[EDRM Editor’s Note: The opinions and positions are those of Michael Berman.]

Jennifer Ellis, JD, LLC, has posted a very interesting blog, Two Courts, Two Answers: When Does Using AI Waive Privilege? – JLE (Feb. 21, 2026). She compares the holding in U.S. v. Heppner, __ F. Supp. 3d __, 2026 WL 436479 (S.D.N.Y. Feb. 17, 2026)(Rakoff J.), with Warner v. Gilbarco, Inc., 2026 WL 373043 (E.D. Mich. Feb. 10, 2026)(Patti, J.), and concludes that they “reach[] the opposite conclusion on work product.”

I have discussed U.S. v. Heppner, __ F. Supp. 3d __, 2026 WL 436479 (S.D.N.Y. Feb. 17, 2026)(Rakoff J.), in two prior blogs: A.I. Privilege, Heppner, and How Did the Court Learn About the Absence of Certain Attorney-Client Communications Between Mr. Heppner and His Attorneys? (Mar. 02, 2026) and A.I. Documents Deemed Not Privileged (Feb. 12, 2026). In a nutshell, the defendant in a criminal action decided on his own—and not at the request of counsel—to use consumer-grade A.I. for case-related research. The Heppner court found that the layperson’s use of A.I., not at the direction of counsel, was not protected under the attorney-client or work product doctrines.

Warner presented markedly different facts. It was a civil case. Unlike Mr. Heppner, who had criminal defense counsel, plaintiff, Ms. Sohyon Warner, was pro se. As Ms. Ellis notes in her excellent blog, unlike Heppner, the Warner court wrote:

To the extent Defendants seek production of “all documents and information concerning her use of third-party AI tools in connection with this lawsuit, as requested in Defendants’ discovery requests,” this request is DENIED, as the information sought is not discoverable. See Fed. R. Civ. P. 26(b)(3)(A) (“Ordinarily, a party may not discover documents and tangible things that are prepared in anticipation of litigation or for trial by another party or its representative ….”) (emphases added). Moreover, it is not relevant, or, even if marginally relevant, is not proportional. See Fed. R. Civ. P. 26(b)(1).

Id. at *4. 

In footnote 3, which follows the last sentence, the Warner court added: “Notably, the Court previously confirmed that Defendants have no evidence of Plaintiff having violated the protective order by uploading documents marked confidential onto an AI platform…. The Court also reviewed pertinent and highlighted portions of Plaintiff’s deposition transcript…, which reveals an inordinate amount of questioning about Plaintiff’s use of AI, but again, no suggestion that she uploaded prohibited items. Defendants’ preoccupation with Plaintiff’s use of AI needs to abate.” 

While it is not free from doubt, it appears that the facially contradictory Warner holding may have been based on concerns that differ from Heppner. As an aside, for protective orders barring uploads of A.I., see Order Prohibiting Upload of Confidential Discovery Documents to Artificial Intelligence (“AI”) (Nov. 3, 2025).

However, in Warner, Defendants also asked to overrule Plaintiff’s attorney-client privilege and work product objections to the disclosure AI materials. Id. at *4. The Warner court denied that request, writing: “Even if this information were discoverable, it is subject to protection under the work-product doctrine, which [the pro se] Plaintiff is permitted to assert.” Id. 

Addressing whether use of ChatGPT waived work product, the Warner court wrote that there must be disclosure to an adversary or “in a way likely to get in an adversary’s hand,” in order to waive work product. Id. at *4. It added:

And ChatGPT (and other generative AI programs) are tools, not persons, even if they may have administrators somewhere in the background. As Plaintiff noted in her response, Defendants’ motion “asks the Court to compel Plaintiff’s internal analysis and mental impressions—i.e., her thought process— rather than any existing document or evidence, which is not discoverable as a matter of law. The motion seeks intrusive post-discovery production based on speculation about what might exist in Plaintiff’s internal drafting process, untethered from Rule 26 relevance, disregarding the heightened protection afforded to opinion work product, and improperly attempting to manufacture a waiver where none exists. At its core, Defendants’ request is a fishing expedition. …”…. Additionally, the Court agrees with Plaintiff that the pursuit of this information is “a distraction from the merits of this case[,]” and that Defendants’ theory, which is supported by no case law but only a Law360 article posing rhetorical questions, “would nullify work-product protection in nearly every modern drafting environment, a result no court has endorsed.”

Id. at *4 (emphasis added). 

The court stated: “But as Plaintiff points out, ‘no cited case orders the production of what Defendants seek here: a litigant’s internal mental impressions reformatted through software.’” Id. at n. 4.

Resolving a number of other issues, the Warner court wrote: “In the end, both sides of this dispute seek to obtain each other’s thought processes, while shielding their opponent from discovery of their own. The Court will uphold the protections afforded the thought processes and litigation strategies of both sides and will order production of neither.”

An earlier decision in this case dealt with hallucinated case references. Warner v. Gilbarco, Inc., 2025 WL 3047881, at *3 (E.D. Mich. Oct. 30, 2025).

Ms. Ellis makes an interesting comparison between social media and A.I. She correctly points out that courts reject fishing expeditions into social media and that private pages are discoverable only when relevant and proportional to the needs of the case. She wrote:

Even in that context, where people are voluntarily posting information for others to see, courts have consistently pushed back on overbroad requests and fishing expeditions. The reasonable expectation of privacy in social media cases turns on what the user actually shared and with whom, not on a blanket reading of Facebook’s terms of service. [emphasis added].

She then compares AI:

AI is a completely different animal. When someone types a prompt into Claude or ChatGPT, they are not publishing anything. They are not posting to a timeline or sharing with friends or followers. They are having a one-to-one interaction with a software tool in what is functionally a private workspace. The entire design of the product is built around individual, private use. This is not social media. AI chats are not meant to be public. [emphasis added].

Thus, Ms. Ellis critiques the Heppner court’s reliance on Anthropic’s privacy policy to support waiver. Additionally, she adds:

Even on the free consumer version of Claude, users can turn off training in their settings. When training is enabled, the data is anonymized and used to improve the model. It is not published, not searchable, not accessible to other users. Anthropic also offers enterprise and API versions that do not train on user data at all and include contractual confidentiality protections. The Heppner court did not appear to consider any of these distinctions.

Ms. Ellis notes:

Every major cloud service has privacy policies that reserve similar rights. Google, Microsoft, Apple, Dropbox, and others all include language permitting disclosure to government authorities and third parties…. These safety and legal compliance obligations exist across the entire cloud ecosystem.

No court has ever held that these processes destroy the reasonable expectation of confidentiality for purposes of privilege. If [Judge] Rakoff’s standard [in Heppner] were applied consistently, uploading a privileged memorandum to Google Drive or sending it through Gmail would also waive privilege, because those services have the same types of terms and the same types of legal obligations.

Ms. Ellis concludes:

These two decisions are going to be cited frequently and in opposition to each other. They are not perfectly analogous. Heppner is a criminal case involving a client who acted without counsel’s direction. Warner is a civil case involving a pro se litigant who is both the client and the pro se counsel, and whose AI use is inseparable from her litigation strategy. But the core tension is real. Is AI a third party to whom you are disclosing confidential information, or is it a tool through which you are processing your own work product? The answer has enormous consequences…. What we have right now are two competing frameworks: one that treats AI platforms as third parties whose terms of service can destroy confidentiality, and another that treats them as tools, “not persons,” through which a litigant processes their own mental impressions. [emphasis added].

Her analysis is well worth reading.

Assisted by GAI and LLM Technologies per EDRM’s GAI and LLM Policy.