The emerging rules of the road governing AI prompts and outputs in discovery

A few general trends are discussed and noted below.

1. Work product protections are unlikely to apply without clear direction from counsel to use AI. In what is sure to be a recurring fact pattern played out over hundreds of future cases, the defense in the ongoing criminal case of United States of America v. Bradley Heppner attempted to invoke work-product privilege over a set of 31 documents that reflected the defendant’s interactions with an AI chatbot. No. 25 CR. 503 (JSR), 2026 WL 436479, at *1–2 (S.D.N.Y. Feb. 17, 2026). At the time of the defendant’s interactions with the AI chatbot, he had already received a grand jury subpoena and was aware that he was the target of an ongoing governmental investigation. Id. Without prompting by counsel to do so, the defendant proceeded to interact with the AI chatbot to “prepare[] reports that outlined defense strategy,” and what “he might argue with respect to the facts and the law,” based on what the “government might be charging.” Id. at 1. The defendant then shared the AI-generated output with his defense counsel. Id. at 2. In response to the defendant’s assertion of privilege over the AI-generated prompts/outputs, the prosecution objected, arguing that such protections were inapplicable because “the defendant took these actions himself—without any direction from counsel—and then shared the products of his research with counsel after it was created.” Gov’t Mot. Ruling Docs. Not Privileged, ECF No. 22 at 11 (Feb. 6, 2026). The government conceded that “[h]ad counsel directed the defendant to run the AI searches, the analysis might be different,” but that “the defendant elected to run his own AI searches and then shared the outputs of those searches with counsel,” nullifying any potential application of work product protections. Id.

The defense attempted to rebut by arguing that “it's very clear [defendant] was preparing these reports in anticipation of a potential indictment[,]” and that “[t]he purpose of his preparing these reports was to share them with [counsel] so that he could discuss defense strategy with us [and] we could create his defense strategy.” Hr’g Tr. 4:18–23 (Feb. 10, 2026). But the court rejected this argument after the defense acknowledged that the AI prompts/output merely “affect[ed]” the defense’s legal strategy and did not “reflect” it. Heppner, 2026 WL 436479, at *3. The bottom line for the court was that “[while] the work product doctrine may apply to materials generated by non-lawyers, the Second Circuit has repeatedly stressed that the purpose of the doctrine is to protect lawyers’ mental processes” and that “[b]ecause the AI Documents were not prepared at the behest of counsel and did not disclose counsel’s strategy, they do not merit protection as work product.” Id. at 4.

Notably, in another recently decided case, the court in Warner v. Gilbarco Inc., held that plaintiff, as a pro se litigant, properly asserted work product privilege over “AI materials” generated by plaintiff through the course of litigation by using ChatGPT. No. 2:24-CV-12333, 2026 WL 373043, at *4 (E.D. Mich. Feb. 10, 2026). Moreover, the court in Warner held that plaintiff’s use of ChatGPT had not affected a waiver of the work-product privilege, because waiver of that privilege requires “waiver to an adversary or in a way likely to get in an adversary’s hand” and that “ChatGPT (and other generative AI programs) are tools, not persons, even if they may have administrators somewhere in the background.” Id. (emphasis in original). The court further adopted the perspective that “while the mere showing of a voluntary disclosure to a third person will generally suffice to show waiver of the attorney-client privilege, it should not suffice in itself for waiver of the work product privilege.” id. Thus, the court agreed with the Plaintiff that a motion to compel such AI-generated “seeks intrusive post-discovery production based on speculation about what might exist in Plaintiff's internal drafting process” and denied the motion. Id.

2. Talking to an AI program may be akin to talking to a friend (in terms of attorney-client privilege). In the Heppner case, the defense further argued that the defendant’s prompts and the associated outputs were subject to the attorney-client privilege. The prosecution argued that the AI prompts and outputs were not protected because they were not communications between the defendant and his counsel, arguing that the AI tool “is obviously not an attorney.” Id., Gov’t Mot. Ruling Docs. Not Privileged at 7. The prosecution likened the defendant’s use of the AI program to “no different than if he had asked friends for their input on his legal situation.” Id. Moreover, the prosecution argued that the AI tool cannot give “legal advice” and that it was effectively a third party that disclosed in its terms and conditions that “it may disclose this data to governmental regulatory authorities and third parties.” Id. at 8. At oral argument, the court agreed, stating that it did not “see any basis for a claim of attorney-client” privilege and that the defendant had “disclosed it to a third-party, in effect, AI, which had an express provision that what was submitted was not confidential.” Hr’g Tr., 2:25–3:15 (Feb. 10, 2026).

In its memorandum further explaining the court’s ruling, the court rejected arguments that a user’s AI inputs are akin to the use of other “Internet-based software, such as “cloud-based word processing application.” Heppner, 2026 WL 436479, at *2. In so rejecting this argument, the court held that such a typification “only cuts against the invocation of privilege because all recognized privileges require, among other things, a trusting human relationship such as . . . with a licensed professional who owes fiduciary duties and is subject to discipline.” Id. (internal quotation marks omitted).

