether attorney-client privilege survives the use of an AI legal research tool turns on a single, answerable question: does the tool disclose data to a third party? That question, not the novelty of the technology itself, is what 2026's first wave of court decisions has forced lawyers and their clients to confront directly.
How the third-party disclosure doctrine determines whether privilege survives AI use
Attorney-client privilege rests on confidentiality, and if information passes to a third party outside the protected relationship, that confidentiality breaks. That principle, the third-party disclosure doctrine, is the lens through which every decision about AI use in a legal matter has to run. Three elements have to hold at the same time for privilege to attach at all: a communication between attorney and client, made in confidence, for the purpose of obtaining legal advice. If any one of the three is missing, the privilege claim fails, regardless of how sensitive the content might be.
The work-product doctrine runs alongside privilege, but it is not the same protection. It covers materials prepared by, or at the direction of, counsel in anticipation of litigation, and it has its own requirements and its own failure points. A document can lose work-product protection through disclosure to an adversary even when no attorney-client communication was ever at issue, so AI use can defeat one protection while leaving the other intact, or it can defeat both at once. Lawyers evaluating an AI tool need to run each test separately.
None of this is conceptually new. Nearly every prior shift in how lawyers and clients communicate, from fax machines to cloud email to outside vendors retained for document review, has forced the same question: was the client's confidence exposed to an outsider in a way inconsistent with the protection claimed? What changes with AI is not the legal test but the mechanism by which disclosure happens. When a lawyer or client types information into an AI tool, the determination of whether a third-party disclosure occurred rests on the tool's architecture: its privacy policy, its data retention practices, and whether it feeds user inputs into a training pipeline. That determination holds regardless of what the user intended by typing the message. An AI tool built from the ground up so that user data stays with the user, never collected, never retained for training, never disclosed to outside parties, does not trigger the doctrine. A consumer platform with broad data-use clauses in its terms of service triggers it immediately, and no amount of good faith on the user's part changes that outcome. What does the tool's privacy policy actually permit?
The 2026 Case Law on AI Tools and Confidentiality
The first wave of 2026 court decisions did not invent a new privilege rule for AI. Courts applied the doctrine described above to a new set of facts, and the outcomes turned on who used the tool, under whose direction, and whether confidentiality was preserved at each step. Two cases, decided within a week of each other, show the framework producing opposite results on different facts.
In United States v. Heppner, No. 1:25-cr-00503-JSR (S.D.N.Y., Feb. 10, 2026), Judge Jed Rakoff confronted what he called a question of first impression nationwide: whether a criminal defendant's exchanges with the AI platform Claude were protected by attorney-client privilege or the work-product doctrine. Bradley Heppner, after receiving a grand jury subpoena and learning he was the target of a federal investigation, used Claude on his own initiative to prepare reports outlining potential defense strategy and arguments on the facts and the law, then sent those reports to his attorney. Judge Rakoff denied privilege on three independent grounds. Claude is not an attorney, so no attorney-client communication existed. Anthropic's privacy policy permits the company to collect user inputs and outputs, use them for model training on consumer accounts unless the user opts out, and disclose them to third parties including government authorities, a set of terms the court found defeated any reasonable expectation of confidentiality. Heppner had not used Claude at counsel's direction, and the resulting outputs did not reflect defense counsel's strategy or work product.
Warner v. Gilbarco (E.D. Mich., Feb. 10, 2026) reached the opposite result on different facts. A pro se plaintiff in an employment discrimination case had used an AI tool to help prepare litigation materials, so the defendants moved to compel production of everything AI-related and challenged her work-product objection. The court held the materials were protected, reasoning that waiver of work-product protection requires disclosure to an adversary, and that an AI program is a tool, not a person. That tool framing kept the protection intact. The analysis was shaped by a protective order the court had modified back in October 2025, which prohibited uploading confidential discovery materials to any AI platform, a precaution that had already set the boundaries before the dispute reached the court.
