A new frontier: publicly available AI and the loss of privilege

In an issue of first impression, a federal US trial court in New York recently held that a criminal defendant’s communications with a public generative artificial intelligence platform were neither protected by attorney-client privilege nor the attorney work product doctrine (the latter is akin to litigation privilege in Canada)¹. While the applicability of the court’s holding in United States v. Heppner is constrained to its facts and is not binding authority, the opinion serves as a cautionary tale for companies, in-house counsel, and lawyers alike, and reinforces the risks inherent in using AI platforms in connection with legal matters. 

What you need to know

• The type of AI tool (likely) matters. The court in Heppner framed the issue before it narrowly, referring to defendant’s use of a “publicly available AI platform”. The holding may have come out the other way had the tool at issue been a secure, enterprise-grade system with enhanced privacy protections, as opposed to a public, commercial-level one. Indeed, courts have held that the use by clients of closed enterprise tools coupled with attorney consultation can, in some instances, retain privilege. While some legal-specific AI tools are designed to avoid learning from or being trained on client data, publicly available AI tools often are not.
• Inadvertent waiver. Although not squarely addressed by the court, the decision underscores that disclosing privileged communications to a public AI tool would likely waive the privilege or work product protection. To avoid such a waiver, companies and in-house counsel should carefully review the privacy policies of any AI tools they intend to consult in connection with internal legal advice or outside legal representation to ensure that the platform neither permits data to be used for model training nor disclosed to third parties. 
• Prompts and privilege logs. The court ordered the disclosure of the client’s communications with the AI tool, in part, because Heppner’s counsel admitted that the communications were not made at counsel’s direction. This suggests that had counsel directed his client to make the communications, and had Heppner stated as much in the communications (and even on the privilege logs), the AI tool arguably could have functioned “in a manner akin to a highly trained professional who may act as a lawyer’s agent within the protection of the attorney-client privilege”.
• Developing law. While the holding in Heppner is not a marked departure from long-standing legal principles on the attorney-client privilege and work product doctrines (nor is it binding on other courts), we can expect courts to continue confronting issues of first impression in this new frontier. Indeed, as the court aptly noted, “the implications of AI for the law are only beginning to be explored”. 

Background

Bradley Heppner was indicted for securities fraud and other charges relating to alleged misconduct in his role as CEO and chairman of several companies. In connection with Heppner’s arrest, federal authorities executed a warrant and seized documents and electronic devices from his home.

Among the documents seized were Heppner’s communications (the AI Documents) with Anthropic’s generative AI tool after he received a grand jury subpoena notifying him that he was the target of an investigation. Heppner communicated with the AI tool to prepare reports outlining his defense strategy and to formulate proposed responses to the government’s case.

Heppner asserted privilege over the AI Documents, claiming that he had inputted information he learned from counsel, created the AI Documents for the purpose of speaking with counsel to obtain legal advice, and subsequently shared the contents of the AI Documents with counsel. Crucially, however, Heppner’s lawyers had not directed him to run the AI searches and Heppner did not use an enterprise or other non-public version of the AI tool.

The government moved the court to rule that the AI Documents, which were withheld but reflected on Heppner’s privilege logs, were neither privileged nor attorney work product. The court orally granted the motion at a pretrial conference and issued a written opinion shortly after.

The opinion

Despite the modern context, the court applied the traditional requirements of the attorney-client privilege and attorney work product doctrine to determine that neither shielded the AI Documents from disclosure.

Attorney-client privilege

The court explained that the documents lacked two, if not all three, elements of the attorney-client privilege:

1. The AI Documents were not communications between Heppner and his counsel. The AI tool is neither an attorney nor a “licensed professional who owes fiduciary duties and is subject to discipline”.
2. The communications memorialized in the AI Documents were not confidential. The AI tool is a third party, and its privacy policy expressly alerts users that both user inputs and outputs are used to train the tool—and that Anthropic reserves the right to share that data, including with government regulators. For those reasons, and unlike a client who prepares notes to share with counsel, Heppner could not have had any “expectation of confidentiality” in his communications with the AI tool.
3. Heppner did not communicate with the AI tool to obtain legal advice. Acknowledging this was a “closer call” because Heppner communicated with it for the express purpose of speaking with counsel, the court found it important that his lawyers did not direct him to communicate with the AI tool. Further, the tool tells users that it cannot provide legal advice. While Heppner ultimately shared the AI Documents with his counsel, that act did not convert the non-privileged communications to privileged ones.

Work product doctrine

Although the work product doctrine protects certain materials prepared in anticipation of litigation by non-lawyers, the court explained the AI Documents did not qualify because they were not prepared by or at the request of Heppner’s counsel and did not reflect his lawyers’ strategy at the time they were created. The court reiterated that the work product doctrine exists to protect from disclosure attorneys’ mental processes. But because the AI Documents were not prepared at counsel’s request and did not disclose counsel’s strategy, they were not protected.