Does Using ChatGPT Waive Attorney-Client Privilege? What the Heppner Ruling Means for Law Firms

Key takeaways

• Privilege is at risk with public tools. A client's own chats with a public AI tool (Claude, not ChatGPT) were not privileged in Heppner, and the reasoning applies to any consumer chatbot.

• Work product is split. Some federal courts protected pro se litigants' AI-assisted preparation; Heppner denied it to a represented client acting alone.

• Texas has its own rule. The Texas Business Court applied Texas Rule of Civil Procedure 192.5 and disagreed with Heppner, in an interim ruling.

• The ethics duties apply regardless. ABA Formal Opinion 512 and Texas Opinion 705 expect lawyers to understand a tool's terms before client information goes in.

What happened in United States v. Heppner?

Judge Jed S. Rakoff of the Southern District of New York called the issue "a question of first impression nationwide." He ruled from the bench on February 10, 2026, and filed a written memorandum on February 17.

The facts

Bradley Heppner was indicted on securities fraud, wire fraud and related charges. In 2025, after receiving a grand jury subpoena and learning he was a target, he used Claude, the AI assistant operated by Anthropic, to prepare reports outlining defense strategy. He did this on his own. His lawyers conceded they "did not direct [Heppner] to run Claude searches."

FBI agents seized about 31 of these documents under a search warrant when he was arrested. Heppner had shared their contents with his lawyers, who claimed privilege over them.

Why the court said there was no attorney-client privilege

Privilege protects communications that are (1) between a client and a lawyer, (2) intended to be and actually kept confidential, and (3) made to get or give legal advice. The court found the AI documents lacked "at least two, if not all three" of those elements.

• Not a communication with a lawyer. Claude is not an attorney, and the court said that alone disposed of the claim.

• Not confidential. The court looked at the publicly available version of the tool, under the written privacy policy its users agree to. It said that policy lets Anthropic collect users' inputs and Claude's outputs, use that data to train Claude, and disclose it to third parties, including "governmental regulatory authorities."

• Not for legal advice. Heppner did not use Claude at his lawyers' direction, and Claude itself disclaims giving legal advice.

Sharing the outputs with his lawyers afterward did not help: non-privileged communications "are not somehow alchemically changed into privileged ones upon being shared with counsel."

Why the court said there was no work product

In the Second Circuit, work product protects material "prepared by or at the behest of counsel" in anticipation of litigation. Heppner prepared the AI documents on his own, and they did not reflect his lawyers' strategy when he created them. The court expressly disagreed with an earlier decision from the same district, Shih v. Petal Card, which had held that work product is not limited to materials prepared by or at the direction of a lawyer.

What the court left open

The court noted that if counsel had directed Heppner to use Claude, Claude "might arguably be said to have functioned in a manner akin to a highly trained professional who may act as a lawyer's agent." That points to the United States v. Kovel line of cases, which can extend privilege to non-lawyers who help a lawyer give advice. The court did not decide that question.

Does putting client information into ChatGPT waive privilege?

It can. ChatGPT was not the tool in Heppner, but the court framed the question around a "publicly available AI platform" and the terms its users accept. In footnote 3, the court addressed the argument that the documents included information Heppner had learned from his lawyers. Even if some of what he typed in was privileged, the court said, "he waived the privilege by sharing that information with Claude and Anthropic, just as if he had shared it with any other third party."

That does not mean every use of AI destroys privilege, and it does not mean AI is safe. The court weighed specific facts: the platform's terms on collection, training and disclosure; who directed the use; and whether the exchange was made to get legal advice from a lawyer. Those questions apply equally to ChatGPT, Claude or any other public AI tool. (AI notetakers and transcription tools raise related questions outside the scope of this page.)

Privilege vs. work product: why are courts splitting?

The two protections fail in different ways. Attorney-client privilege is generally waived when a communication is disclosed to any third party. Work product generally survives unless the material is disclosed to an adversary, or in a way that substantially increases the chance an adversary will get it. That difference explains most of the split.

Warner v. Gilbarco (E.D. Mich.)

In Warner v. Gilbarco, Inc. (E.D. Mich. Feb. 10, 2026), the defendants asked a pro se plaintiff to produce all documents and information about her use of third-party AI tools in the lawsuit. Magistrate Judge Anthony P. Patti denied the request, finding that even if the material were discoverable, it was protected work product. Using ChatGPT did not waive that protection, because "the work-product waiver has to be a waiver to an adversary or in a way likely to get in an adversary's hand." He added that ChatGPT and other generative AI programs "are tools, not persons."

Morgan v. V2X (D. Colo.)

In Morgan v. V2X, Inc. (D. Colo. Mar. 30, 2026), Magistrate Judge Maritza Dominguez Braswell held that a pro se plaintiff's AI-assisted litigation preparation could be protected under Federal Rule of Civil Procedure 26(b)(3). The protection had limits. The court ordered him to disclose the name of any AI platform he had used with information designated confidential, and it amended the protective order. Under the amended terms, no one may put confidential information into an AI tool unless the provider is contractually prohibited from "storing or using inputs to train or improve its model" and from disclosing inputs to third parties except where essential to the service. The provider must also let the user delete the information on request.

A New York state court reached a similar result in Assini v. Hayward (N.Y. Sup. Ct., Nassau Cty., June 4, 2026), quashing an OpenAI subpoena for a self-represented litigant's ChatGPT records on work-product grounds after finding Morgan's reasoning persuasive; it did not find attorney-client privilege.

What's the rule in Texas?

