The American courtroom is undergoing a quiet, high-stakes collision with the age of artificial intelligence. The intersection of AI agents and the civil litigation process is reaching a critical juncture.
We are rapidly approaching a time when AI agents will not just assist in the drafting of filings, but may become the functional, if not legal, drivers of economic and commercial activity. As this "agentic commerce" matures, "agentic litigation" is not a far-fetched academic theory; it is becoming a structural inevitability. This article focuses on some of the key issues created at the intersection of AI and the litigation process, specifically the attorney-client communications and attorney work product privileges, initially in the context of current AI tools in general use and then anticipating issues that will arise with AI agents, which include autonomous systems capable of interpreting information, making decisions and executing tasks.
Currently, the attorney-client privilege rarely protects a party's or counsel's direct communications with a public generative AI platform, because those communications lack the essential elements of confidentiality and an attorney-client relationship. Work product protection, by contrast, may apply to AI-generated materials prepared in anticipation of litigation, particularly when counsel directs the use of AI and the prompts or outputs reflect counsel's mental impressions or legal strategy, but that protection is not automatic and can be waived.
Whether discovery can compel production of AI chatbot prompts and outputs, notwithstanding the attorney-client and attorney work-product privileges, depends on a multi-factor analysis of relevance, proportionality and the specific circumstances of the AI use.
The attorney-client privilege
Under federal law, the attorney-client privilege protects confidential communications between a client and an attorney made for the purpose of obtaining or facilitating legal advice. Courts have articulated various formulations of the privilege elements, typically requiring: (1) a communication between attorney and client; (2) made in confidence; (3) for the purpose of obtaining legal advice. See Upjohn Co. v. United States, 449 U.S. 383 (1981) (discussing the privilege's purpose of encouraging full and frank communication between attorneys and clients to promote broader public interests in the observance of law and administration of justice).
California codifies the privilege in the Evidence Code. Under Cal. Evid. Code § 954, the client holds the privilege to refuse disclosure of any confidential communication between client and lawyer. Cal. Evid. Code § 952 defines a confidential communication as information transmitted between client and lawyer "in confidence by a means which, so far as the client is aware, discloses the information to no third persons other than those who are present to further the interest of the client in the consultation or those to whom disclosure is reasonably necessary for the transmission of the information or the accomplishment of the purpose for which the lawyer is consulted." Critically, Cal. Evid. Code § 917 provides that a communication "does not lose its privileged character for the sole reason that it is communicated by electronic means or because persons involved in the delivery, facilitation, or storage of electronic communication may have access to the content of the communication." This provision was designed for email and cloud storage, but its application to AI platforms is contested since they do far more than passively store or transmit data.
Waiver of the privilege under Cal. Evid. Code § 912 occurs when the holder voluntarily discloses a significant part of the communication. However, Cal. Evid. Code § 912(d) provides that disclosure in confidence that is reasonably necessary for the accomplishment of the purpose for which the lawyer was consulted is not a waiver.
The attorney work product doctrine
The federal work product doctrine, codified at FRCP Rule 26, protects documents and tangible things prepared in anticipation of litigation or for trial by a party or its representative. The doctrine has two tiers: ordinary (fact) work product, which may be overcome by a showing of substantial need and inability to obtain the equivalent without undue hardship; and opinion work product, reflecting the mental impressions, conclusions, opinions or legal theories of an attorney, which receives near-absolute protection. Hickman v. Taylor, 329 U.S. 495 (1947) established foundational work product protection principles and emphasized that attorney mental impressions warrant strong protection.
California's work product doctrine is notably stronger than its federal counterpart. Under § 2018.030(a), a writing that reflects an attorney's impressions, conclusions, opinions or legal research or theories is "not discoverable under any circumstances"--an absolute bar with no exception for substantial need. § 2018.020 declares it the policy of the state to preserve attorneys' rights to prepare cases with the degree of privacy necessary to encourage thorough preparation. Fireman's Fund Insurance Co. v. Superior Court, 196 Cal. App. 4th 1263 (2011) extended § 2018.030(a)'s absolute protection to unwritten opinion work product, holding that the statute's protection of written opinion work product carries with it the implicit understanding that unwritten opinion work product is already entitled to absolute protection.
United States v. Heppner: The landmark AI privilege decision
The most significant case addressing AI and privilege is United States v. Heppner, 820 F. Supp. 3d 292 (S.D.N.Y. 2026). Although arising in a securities fraud prosecution, the court's analysis of attorney-client privilege and work product doctrine is directly applicable to civil litigation and has already been cited in civil cases. The defendant was charged with securities fraud and related offenses. After receiving a grand jury subpoena, he communicated with the publicly available AI platform Claude and sought to shield a large number of documents memorializing those communications from the government.