The two cases are fact-intensive applications of the same doctrine, diverging on who used the AI, for what purpose, under whose direction, and whether confidentiality was preserved throughout. One involved a defendant acting alone, feeding attorney communications into a consumer tool with no instruction from counsel. The other involved a litigant using an AI tool under a court order that already restricted what could be uploaded, with no disclosure ever reaching an adversary. The doctrine did not bend. The facts simply pointed in different directions.
The Confidentiality Ground in Heppner
The headline-grabbing line out of Heppner, that Claude is not a lawyer, is the least consequential part of the ruling for most people who will ever use an AI tool in connection with a legal matter. The more dangerous holding is that a tool's own terms of service can independently destroy confidentiality before any information ever reaches an opposing party. Anthropic's consumer Claude privacy policy, the one users consent to by clicking accept, permitted data collection on inputs and outputs, model training on that data, and disclosure to third parties including government regulatory authorities. On those terms, the court held, Heppner could have had no reasonable expectation of confidentiality in anything he typed into the platform. The waiver happened at the moment of use, not at the moment anyone else read the output.
This reasoning does not stay confined to criminal defendants who act without a lawyer's knowledge. It applies to any public-facing consumer AI platform whose terms of service include comparable data retention, training, or disclosure provisions, and the privilege analysis plays out identically whether the user is a criminal defendant, a corporate employee, or a party in an ordinary civil dispute. You might think a civil litigant typing a quick question into a free AI chatbot bears no resemblance to Heppner drafting defense strategy ahead of an indictment. But the doctrine does not distinguish by the gravity of the underlying matter. It asks only whether a reasonable expectation of confidentiality could have existed given what the platform's own policy permits.
AI chat logs, the prompts typed in and the outputs received, are electronically stored information, and that makes them subject to discovery under the Federal Rules of Civil Procedure whenever they are relevant, nonprivileged, and proportional to the needs of the case. That alone would be a manageable risk if the only thing exposed were the AI conversation itself. The more severe exposure runs backward. Feeding information a lawyer gave a client into a public AI tool can waive privilege over the original attorney-client communication, not just over the new conversation with the AI. The AI outputs do not sit unprotected on their own; they can pull previously protected conversations out of privilege along with them. That cascading effect is the part of Heppner's reasoning most likely to blindside lawyers who assume the risk begins and ends with whatever gets typed into the chat box.
The same exposure reaches people who never thought of themselves as making a privilege decision. If an employee uses a consumer AI tool on their own to research a legal question, or to input case facts before ever speaking with in-house counsel, the outputs are discoverable under Heppner's reasoning, because the use was unsupervised and the platform's terms already defeated confidentiality before counsel ever entered the picture. AI transcription and note-taking tools add a further layer of exposure: a privileged conversation recorded automatically by such a tool can become a third-party-held record subject to the same analysis, even if no one in the room intended to create one.
The court did leave open one narrower path. If Heppner's counsel had directed him to use Claude for this purpose, the tool might have functioned as an attorney's agent under the Kovel doctrine, the rule that extends privilege to certain non-lawyer agents retained to assist counsel. That pathway simply was not available on Heppner's facts, since he acted on his own initiative without any direction from his attorneys. The distinction matters because it signals that attorney direction alone will not rescue a privilege claim if the underlying tool's architecture still permits the kind of data collection and disclosure the court found fatal. Direction might open the door to an agency argument, but the tool's own terms of service still have to hold up once the door is open.
Why enterprise architecture changes the privilege analysis
The risk created by consumer AI tools is architectural. No amount of careful typing, redaction, or caution fixes a tool whose underlying terms of service already permit data collection, training, and third-party disclosure. The only fix is using a tool whose architecture does not create a third-party disclosure to begin with.
The 2026 opinions already draw that distinction, even without naming it directly. The courts that adopted the tool framing and preserved work-product protection did so on facts where enterprise-grade controls, or at minimum a protective order restricting what could be uploaded, were already in place. The court that denied protection did so on facts involving a consumer platform with none of those controls, used without any instruction from counsel. The line the courts are drawing is between an architecture that permits disclosure and one that does not.
