Attorney-client privilege, above all, requires confidentiality. The communication must be between a client and an attorney, made for the purpose of obtaining legal advice, and it must be made in confidence. If any of those elements is missing, attorney-client privilege never attaches. And once established, attorney-client privilege is fragile: it may be waived by voluntary disclosure to any third party, regardless of whether that third party is adverse.

Work product protection is different. It protects materials prepared in anticipation of litigation, it can be asserted by both the client and the attorney, and it does not require confidentiality as a threshold element. It is also more resilient: it is generally waived only by disclosure to an adversary, or in a manner that substantially increases adversary access.

For decades, courts have applied these protections to successive waves of new technology and generally concluded that the medium of communication does not, by itself, destroy protection. But 2026 may mark the year that consensus began to fracture. In February, two federal courts, ruling on the same day, reached what appeared to be opposite conclusions about whether materials generated through interactions with AI tools are protected.

Those rulings have also raised a further question: the terms of use governing Gmail grant Google broad rights over user content that bear similarities to the AI platform policies at issue in Heppner. Some commentators have asked whether, under the reasoning of that decision, similar challenges could be directed at attorney-client privilege over communications sent through consumer email platforms. As discussed below, existing authority provides reasons to doubt that result, but the question has been squarely raised by at least one federal court.

This article examines the emerging case law, identifies the growing disagreements among courts, and surveys the arguments on both sides. The law in this area remains unsettled, and these issues are far from resolved. Practitioners should be aware of these developments and consult with counsel regarding their specific circumstances.

'United States v. Heppner' (S.D.N.Y. Feb. 17, 2026)

Bradley Heppner, a financial services executive indicted on securities fraud, used the free consumer version of Anthropic's Claude, on his own and without his lawyers' direction, to analyze potential defenses. He shared those outputs with his attorneys. When federal agents seized his devices, defense counsel claimed privilege over roughly 31 AI-generated documents.

Judge Jed Rakoff rejected every theory of protection, calling it "a question of first impression nationwide." As to attorney-client privilege: Claude is not a lawyer; Heppner acted without counsel's direction; and perhaps most importantly, Anthropic's privacy policy permits data collection, model training, and disclosure to government authorities, thereby negating any reasonable expectation of confidentiality. The court also held that when Heppner typed previously privileged information into Claude, he waived attorney-client privilege over that information too, "just as if he had shared it with any other third party."

Turning to work product protection, Rakoff similarly determined that the materials did not qualify: Heppner created the documents on his own, they were not prepared at counsel's behest, and they did not reflect counsel's mental impressions or strategy. Having determined that work product protection did not exist as a threshold matter, the court never reached the question of whether sharing materials with Claude would have waived an otherwise valid work product protection.

'Warner v. Gilbarco' (E.D. Mich. Feb. 10, 2026)

The same day, a Michigan federal court appeared to reach the opposite result. A pro se plaintiff in an employment discrimination case had used ChatGPT to draft her legal filings. The defendants wanted every prompt and output. The court said no.

The court grounded its analysis in the plain text of Federal Rule of Civil Procedure 26(b)(3)(A), which protects materials "prepared in anticipation of litigation or for trial by or for another party or its representative." Because the plaintiff was a party preparing materials in anticipation of her own litigation, the court held that her AI-generated documents qualified as work product regardless of her lack of counsel. The court then applied the adversary-focused waiver rule: AI tools "are tools, not persons, even if they may have administrators somewhere in the background." ChatGPT is not the plaintiff's adversary. Work product protection survived.

Making Sense of the Split

Warner presents a unique issue, however. Whether pro se litigants may claim work product protection is not itself a settled question. A minority of federal courts have rejected the concept, and neither Florida's state courts nor federal courts sitting in Florida appear to have addressed it under the comparable state rule (Fla. R. Civ. P. 1.280(b)(4)). A deeper treatment of this issue is beyond the scope of this Article, but practitioners should be aware that Warner's holding on this point is likely to be subject to future challenge.

In order to reconcile these two cases, it is helpful to recognize that the same rule—Federal Rule of Civil Procedure 26(b)(3) — applied in both, but the courts read it differently.

In Heppner, the court treated work product as requiring a nexus to counsel's involvement or strategy. A represented defendant's independent AI research, undertaken without his lawyers' knowledge, did not qualify. In Warner, the court read the rule's reference to materials prepared by "a party" at face value and held that a litigant's own litigation preparation qualifies regardless of attorney involvement.That interpretive disagreement is itself part of the emerging split, and no appellate court has resolved it.