On attorney-client privilege, the court held that the AI documents failed all three elements. First, the communications were not between Heppner and his counsel, and all recognized privileges require a trusting human relationship with a licensed professional who owes fiduciary duties and is subject to discipline. No such relationship exists, or could exist, between an AI user and a platform such as Claude. Second, the communications were not confidential. Anthropic's privacy policy to which users consent provides that Anthropic collects data on both users' inputs and Claude's outputs, uses such data to train Claude, and reserves the right to disclose such data to third parties, including governmental regulatory authorities. The court concluded that Heppner could have had no reasonable expectation of confidentiality in his communications with Claude. Third, Heppner did not communicate with Claude for the purpose of obtaining legal advice; he did so on his own volition, and Claude itself disclaimed providing legal advice, recommending instead that users consult a qualified attorney. The court also rejected the argument that non-privileged communications become privileged when later shared with counsel, reaffirming the black-letter rule that non-privileged communications are not alchemically changed into privileged ones upon being shared with counsel.
On work product doctrine, the court held that the AI documents were not prepared by or at the behest of counsel. Heppner's counsel confirmed the documents were prepared by the defendant on his own volition, meaning Heppner was not acting as his counsel's agent. While the documents may have affected counsel's strategy going forward, they did not reflect counsel's strategy at the time Heppner created them.
Work product protection for AI-generated materials
While Heppner denied work product protection in the specific context of a party's unilateral, uncounseled AI use, other courts have reached different conclusions where the AI is used as a litigation tool by counsel or a party in anticipation of litigation.
In Warner v. Gilbarco, Inc., 820 F. Supp. 3d 629 (E.D. Mich. 2026), a pro se plaintiff used ChatGPT to assist in preparing her employment discrimination case. The court denied the defendant's motion to compel production of AI materials, holding that the materials were protected by the work product doctrine under Fed. R. Civ. P. 26(b)(3). The court reasoned that the generative AI program was a tool, not a person, and that the AI materials involved the plaintiff's internal drafting process, analysis and thought process, prepared in anticipation of litigation. Critically, the court held that using ChatGPT does not waive work product protection because work product waiver requires disclosure to an adversary or in a manner likely to reach an adversary's hands, and ChatGPT and other generative AI programs are tools, not persons, even if they may have administrators somewhere in the background.
Morgan v. V2X, Inc., No. 25-CV-01991, 2026 WL 864223 reached a similar conclusion, holding that Fed. R. Civ. P. 26(b)(3) applies to a pro se litigant's AI use and that AI interactions do not automatically compromise work product protections. The court reasoned that routing information through a third-party system does not forfeit all privacy, drawing an analogy to Fourth Amendment cases holding that using email or cloud services does not eliminate all privacy expectations. However, the court required the plaintiff to disclose the name of the AI tool used, finding that this limited disclosure did not reveal mental impressions or case strategy, while noting that the defendant was entitled to know which AI system had received confidential information.
The key distinction between Heppner on one hand and Warner and Morgan on the other is the context and direction of AI use. Where a party uses AI on their own initiative, without counsel's direction, and the outputs do not reflect counsel's strategy, work product protection is unlikely to apply. Where counsel directs AI use as part of litigation preparation, and the prompts and outputs reflect counsel's mental impressions and legal strategy, work product protection is far more likely to apply, and may be absolute under California's § 2018.030(a) if the materials constitute a writing reflecting an attorney's impressions, conclusions, opinions or legal theories.
Compelled discovery of AI chatbot prompts and outputs
Courts have addressed several attempts to compel production of AI chatbot logs and related materials, with mixed results depending on relevance, proportionality and privilege.
In In re OpenAI, Inc., Copyright Infringement Litigation, 800 F. Supp. 3d 602 (S.D.N.Y. 2025), the court denied a motion to compel the New York Times to produce over 80,000 internal AI chatbot log entries. The court held that the logs were neither relevant to the defendants' fair use defense nor proportional to the needs of the case under FRCP Rule 26. Even assuming relevance, the court found production would be disproportionate: reviewing 80,000+ entries for attorney-client privilege and reporter's privilege would require approximately 1,333 hours of attorney review time, costing upwards of $1 million for privilege review alone. Similarly, in New York Times Co. v. Microsoft Corp., 757 F. Supp. 3d 594 (S.D.N.Y. 2024), the court denied defendant OpenAI's motion to compel the plaintiff New York Times to produce evidence related to the Times's use of generative AI tools, finding the discovery not relevant to the defendant's fair use defense.
