Is Your AI Conversation Privileged?

‍

There are numerous AI tools available now that offer legal help, including drafting patent specifications, evaluating prior art, and preparing responses to office actions. Much has been said about the confidentiality of AI tools, you don’t want your AI tool to repeat your secrets (corporate or otherwise) to some stranger. But in the legal realm there is another concern, what if your opponent in litigation can demand access to your AI conversations.

Ordinarily, legal advice sought from a lawyer is privileged, it shouldn’t be available to an opponent in litigation. But what if you ask an AI tool for legal advice? Does using a tool that maintains privacy in the general sense protect you, or is that just as vulnerable in court?

Until recently these questions had no court-tested answer. But on the same day in February 2026, two US courts gave the first and, at first glance, opposite answers. The takeaway: an AI exchange that looks identical from the outside can be privileged in one party’s hands and discoverable in another's, depending on who set it up and how.

Heppner: When AI use sits outside the privileged relationship

In United States v. Heppner, Judge Rakoff of the Southern District of New York held that documents the defendant had generated using a public AI platform were not protected by attorney-client privilege. Bradley Heppner, anticipating a federal investigation, used a generative AI tool to draft multiple documents analyzing his potential defenses and legal exposure. He did this on his own initiative, before involving counsel, and only later shared the materials with his lawyers. Federal agents seized them in the execution of a search warrant.

The court held that no privilege attached, on three grounds. First, the AI tool was not a lawyer, and privilege requires communication with counsel. Second, the platform's terms of service permitted retention of inputs, use of those inputs to train the model, and disclosure to third parties including governmental authorities - meaning the defendant could have no reasonable expectation that what he shared would remain confidential. Third, the privilege test requires that the communication be for the purpose of obtaining legal advice. The court held that purpose was not met. No lawyer had directed Heppner to use the AI tool, so the use was not part of obtaining advice from counsel; and the platform's own terms disclaimed providing legal advice, undermining any claim that Heppner was seeking it from the tool itself.

The third point may be the most instructive. The court observed that "had counsel directed Heppner to use the AI tool, the tool might arguably be said to have functioned in a manner akin to a highly trained professional who may act as a lawyer's agent within the protection of the attorney-client privilege." This suggests the court was not hostile to AI in legal work; it was attentive to who was directing the work, in what relationship, and on what platform.

A footnote in the opinion adds a further caution. Even where information was originally privileged because it had been received from counsel, sharing it with the AI platform constituted disclosure to a third party and waived privilege as to that information. This waiver risk applies regardless of whether the user is the client or a non-lawyer team within the company.

Warner: Where work product is more forgiving

In Warner v. Gilbarco, decided the same day in the Eastern District of Michigan, a pro se plaintiff had used Chat GPT to prepare litigation materials. (A pro se plaintiff is someone who brings an action themselves without being represented by a lawyer.) The defendants moved to compel production of those materials. The court denied the motion, holding the materials were protected by the work-product doctrine.

Work product is a distinct protection from attorney-client privilege. It covers materials prepared in anticipation of litigation, and its waiver standard is meaningfully different. While disclosure of privileged information to a third party generally waives privilege, work-product waiver requires disclosure to an adversary, or in a manner that substantially increases the likelihood of adversary access. The court in Warner held that inputting materials into a generative AI platform did not meet that threshold, and was unconcerned that the platform "may have administrators somewhere in the background."

Warner therefore does not contradict Heppner. The two decisions apply different doctrines with different waiver standards, and they answer different questions. Together, they suggest that work product may survive AI use even where privilege would not, though the Heppner court's confidentiality analysis is a reminder that the platform's data terms could be vital, and the law in this area is still developing.

So should I avoid AI?

Read together, the cases suggest three considerations for whether work with AI is likely to be privileged:

1. the relationship within which the AI work was done;

2. the confidentiality policies of the platform on which it was done; and

3. the purpose for which it was done.

Where AI is used outside any attorney engagement, on a platform whose terms permit retention, training, and disclosure, and without an attorney  directing the work, Heppner shows that privilege can be lost.

On the other hand, where the use of AI addresses each of those concerns - qualified counsel using or directing AI use, on a platform configured to preserve confidentiality (e.g., no retention beyond what the engagement requires, no use of inputs for training, no third-party disclosure), for the purpose of providing legal advice, the analysis is materially different.

These are only the first cases on the topic. More will surely come, from more senior courts, and the law will develop case by case. And other countries may take different views from  the US. It would be premature to draw any firm conclusions, but already we have a useful guide.

From these two cases, the practical takeaways for patent drafting and prosecution are

i. make sure you know your (or your attorney’s) AI platform’s data terms; and

ii. AI use by registered patent attorneys  seems more likely to retain privilege than direct in-house (non-lawyer) use.

Visser AI, EIP's AI service for patent work, has been built around these considerations. The tools we use operate with zero data retention policies in place - meaning that not only is there no training on your data; the AI services do not retain your data at all.

Get in touch with Callum Docherty, or your usual EIP contact, if you’d like to learn more about Visser AI from EIP and Hybrid Intelligence. We can show you how we can improve outcomes and allow your patent budget to go further – while keeping your data secure.