An enterprise license by itself does not settle the question. The contract between a law firm or client and an AI vendor has to affirmatively address data segregation between clients, confidentiality obligations that are enforceable rather than aspirational, transparency about how inputs and outputs are actually used, audit rights, and clear policies on data retention and deletion. A vendor calling its product "enterprise" without those specific contractual commitments has not changed the privilege analysis at all; it has only changed the marketing.
Several architectural features recur across the tools that have survived scrutiny so far, and you can use them as a practical checklist before you put privileged information anywhere near a platform. It does not train on customer data, so inputs and outputs never get folded into model improvement. Retention does not go beyond ephemeral processing, so nothing sits in a form the vendor can access once the session ends. No human review of customer content by vendor employees. Authenticated, segregated workspaces that keep one client's data walled off from another's. Regional data processing in regions the customer selects. Contractual confidentiality commitments that can actually be audited, not just asserted. If a tool satisfies all six, that does not guarantee privilege will survive every fact pattern, but it removes the specific mechanism that destroyed privilege in Heppner.
Evaluating AI Legal Research Tools Against the Privilege Framework
Evaluating any AI legal research tool for privilege safety comes down to the same two questions the courts themselves have been asking: what does the platform's architecture actually permit, and what do the contract terms actually say? Judged by name, several tools illustrate how that evaluation plays out in practice.
Confidant AI was built from the ground up around privacy preservation, rather than retrofitting privacy controls onto a general-purpose consumer product. It does not collect or use client data for model training, it does not retain data beyond the session, and it does not let employees review user content. That architecture addresses the specific mechanism that defeated privilege in Heppner directly: the privacy policy and terms of service do not include the data collection, model training, or third-party disclosure provisions that Judge Rakoff found fatal to confidentiality. If you need AI capability without trading away the confidentiality privilege depends on, that positioning reflects a deliberate architectural choice, not a compliance checkbox added after the fact. Confidant AI's named deployments include Allen & Overy Shearman, Latham & Watkins, and PwC Legal, among other firms.
Harvey was built for lawyers rather than general consumers, and its architecture includes authenticated workspaces, no training on customer data, no retention beyond ephemeral processing, no human review of content, and regional data processing in regions the customer selects. Its enterprise agreements include contractual confidentiality protections, features designed to support the kind of confidentiality discipline privilege requires. Named deployments include Allen & Overy Shearman, Latham & Watkins, and PwC Legal, among others.
Thomson Reuters CoCounsel Legal is positioned as an enterprise legal platform, one you deploy at a law firm. Its fit for privileged work depends on the specific data handling and confidentiality terms in its deployment contract, which should be checked against the architectural checklist above before any firm relies on it for privileged matters, the same scrutiny that applies to any enterprise AI vendor regardless of its reputation.
Consumer-facing tools, the public versions of ChatGPT, Claude, and similar platforms, are assessed against the identical framework, and their publicly available terms of service include the data collection, training, and disclosure provisions that Heppner found fatal to privilege. Under the current state of the case law, none of them are appropriate for inputting privileged information.
Ethics Rules for Choosing an AI Tool
The privilege analysis and the professional responsibility analysis arrive at the same act: reading and actually understanding the terms of service of any AI tool before putting client information anywhere near it. It is the mechanism by which a lawyer satisfies the duty of competence and the duty of confidentiality at the same time, since both duties now depend on technical facts about data collection, retention, and training that live inside a privacy policy.
It falls on lawyers because the privilege holder's conduct, not that of bar associations or software vendors, is what the doctrine examines. A vendor's privacy policy is a fact in the record, not an excuse. A lawyer who directs a client toward an AI tool, or who uses one personally in preparing a matter, is making a confidentiality decision whether or not it feels like one, and Heppner shows what happens when that decision gets made without anyone having read the terms. The architectural checklist developed in the two sections above exists for exactly this purpose: to give lawyers a concrete, repeatable way to answer the question courts are now asking, before a court has to ask it for them.
