Your law firm uses ChatGPT. The privilege you are losing every time, explained.
Short answer
Two federal rulings in early 2026 reached opposite conclusions on whether AI conversations preserve privilege. Heppner said no for a defendant using Claude on his own. Warner v. Gilbarco said yes for a pro se plaintiff using ChatGPT. The line is whether the user is the lawyer, the client, or someone in between, and whether disclosure is to a tool or to an adversary.
The three variables that decide the question
Whether privilege survives depends on who is running the prompt, how the platform is configured, and where the conversation is stored. Three variables determine whether AI use in a matter breaks privilege, threatens it, or leaves it intact.
Variable 1. Who is running the prompt
If the client is running the prompt on their own initiative, even about their own case, the Heppner reasoning treats the output as a third-party disclosure with no privilege. This is what tripped up the Heppner defendant.
If the lawyer is running the prompt on the firm’s account, in the course of representation, the analysis is closer to traditional work product. The firm’s mental impressions, strategy, and case theory are central to the protection, regardless of the tool used to organize them.
If a paralegal or associate is running the prompt at the supervising lawyer’s direction, the work-product analysis is similar. The chain is lawyer to staff to AI, which is operationally the same as lawyer to staff to legal-research database.
Variable 2. The contractual posture of the AI service
Consumer ChatGPT, with default account settings, is the worst contractual posture for a law firm. Conversations are retained for at least thirty days, may be used for safety review, and are subject to legal hold orders that override user deletion. The same applies to consumer Claude, Gemini and the consumer tier of Copilot.
Business and Enterprise tiers change the posture. ChatGPT Enterprise, Claude for Work with a business agreement, Microsoft Copilot for Business with a Data Loss Prevention policy: each has explicit contractual terms that limit retention, prohibit training, and accept compliance and discovery obligations.
The decisive question is whether the firm has executed a Business Associate Agreement or its functional equivalent. With such an agreement in place, you are in the analytic territory of Microsoft 365 or your case management system: a vendor under contractual confidentiality. Without it, you are in the analytic territory of an open public service, with all the disclosure that implies.
Variable 3. The matter sensitivity
Not every matter requires the same posture. A standard real-estate closing where ChatGPT helps draft a routine clause is not the same risk surface as a federal securities defense where every internal note will be examined.
The threshold question is: if every prompt and every output became part of the discovery record, would that change the outcome of the matter? For most routine work, the answer is no. For criminal defense, securities and regulatory matters, family law with custody implications, employment disputes, immigration, and any matter where the client’s own words could be turned against them, the answer is yes. The posture has to match the answer.
The decision matrix
Three categories of work, three different rules. Memorize this. It is not subtle.
Category A. Routine drafting and research. Standard contract clauses. Statute and regulation summaries. Boilerplate motions. State-specific procedure questions. Use of consumer ChatGPT or Claude is operationally fine for this work, with one constraint: never include identifying client information in the prompt. The prompt that says “draft a non-disclosure agreement clause for a software vendor in California” is fine. The prompt that says “draft a non-disclosure agreement for ACME Corp’s deal with Beta Industries closing on March 15” is not.
Category B. Strategy and matter-specific analysis. Stress-testing arguments. Outlining cross-examination. Drafting briefs that touch the case theory. This work belongs on a Business or Enterprise tier with a vendor agreement, or on a local model, or on a tool your bar association has cleared. Not on consumer chat. We covered the broader frame in your ChatGPT and Claude conversations are not protected, which is worth sharing with the partners before the next firm decision on tools.
Category C. Anything the client said into a public chatbot before retaining you. This is now a standard intake question. Add it to your engagement letter and to your first meeting checklist. Have you used ChatGPT, Claude, Gemini, Copilot, or any other AI service to discuss this matter? If the answer is yes, the conversations are likely producible, and your strategy has to account for what is in them. We covered the related framework in what law enforcement can actually access from your accounts, and the same logic applies to civil discovery requests.
What to put in your engagement letter
Several US firms have already updated their engagement letters and intake protocols in response to Heppner, applying logic similar to our framework in how to build a threat model in 20 minutes. Sher Tremonte was one of the early movers.
First, a representation about prior AI use. The client represents that they have disclosed any prior conversations with AI services that touch the matter, and undertakes not to use consumer AI services regarding the matter going forward without written authorization.
Second, an acknowledgment about firm AI use. The firm discloses that it may use AI tools in the course of representation, identifies the contractual posture of those tools (Enterprise tier, BAA executed, no training, retention limited), and confirms that the use is governed by the firm’s confidentiality obligations.
Third, a waiver framework. If the client wishes to use a specific AI tool against the firm’s recommendation, the engagement letter should either prohibit the use or document the client’s informed consent to the privilege risk. The latter is the standard practice when a client wants to do something the lawyer thinks is unwise but the client has the right to choose.
These changes are not theoretical. Disciplinary cases involving AI tool use are now a regular feature of state bar opinions. Drafting the engagement letter cleanly is the easiest way to avoid the secondary problem of having to defend AI tool use in a disciplinary proceeding two years from now.
Frequently asked questions
Does using my firm’s local Outlook Add-in for ChatGPT change the analysis?
It depends on whether the Add-in is connected to your firm’s Enterprise tenant or to a personal account. When the Add-in is wired to the firm’s Enterprise tenant under a Business agreement with Microsoft, the analysis is closer to other firm-managed tools. When it is a consumer account running on a firm device, the exposure is identical to opening ChatGPT in a browser tab. The label visible to the user does not change the underlying contractual posture.
What about local-only models running on firm hardware?
For genuinely sensitive matters this remains the only configuration that fully avoids third-party records. A model running on your own machine, with no network connection, leaves no third-party record. The conversations exist only on firm-controlled hardware and are subject to the same privilege analysis as any other firm work product. The trade-off is performance: local models are smaller and slower than the frontier hosted models.
If I use ChatGPT Enterprise, am I covered?
Closer to covered, not absolutely covered. ChatGPT Enterprise terms commit OpenAI to no training on your data, limited retention, and SOC 2 compliance. That is the contractual basis for treating the service as a vendor in your privilege analysis. It is not a guarantee against subpoena, and it does not exempt you from disciplinary review of how you used the tool. Read the terms. Have your malpractice carrier read them too.
Should I tell clients I use AI in their matter?
Increasingly yes, and the bar opinions are pushing in that direction. Disclosing AI use in the engagement letter is materially cleaner than addressing it mid-matter, where late notice tends to raise awkward questions about what was already done before the client knew. Get it in the engagement letter and forget about it.
There’s no perfect setup. Anyone selling you perfect is selling fear. The goal is simple: make yourself a harder target than the person next to you.
