Generative AI prompts create risk of waving privilege

As the use of Generative AI for legal research and drafting grows, so do the pitfalls. But unless an attorney is using an AI platform internal to his or her firm or company, it is literally impossible to avoid sharing information with third parties. Generative AI learns from its own experience, and many (if not all) AI platforms record the prompts and interactions with the requesting attorney, store the transcript for an indefinite period and use the content to improve the AI program. Many of these platforms encourage the attorney to include highly specific information, even client names, in order to produce the "most useful" output.

The California State Bar has taken note. It already warned in a 2023 advisory that lawyers could inadvertently disclose client confidential information when they draft prompts and upload documents to Generative AI platforms. Another worry is whether the AI platform has adequate security to prevent even more third parties from obtaining confidential information, so the Bar urged attorneys to consult with IT professionals to determine whether data provided to AI systems is secure. Just as the Bar's Committee on Professional Responsibility and Conduct (COPRAC) is working to update its AI guidance on confidentiality concerns for its meeting in May, a new risk of using AI has emerged--whether AI prompts may waive privilege.

California Evidence Code Section 912(a) provides that the attorney-client privilege is waived if privileged information, without coercion, discloses a significant part of the communication or consents to disclosure made by anyone. The statute clarifies that disclosure of client confidences does not waive privilege if such disclosure "is reasonably necessary for the accomplishment of the purpose for which the lawyer was consulted." Cal. Evid. Code Section 912(d).

Courts are now grappling with discovery disputes in which parties are attempting to obtain AI prompts based on waiver of privilege. Two recent opinions show an emerging split as to whether prompts to an AI platform are more like disclosing the communication to an outside third party (waiver), or more like a confidential, purpose-driven disclosure reasonably necessary to accomplish the legal representation (no waiver).

Last fall, a group of music publishers sought a preliminary injunction to prevent the defendant, Anthropic, from using copyrighted song lyrics to train its generative AI model, Claude. Concord Music Grp., Inc. v. Anthropic PBC, No. 24-cv-03811-EKL (N.D. Cal. 2025). The publishers conducted an investigation prior to filing the complaint using prompts to test whether Claude was reproducing copyrighted content. Anthropic sought to compel production of the number of prompts and Claude's responses. U.S. Magistrate Judge Susan Van Keulen ruled that the text of the prompts themselves were attorney work product and therefore not discoverable. 2025 US Dist. LEXIS 201671 (Oct. 12, 2025). Claude's responses, however, were ruled to be "fact work-product" that did not reveal the attorneys' mental impressions, conclusions or opinions. Therefore, Judge Van Keulen ruled that the responses were discoverable "to the extent Publishers have waived the privilege, including by 'plac[ing] the work product at issue during the course of litigation.'"

In February, the Southern District of New York considered the protectability of AI prompts in a criminal case of first impression. The defendant, Bradley Heppner, was accused of various financial crimes, including securities and wire fraud. U.S. v. Heppner, 25-cr-503 (S.D.N.Y 2026). After receiving a grand jury subpoena that made clear Heppner was the target of an investigation, but before he was arrested, "prepared reports that outlined defense strategy, that outlined what he might argue with respect to the facts and the law that we anticipated that the government might be charging." Law enforcement seized 31 documents related to the AI searches and responses.

Heppner's counsel argued that the AI-generated materials were privileged because Heppner's prompts to Claude included information that Heppner learned from counsel, that Heppner created the AI documents for the purpose of speaking with counsel to obtain legal advice, and that Heppner had subsequently shared the contents of the AI documents with counsel. Judge Jed Rakoff rejected the arguments. (ECF No. 27, Feb. 17, 2026).

Judge Rakoff ruled that Heppner's prompts to Claude lack all three elements to invoke the attorney-client privilege. First, Claude is not an attorney, so Heppner's communications with Claude did not constitute communications between a client and his attorney. Second, Heppner had no reasonable expectation of privacy because Claude is a third-party public platform, but also because the platform includes a disclaimer that user inputs and outputs may be used to train Claude.

Finally, Judge Rakoff held that Heppner did not communicate with Claude for the purpose of obtaining legal advice. The ruling conceded that it was a closer question as to whether Heppner met this element of attorney-client privilege. But Judge Rakoff noted that Heppner had undertaken his research on a public platform without instruction or encouragement from his counsel. "Had counsel directed Heppner to use Claude, Claude might arguably be said to have functioned in a manner akin to a highly trained professional who may act as a lawyer's agent within the protection of the attorney-client privilege."

The rulings in Concord Music Grp. and Heppner reflect the evolving landscape surrounding AI technologies and their effect on privilege and discoverability. Both cases involve Claude, an AI platform geared to the general public. Had the users issued prompts to a specialized legal AI platform such as LEXIS or Westlaw, the result could have been different. Given the highly fact-specific nature of the applicability of privilege to AI prompts and the lack of guidance from state bar associations, attorneys and clients should use AI platforms with caution.