AI Privilege Waiver Not Automatic, Post-Heppner Courts Find

Estimated reading time: 7 minutes · Last updated: 13 November 2026

Using an AI tool does not by itself waive attorney-client privilege or work-product protection, according to Andrea D'Ambra, Ellen Blanchard and Marissa Elder of Norton Rose Fulbright. Their argument answers a wave of warnings set off by United States v. Heppner, in which a Manhattan federal judge ruled that a criminal defendant's chats with Claude were not privileged. The three lawyers read that ruling as narrow and tied to its facts. They point to later decisions in Colorado, New York and Texas that treat AI as an instrument for legal work rather than an outsider. On their reading, AI privilege waiver turns on the kind of tool, the vendor contract and who directed the work, not on the mere presence of software.

What Heppner Held, and Why It Set Off Alarms

In Heppner, the court gave two reasons for refusing protection to the defendant's conversations with Claude. Claude is, in the court's words, "not a lawyer." And the company behind it keeps the right to look at prompts and outputs on the version anyone can use.

The Norton Rose Fulbright lawyers also describe the case as turning on a consumer-grade transcription platform whose vendor could reach communications for its own ends, model training among them. As they summarise it, the court set such tools apart from enterprise-grade platforms bound by contractual confidentiality and zero-retention terms. Zero retention means the vendor keeps no copy of the data once it has been processed.

That distinction fed broader warnings that AI notetakers, applicant screeners, consumer transcription apps and HR analytics tools used in internal investigations give up privilege by default. One version, which the lawyers attribute to commentators they do not name, casts notetakers as third-party interceptors under the Electronic Communications Privacy Act and the California Invasion of Privacy Act. D'Ambra and her colleagues reply that the same reasoning would condemn email, or any service that keeps data on another company's servers.

The real test, they argue, is whether using AI is a voluntary hand-over to an outsider that breaks confidentiality, and whether an application can be an outsider at all.

Why Courts Tie Work Product to Purpose, Not the Tool

Work product is material prepared in anticipation of litigation that reflects a lawyer's thinking, and courts shield it from the other side. In Morgan v. V2X Inc., the District of Colorado held that notes and summaries produced with AI help during an internal investigation kept that shield. Because counsel steered the AI's analytical work, the attorney's mental processes stayed in what it produced.

Assini v. Howard reached a similar place by a different route. A New York state trial court quashed a subpoena for the AI chat logs of a pro se litigant, meaning someone representing themselves without a lawyer. Relying on Morgan, and in the Norton Rose Fulbright lawyers' view implicitly endorsing Warner v. Gilbarco Inc., the court ruled that a publicly available tool does not automatically erase an expectation of privacy. It treated the prompts and outputs as work product under New York civil practice law.

Warner, an Eastern District of Michigan case, also involved a pro se litigant. We have not confirmed its exact holding, so we do not characterise it here.

Taken together, these rulings move the inquiry away from which product was used and toward why it was used and who was in charge. That is a sturdier footing than a brand-by-brand list.

Texas Business Court Goes Furthest on AI Chat Logs

D'Ambra, Blanchard and Elder call Tate Group Automotive v. Legace Automotive Capital perhaps the most affirmative statement yet from any court on the point. The Texas Business Court held that a litigant's generative AI chat logs were protected work product under Texas Rule of Civil Procedure 192.5(a)(1). That rule explicitly covers a party's own mental impressions, not only those of its lawyers.

The court went a step further on waiver. Feeding privileged material into an AI platform does not, on its own, give up work-product protection, so long as nothing passes to an adversary. That is the line the lawyers say other state courts may follow.

There is a catch. The same ruling suggests a court can still order a party to admit that a chat log exists and to list the documents it shared with the tool, even while the conversation itself stays protected. Protection of the content, in other words, does not mean secrecy about the fact of AI use.

The practical consequence is administrative. Investigation protocols should record which tools were used, and privilege logs should list AI-assisted materials rather than leaving them out.

What Belongs in an AI Vendor Contract

The Norton Rose Fulbright lawyers say privilege now depends heavily on two things: what kind of tool is used and what the vendor has promised. Their reading of Heppner is that its warning is aimed at consumer platforms deployed without contractual safeguards, while enterprise systems with firm data controls are easier to defend.

Their minimum list for vendor agreements has five parts. Explicit duties of confidentiality and data handling. Zero data retention, or a short and clearly defined retention period. A ban on the vendor training models with client data. An acknowledgment that the platform serves work directed by attorneys. And, in engagement letters and expert agreements, express limits on experts using AI.

Their broader advice is to govern AI rather than abandon it, through vendor due diligence, tidy contracts, written protocols and staff training. D'Ambra leads the firm's US e-discovery and information governance practice, and David Kessler and Susana Medeiros also contributed. Readers should note that this is advocacy from lawyers who advise clients on exactly these questions, and that Heppner, the ruling they want read narrowly, is the only criminal case among those they cite.

Will courts keep protecting AI-assisted legal work?

The bottom line

Heppner has been read in some quarters as a verdict against AI in legal work. The rulings that followed suggest otherwise. Morgan protected AI-assisted investigation notes in Colorado, Assini shielded a self-represented litigant's chat logs in New York, and Tate Group extended work-product protection to chat logs in Texas. What links them is attention to purpose and direction rather than the software itself. The open edge is disclosure: Tate Group indicates that the existence of AI use may have to be revealed even when the content stays sealed. For legal teams, the work now sits in contracts, logs and protocols. A tool deployed under counsel's direction, with a vendor bound to confidentiality and barred from training on client data, stands on far firmer ground than a consumer app.

What to watch

• Watch whether a federal appeals court takes up the consumer-versus-enterprise distinction drawn in Heppner; no date has been set.
• Watch whether other state courts adopt the Texas Business Court's rule that AI disclosure waives work product only when it reaches an adversary; no date has been set.
• Watch for courts ordering parties to disclose that AI chat logs exist and which documents were shared, as Tate Group signalled; no date has been set.