The court further held that “no such relationship exists, or could exist, between an AI user and a platform such as Claude.” Id. In response to the defense’s arguments that defendant had used AI for the “express purpose of talking to counsel,” the court noted that the defendant did not use the AI chatbot at the “suggestion or direction of counsel” and that the test was whether Heppner “intended to obtain legal advice from [the AI chatbot], not whether he later shared [the AI chatbot’s] outputs with counsel.” Id. at 3. Here, the defendant could not possibly receive legal advice from a non-attorney, which expressly disclaims the provision of legal advice, so no privilege attached to his AI prompts and outputs. Id.

3. Just because it was produced using generative AI does not mean it is discoverable. Recent decisions might tempt litigants to assume that all prompts and outputs from an AI program are subject to discovery. However, some courts have made clear that traditional doctrines governing attorney work product and waiver apply equally to prompts and AI-generated outputs. For example, in Concord Music Group, Inc. v. Anthropic PBC, plaintiff music publishers relied on a subset of their own prompts and output generated by defendant’s AI chatbot to support claims of copyright infringement. 2025 WL 1482734, at *1 (N.D. Cal. May 23, 2025). In discovery, plaintiffs produced only those prompt-output pairs from their pre-suit investigation on which they had relied to support infringement claims, without disclosing so-called “unrelied-upon” prompt-output pairs that, presumably, did not support infringement. Id. When the defendant served discovery requests seeking all prompts and outputs, the plaintiff objected, arguing that the “unrelied-upon” prompts were privileged. Defendant disputed plaintiffs’ claim of privilege and argued that, in any event, plaintiffs had waived privilege by selectively disclosing only some prompt-output pairs. Id.

The court easily found that the prompt-output pairs, and related settings, were protected attorney work product because they were “queries crafted by counsel” and reflected counsel’s mental impressions. Id. at 2; see also Tremblay v. OpenAI, Inc., 2024 WL 3748003, at *2 (N.D. Cal. Aug. 8, 2024) (holding that AI prompts crafted by counsel during a pre-suit investigation constituted opinion work product because they “contain counsel’s mental impressions and opinions about how to interrogate ChatGPT”).

The court viewed waiver as a closer question. Under the sword-and-shield doctrine, the court found a partial waiver but did not allow discovery to proceed, finding that the defendant’s request for all prompt-output pairs was too broad and amounted to a “sweeping subject-matter waiver” that “goes too far.” Concord Music, 2025 WL 1482734, at *2. The court, however, left open the possibility that a more narrowly-tailored approach could warrant disclosure. Consistent with that approach, the court subsequently permitted defendant discovery on the number of prompts plaintiffs used as part of the pre-suit investigation, holding that such “statistical” information could only amount to mere fact work product, for which a partial waiver had occurred. Order Following Hr’g Re: Disc. at 5 (Oct. 12, 2025). As the court put it, “if [plaintiffs] are supplying the numerator, [defendant] is entitled to discover the denominator.” Id. And once plaintiffs made clear that they would rely upon a post-litigation investigation to demonstrate the effectiveness of the AI tools’ guardrails, the court permitted defendant’s discovery of all prompts and outputs generated in the course of the investigation, reasoning that plaintiffs had waived privilege by putting the investigation at issue, and disclosure was necessary to permit defendant an effective cross-examination. Concord Music Grp., Inc. v. Anthropic PBC, 2025 WL 3677935, at *3 (N.D. Cal. Dec. 18, 2025).

4. Involving an attorney is not enough to imbue AI prompts and outputs with privilege. A forward-thinking client may see cases like Heppner and anticipate a quick fix: simply have the lawyer give an “instruction” to keep a log of AI prompts and outputs. That way, these prompts/outputs would nominally be protected as attorney work product or communication, regardless of the nature of the AI use. The court in In re OpenAI, Inc., Copyright Infringement Litigation, however, rejected that approach. 802 F. Supp. 3d 688, 694–95 (S.D.N.Y. 2025). OpenAI’s counsel attempted to argue that an Excel spreadsheet “with various entries written by OpenAI employees that describe and evaluate their prompts to and output responses” was created at the direction of counsel and contained legal advice. Id. at 694. However, the court saw no legal advice “sought or conveyed by an attorney” and explained that “[g]iven the overwhelmingly business nature of the document, the mere fact that it may have been created at the direction of in-house counsel is insufficient to confer privilege over this document.” Id. at 695.

In all, courts (so far) appear comfortable deploying traditional tools and doctrines to adjudicate disputes involving the discovery of AI prompts and outputs. That said, the precise contours of how courts use these tools should come into greater focus as the technology becomes more and more ubiquitous.

Authored by Elizabeth C. Carter and David Jonas.