But even setting aside the threshold question, the two doctrines' different waiver rules point in different directions. Attorney-client privilege may be waived by disclosure to any third party. Work product protection is generally waived only by disclosure to an adversary. An AI platform is a third party, but it is not typically an adversary. As a doctrinal matter, this distinction suggests that attorney-client privilege claims may face greater exposure to AI-related challenges than work product claims, regardless of how the threshold question is resolved. Whether courts will broadly adopt this reasoning, however, remains to be seen.

The same technology, the same act of typing into a consumer chatbot, produced different outcomes because the doctrines ask different questions. An earlier decision reinforces the pattern: in Tremblay v. OpenAI, (N.D. Cal. Aug. 8, 2024), the court held that ChatGPT prompts crafted by attorneys constituted opinion work product because they reflected "counsel's mental impressions and opinions."

'Morgan v. V2X' (D. Colo. Mar. 30, 2026)

Just as these cases were being analyzed, a Colorado federal court threw a new wrinkle at this fast-changing area. Morgan reframed the confidentiality debate and put Gmail in the crosshairs. Magistrate Judge Braswell protected a pro se litigant's AI-generated work product and posed the question at the heart of this article: "Today, nearly all electronic interaction passes through third-party systems. Google, for example, hosts millions of accounts ... Does that mean that anyone with a Gmail account has forfeited all rights to confidentiality and privacy?" The court's answer was no, but it amended the protective order to bar uploading confidential litigation materials into consumer-grade AI platforms in order to better protect confidentiality going forward.

The Gmail Question

The AI cases matter on their own. But they also raise questions about email platforms that lawyers and clients use every day.

Google's privacy policy states that Google "collects the content you create, upload, or receive from others when using our services," including emails, and uses "automated systems that analyze your content." These provisions bear similarities to the Anthropic privacy policy at issue in Heppner. One could argue that, under a strict application of Heppner's reasoning, attorney-client privilege over communications sent through Gmail might face a similar challenge. But there are reasons, discussed below, to question whether courts would or should extend Heppner in that fashion.

Several doctrinal features weigh against extending Heppner to consumer email platforms. First, unlike attorney-client privilege, work product protection does not require confidentiality as a threshold element. A litigation memo emailed through Gmail could still qualify as work product even if Google's terms permit scanning or analysis of the email's content, because the threshold turns on when and why the material was created, not on whether it was kept secret from the platform provider. And at the waiver stage, Google is not typically the sender's adversary. Under the reasoning of Warner, work product protection would likely survive even if attorney-client privilege over communications sent through the same platform were called into question.

Second, the distinction between closed AI processing (where content stays within the platform’s systems for routine operations like spam filtering and storage) and consumer AI platforms (where content may be used for model training or disclosed to third parties) is likely to prove critical. Courts may well conclude that automated processing incident to providing an email service is fundamentally different from the affirmative disclosure to a consumer AI chatbot at issue in Heppner. The terms of service for an email platform and the terms of service for a generative AI tool serve different purposes and grant different rights, even where their language appears superficially similar.

Third, and perhaps most importantly, other courts have squarely resisted finding a per se or automatic waiver based on platform terms of service. The Oregon Supreme Court in Gollersrud v. LPMC (2023) held that "a mere risk of disclosure cannot suffice, on its own, to overcome the presumption of confidentiality." In Doe v. Mast (W.D. Va. 2024), a university's policy reserving the right to monitor all emails did not destroy attorney-client privilege. These decisions suggest that the mere existence of broad terms of service, without evidence of actual disclosure to an adversary or to a human third party, may be insufficient to defeat privilege. Courts have historically been reluctant to adopt rules that would, in practice, eliminate privilege over the vast majority of modern electronic communications.

Conclusion

These are early days. The case law is developing rapidly, courts are reaching different conclusions on similar facts, and no appellate court has yet weighed in. How attorney-client privilege and work product protection will fare in an era of AI-integrated platforms is a question the courts are only beginning to answer. For now, the weight of authority and the practical realities of modern legal practice counsel against concluding that routine use of consumer email platforms waives privilege. But the question has been raised, and practitioners should monitor developments closely.

Reprinted with permission from the June 12 issue of the Daily Business Review. (c) 2026 ALM Media Properties, LLC. Further duplication without permission is prohibited. All rights reserved.