On June 3, 2026, Judge Grant Dorfman of the Business Court of Texas, Eleventh Division, entered a minute entry in Tate Group Automotive, LLC v. Legacy Automotive Capital, LLC after reviewing a non-lawyer's ChatGPT conversations in camera. The plaintiff, a represented party, had withheld them as work product. The defendants argued that work product does not cover a non-lawyer's AI chats, or that using AI waived it.

The court agreed with Warner and Morgan, said it "disagrees with" Heppner, and noted that all three were federal cases. Texas Rule of Civil Procedure 192.5(a)(1) protects material prepared or mental impressions developed in anticipation of litigation or for trial "by or for a party." The court said the Texas rules "plainly appear on their face" to extend that protection to the ChatGPT conversations.

The ruling had limits:

• The court ordered some pages produced because they were not work product, and allowed the rest to be withheld.

• It ordered the plaintiff to disclose all discovery materials it had shared with ChatGPT, including material produced under the protective order.

• It recommended that the parties consider amending the protective order to make clear whether, and how, confidential information may be shared with AI tools.

• It said these minute entries are "not intended to be final," and gave the parties leave to seek a final ruling.

Keep it in proportion. This is an interim ruling from one trial-level business court, not an appellate decision, and it protected work product for a represented party rather than recognizing attorney-client privilege. It does not set a statewide rule. Texas ethics guidance, Opinion 705, is covered below.

Does a paid, enterprise, or private AI tool change the answer?

It changes one of the facts the court relied on, but not the whole analysis. Heppner turned partly on the privacy policy that users of that tool agree to: collection of inputs and outputs, training, and disclosure to third parties, including government authorities. A tool whose contract bars training and outside disclosure removes that particular reason. That is why commentators point firms toward enterprise or internally controlled systems, and why Morgan tied its protective order to contractual no-training, no-disclosure and deletion terms.

But confidentiality alone does not create privilege. As an ABA Litigation Section article puts it, even a confidential, sandboxed enterprise platform "does not automatically cloak discussions of legal theories or strategy with privilege." Privilege still requires a confidential communication between lawyer and client made for legal advice. Work product still requires material that meets the court's test, which in some courts means counsel's direction. None of the decisions discussed here held that using a particular private tool preserves privilege.

The questions that mattered in these cases (where the data goes, who can see it, whether it is kept, and whether it is used for training) are the questions a written data boundary answers. See how a written data boundary works, and our page on private AI for law firms.

What do ABA Formal Opinion 512 and Texas Opinion 705 require?

Privilege is about what a court will protect. The ethics opinions are about what a lawyer must do before client information goes into a tool.

ABA Formal Opinion 512 (July 29, 2024)

• Lawyers should read and understand a tool's Terms of Use, privacy policy and related contractual terms, or consult someone who has.

• Because many self-learning AI tools could lead to disclosure of information relating to the representation, the client's informed consent is required before that information goes in.

• Informed consent means a real explanation of risks and benefits. In the opinion's words, "merely adding general, boiler-plate provisions to engagement letters purporting to authorize the lawyer to use GAI is not sufficient."

Texas Opinion 705 (February 2025)

The Professional Ethics Committee for the State Bar of Texas said that whenever a lawyer intends to provide client confidential information to an AI program, Rule 1.05 "will likely be implicated." The lawyer should be "reasonably satisfied" that the program will not reveal confidential information or allow its use to the client's disadvantage. If not, the lawyer should, at a minimum, not input confidential information "without client consultation and consent."

The reasonable precautions the opinion lists include understanding how the technology works, reviewing and potentially renegotiating the terms of service, learning the tool's data-security protections, and training lawyers and staff. The opinion also says lawyers should consider informing clients about the risks and may need their consent.

What if your client used ChatGPT on their own case?

Heppner is this fact pattern. The defendant used a public AI tool "of his own volition," and his lawyers conceded they had not directed it. That combination sank both privilege and work product.

In civil cases, Warner, Morgan and Tate Group show that work product arguments may still be available, depending on the court and its rules. Steps firms often consider:

• Talk to clients early. A Wilson Elser article recommends instructing clients not to enter attorney communications, case facts, witness information or legal strategy into public AI platforms without counsel's approval.

• Put it in writing. Add the instruction to engagement letters and intake materials.

• Ask at intake. Find out whether a new client has already used AI on the matter.

A practical checklist for firms

• Written AI policy. List which tools are approved for which kinds of data, and which are not approved for client information.

• Read the terms. For each tool, check the training, retention and disclosure terms, and get them in writing (ABA 512, Texas 705).

• Client consent where the opinions call for it. Explain the risks specifically. Under ABA 512, boilerplate is not enough.

• Counsel-directed workflows. For litigation work, have a lawyer direct and document AI use. Heppner left open whether counsel-directed use could change the privilege result.

• Client instructions. Tell clients not to put case facts, attorney communications or strategy into public AI tools without your approval.

• Protective orders. Consider AI-use terms, as Morgan ordered and Tate Group recommended.

• Verify every citation. Check every AI-cited authority before filing. Texas Opinion 705 says lawyers should always verify the accuracy of AI responses.

How OptiVis approaches this

The questions courts and ethics opinions keep asking are concrete: where does the data go, who can see it, is it kept, and is it used for training? OptiVis builds private AI for law firms that answers from your own documents and shows the passage each answer came from. Every engagement comes with a written data-boundary document that answers those questions before anything is built.

Work starts with a $7,500 diagnostic on one workflow. Builds start at $25,000, and ongoing operations start at $2,500 a month. A data boundary does not make anything privileged, and that judgment stays with your lawyers, but it gives them the facts to make it. New to us? Read What is OptiVis?.