In February, a federal judge in Manhattan ruled that 31 documents a defendant created using Anthropic’s Claude chatbot aren’t protected by attorney-client privilege or work product doctrine.
The court’s rationale hinged on the fact that consumer AI platforms don’t promise confidentiality; their privacy policies allow inputs to be used for model training and disclosed to government authorities. Sharing confidential information with a third party that doesn’t guarantee confidentiality (i.e., your AI platform) waives the privilege, and sending the documents to your lawyer after the fact doesn’t fix it. Even worse, the court found that typing privileged communications into the chatbot may waive the privilege over those original communications themselves.
Think about what that means for your organization. Your ED asks ChatGPT how to handle a personnel issue. A board member runs a regulatory question through Claude. Your programs team describes field operations and asks whether anyone could face criminal exposure, or whether the organization could get sued.
Under Heppner, every one of those conversations could be discoverable in litigation or a government investigation. And requesting an adversary’s AI chat logs is already becoming routine in civil discovery.
Three things to consider putting on your list:
- Update your organization’s AI use policy to address privilege explicitly. Most policies focus on data security and accuracy but say nothing about the risk of waiver when employees use AI to analyze legal questions. Make it clear to your teams that legal questions go through counsel, not a chatbot.
- Audit the distinction between consumer and enterprise AI tools in your environment. If your organization has enterprise agreements with contractual confidentiality protections and data isolation, that’s a meaningfully different posture than staff using free or paid consumer accounts. Know which you’re dealing with.
- Build the privilege question into your broader AI governance. When evaluating any new AI tool, ask what happens to the data your team puts in, whether it’s used for model training, and who else can access it.
A consumer chatbot is basically a third party with a microphone; make sure your organization knows who’s listening.
