AI and Legal Professional Privilege: What Courts Say

Can Using AI Waive Privilege?

Yes, using AI can waive privilege if the disclosure is inconsistent with maintaining confidentiality. A provider’s rights to retain, review or train on your material can put that confidentiality at risk. The result depends on the circumstances and applicable law.

Legal professional privilege protects qualifying confidential communications and documents made for the dominant purpose of legal advice or existing or anticipated litigation. The AI question has two distinct parts.

First, did privilege arise when the material was created? A client who asks a chatbot for legal strategy does not create a privileged lawyer-client exchange simply by discussing the law. Later sending the answer to a solicitor does not automatically change the original document’s status.

Second, was existing privilege waived by a later upload? Pasting counsel’s advice into a public AI service raises a different issue. The advice already has a claimed privileged character, and the later disclosure can conflict with preserving its confidentiality.

In Mann v Carnell, the High Court assesses waiver through inconsistency with confidentiality. The judgment does not make every confidential disclosure to a third party an automatic waiver. That distinction supports examining the actual contract and controls, rather than assuming all cloud processing has the same result.

United States v Heppner

The Heppner memorandum concerns approximately 31 documents recording Bradley Heppner’s exchanges with Claude. He prepared defence material independently after becoming aware of a criminal investigation. His lawyers had not directed that work.

Federal agents seized the records under a search warrant. Judge Jed Rakoff rejected attorney-client privilege and US work-product protection in 2026, allowing government inspection. The decision concerned seized material, rather than a subpoena served on Anthropic.

The court found that Claude was not a lawyer and the exchanges lacked confidentiality under the provider policy it examined. It also rejected the claimed legal-advice purpose in the circumstances. Sending the documents to counsel later did not retrospectively protect them.

For work-product protection, the court relied on the absence of counsel-directed preparation or material reflecting counsel’s strategy. It left open an argument that lawyer-directed AI use could be treated differently. That observation did not decide that supervised AI work is automatically protected.

The court also said that any privileged information entered into Claude had been waived under the circumstances it considered. The ruling therefore addresses both initial protection and disclosure of existing advice.

What Australian Lawyers Can Take From It

Heppner is a US district court decision, so it does not bind an Australian court. Its confidentiality reasoning nevertheless concerns questions that Australian privilege law already asks.

Clayton Utz’s Australian analysis identifies confidentiality and lawyer direction as central practical issues. It distinguishes consumer AI from systems with contractual and technical safeguards. The label “enterprise” alone does not answer whether the dominant legal purpose and confidentiality requirements are satisfied.

The overseas cases also differ. Clayton Utz discusses Warner v Gilbarco, where a court protected a self-represented litigant’s AI-assisted material as work product. US work-product outcomes cannot simply be substituted for Australian litigation privilege.

MinterEllison’s analysis adds that ordinary third-party cloud storage does not itself waive privilege. It identifies training and provider access as distinct AI concerns. These analyses support assessing the facts of the workflow, without treating Heppner as a universal prohibition on AI-assisted legal work.

Can AI Chats Be Subpoenaed or Discovered?

Yes, AI chats can be sought for court proceedings. Whether they must be produced depends on the legal process, who controls the records and any valid privilege or other objection. A private account setting does not create immunity from production.

A firm’s saved prompts, outputs and exported transcripts can fall within relevant document categories. In Federal Court proceedings, the Federal Court Rules govern discovery and production. Rule 20.02 preserves privilege, and rule 20.35 permits the Court to inspect documents when deciding an objection.

A subpoena can require documents from an appropriate non-party. The Federal Court’s subpoena guidance distinguishes producing documents to the Court from permission to inspect them. A privilege claim therefore needs attention before access is granted.

Provider-held records raise additional jurisdiction and service questions. OpenAI’s civil request policy expressly addresses subpoenas and court orders. It requires valid legal process and permits objections, including to overbroad requests. An Australian subpoena does not automatically compel an overseas provider through that US procedure.

Have ChatGPT Chats Been Required for Court?

Yes. Courts have ordered preservation and production of ChatGPT records in the US copyright litigation involving OpenAI. That establishes court access through discovery orders, without suggesting that every chat is routinely available to an opponent.

The court upheld orders concerning a de-identified sample of 20 million consumer logs. OpenAI’s litigation update says it complied and describes access controls on the produced material.

A separate broad preservation obligation ended in 2025. OpenAI’s retention update says standard retention resumed, while a limited historical dataset remained under legal hold. Preservation means keeping records, and production determines who receives access. An order to preserve chats is not itself permission for public inspection.

Using AI Without Losing Privilege

Keep AI work within a confidential legal workflow, with a recorded legal purpose. These steps reduce avoidable exposure, while the facts still determine whether privilege applies.

1. Use approved business terms for the particular product. Establish confidentiality obligations and restrictions on training. Review human access, retention exceptions and access by other service providers.
2. Have the lawyer direct the work before it starts. Define the legal-advice or litigation task and who may perform it. Keep general commercial analysis distinct from work undertaken for that legal purpose.
3. Label qualifying material consistently and restrict access. A privilege label records the intended treatment, but cannot supply missing confidentiality or purpose.
4. Limit the material entered. Use a hypothetical or remove identifying facts where the legal task allows it. Check that a summary does not reveal the substance of confidential advice.
5. Record the purpose, lawyer’s instruction and approved service configuration in the matter file. Preserve the relevant contractual terms and evidence of the settings used.

MinterEllison recommends contractual restrictions on training and human review, alongside access controls and deletion terms. Those protections need to match the application in use. The AI privacy guides explain the provider settings behind those questions.

Tell clients how the firm permits AI use before they paste documents into their own accounts. Before receiving advice, independent chatbot research can produce unprotected material. After receiving advice, uploading the advice or its substance can raise waiver concerns. Gilchrist Connell’s analysis explains this distinction between failed initial protection and later waiver.

If a client has already used AI, establish what they entered and which service received it. Preserve the records and assess confidentiality before further use. The relevant AI practice note also needs attention: court restrictions on using material apply separately from the privilege assessment.