Where did the client's information go? Privilege, confidentiality and AI tools

The citation cases get covered because they are dramatic. A lawyer is embarrassed in open court, and everyone reads about it.

The confidentiality problem is quieter. When a lawyer puts client information into a consumer AI tool, nothing happens immediately. No judge, no sanction, no headline. The risk shows up later, in discovery, in a records request, in a dispute about whether something was ever privileged.

That "later" has now started to arrive.

United States v. Heppner (S.D.N.Y., Feb. 2026)

Judge Rakoff ruled from the bench on February 10, 2026 and followed with a written opinion on February 17. The facts are specific. A defendant in a securities and wire fraud case used a consumer AI tool on his own to prepare defense-strategy reports. The FBI seized about 31 such documents.

The court held they were neither attorney-client privileged nor protected work product. As reported by several firms that analyzed it, the reasoning ran along these lines:

• The tool is not an attorney.
• There was no reasonable expectation of confidentiality, because the provider's privacy policy allows disclosure to third parties and regulators and use of inputs and outputs for training.
• The work product was not prepared by or at the direction of counsel.

Be careful about how far to take it. It is a single district court decision. The defendant was acting alone, not a lawyer using a tool. And the court left open whether the result changes where counsel directs the client to use an AI platform. But the central point about the provider's terms is one every lawyer should have in their head: the terms of service are part of your privilege analysis.

Warner v. Gilbarco (E.D. Mich., Feb. 2026)

The same day, a magistrate judge reached a different result. A self-represented plaintiff's AI-assisted materials were protected as work product. The court said disclosure to an AI tool is not waiver, because waiver requires disclosure to an adversary, and called AI programs "tools, not persons."

So the courts are split. One looked hard at the platform's terms and found no protection. One did not examine the terms and found protection. You cannot plan around that kind of split. You can only avoid being the test case.

"Deleted" does not always mean deleted

In a federal copyright case against an AI company in New York, the court ordered the company in May 2025 to preserve consumer chat logs that would otherwise be deleted. That preservation duty was later narrowed, and in November 2025 the court ordered production of 20 million de-identified consumer logs, which the district judge affirmed in January 2026. (The dates on the preservation timeline vary between sources; check the dockets before you cite them.)

The point for lawyers is not the copyright claim. It is that chat content sitting on a consumer platform can be preserved under a legal hold and swept into discovery in a lawsuit you are not a party to. Exposure depends on the plan tier the user is on.

What the ethics guidance already told us

None of this is a surprise to anyone who read the opinions.

• ABA Formal Opinion 512 (July 2024): before entering client information into a tool, weigh the likelihood of disclosure, the sensitivity of the information and the safeguards. For tools that learn from inputs, the lawyer needs the client's informed consent before entering confidential information.
• Florida Bar Opinion 24-1 (Jan. 2024): confirm that the provider's confidentiality terms are enforceable, ask about breach notice and retention, and get informed consent before disclosing to a third-party tool. An in-house tool may remove the need for consent.
• California State Bar guidance: do not enter confidential information into a tool presenting material confidentiality or security risks without informed consent, and read the terms rather than the marketing.

And California has gone further by statute. As summarized by law firm alerts, SB 574, signed September 30, 2026 and effective January 1, 2027, bars entering confidential or personally identifying information into a generative AI system unless access is limited to the lawyer and authorized persons bound by confidentiality. Read the text yourself before relying on any summary of it.

What a confidentiality-first setup looks like

The honest checklist for any AI tool you use with client information:

1. Does the provider train on your inputs? Is that contractually prohibited?
2. Who can see the data, and how is access controlled inside the firm?
3. Is it encrypted in transit and at rest?
4. What is retained, for how long, and what happens under a legal hold?
5. Can you show a client or a court what happened to their information?

This is what JILL is built around. JILL runs inside the matter, so client information is not copied out to a separate consumer tool. Customer matters, documents, communications and AI sessions are never used to train third-party models. Ethical walls and role-based access control who inside the firm sees what. Data is encrypted in transit and at rest. And every action is recorded in the DDEAS audit log, so you can answer the question "what happened to this information" with a record.

That does not remove your duty to think about consent and to understand your obligations in your jurisdiction. It means the tool is not the thing creating the problem.

The takeaway

Treat every AI tool the way you would treat a vendor who will see your client's file. Read the terms. Ask where the data goes. Keep a record. And do not assume that because a chat window feels private, a court will agree.

See the security model →

Built for ABA Formal Opinion 512 →