The at-issue waiver doctrine presents a significant risk. In Tremblay v. OpenAI, Inc., No. 3:23-cv-03223, 2024 WL 3748003 (N.D. Cal. Aug. 8, 2024), a California federal court found that counsel's AI prompts and outputs constituted opinion work product, but held that waiver applied to the extent counsel had disclosed those materials in the complaint. The court limited the waiver to materials actually disclosed, rejecting broad subject-matter waiver.
The third-party disclosure problem and attorney-client privilege
The central privilege problem with public generative AI platforms is that they are third parties with data retention and training policies that are fundamentally incompatible with the confidentiality requirement. The Kovel doctrine, established in United States v. Kovel, 296 F.2d 918 (2d Cir. 1961), extends attorney-client privilege to certain third-party communications where the third party's presence is necessary to facilitate the attorney-client relationship, such as an interpreter or accountant helping the attorney understand complex financial matters. However, Heppner rejected the application of Kovel to AI platforms, reasoning that recognized privileges require a trusting human relationship with a licensed professional who owes fiduciary duties and is subject to discipline, a relationship that cannot exist with an AI platform.
Under California law, Cal. Evid. Code § 952 permits third-party disclosure where it is reasonably necessary for the transmission of information or the accomplishment of the purpose for which the lawyer is consulted. The California State Bar's 2010-179 opinion recognized that transmission of information through a necessary third party should not destroy confidentiality. However, this protection is undermined when the third party (i.e., the AI platform) has its own data retention, training and disclosure policies that are inconsistent with confidentiality. Cal. Evid. Code § 917 provides that electronic communications do not lose their privileged character solely because of electronic transmission, but this provision addresses passive transmission, not active data collection and use for training purposes.
The practical consequence is that inputting client information into a public AI platform, which retain user inputs, use them for model training and may disclose them to third parties, likely constitutes a voluntary disclosure that destroys confidentiality and waives the attorney-client privilege. This is not inadvertent disclosure under FRE Rule 502 or Cal. Evid. Code § 912 because the attorney intentionally inputs the information. California State Bar Formal Opinion 2010-179 indicates that where the attorney-client privilege is at issue, failure to use sufficient precautions when using technology may be considered in determining waiver, and that use of technology lacking essential security features could potentially be deemed to have waived privilege protections.
From AI tool use to AI agents
The open/closed model distinction is the most practically significant factor in privilege preservation. Public AI tools typically retain user inputs, use them for model training and may disclose them to third parties. Inputting client-identifying or case-specific information into these platforms can destroy attorney-client privilege and creates serious work product waiver risks. Enterprise or closed AI systems tools that contractually prohibit data retention, training on user inputs, and third-party disclosure present a far lower risk and may preserve both privilege and work product protection, provided the contractual safeguards are documented and enforceable.
Today, counsel often adopt a tiered approach to AI tool use: (1) for general legal research and drafting that does not involve client-specific facts, public AI tools may be used with appropriate verification of outputs ( with the caveat that AI can misinterpret cases and sometimes will invert citations, leading to a number of attorneys have been sanctioned for misuse of AI); (2) for any work involving client-identifying information or case-specific facts, only closed enterprise AI systems with documented contractual protections should be used; (3) for any AI use involving materials produced in discovery or designated as confidential under a protective order, the protective order should include AI-specific provisions consistent with the Morgan v. V2X framework.
Privilege logs should be updated to include AI-generated materials withheld on privilege or work product grounds. While courts have not yet established specific privilege log requirements for AI materials, the standard requirements of Fed. R. Civ. P. 26(b)(5) and California discovery rules apply: the log must identify the nature of the document, the date, the author, the recipients and the basis for the privilege claim, with sufficient specificity to allow the opposing party to assess the claim.
The pace of judicial and regulatory activity on AI and privilege accelerated dramatically in 2025 and 2026. Heppner, Warner, and Morgan represent the first wave of direct judicial engagement with the privilege and work product questions that practitioners have been debating since the release of AI tools such as ChatGPT in late 2022. These decisions reveal a discernible framework: attorney-client privilege is unlikely to protect direct AI communications; work product protection may apply when counsel directs AI use as a litigation tool; and at-issue waiver will be enforced when parties affirmatively rely on AI-generated materials.
In sum, attorney-client privilege protects confidential communications made for obtaining legal advice and is narrowly construed; only communications between client and legal adviser in that capacity are privileged, with the client bearing the burden of proving applicability and non-waiver. Use of generative AI tools implicates new and evolving risks to the privilege and work product doctrine, particularly where client or counsel inputs could be disclosed to third parties, potentially waiving protections. Courts have begun addressing discovery requests for AI prompts and outputs. However, this area remains unsettled, with few decisions available.
What happens, though, when the algorithms evolve and expand from passive AI tools under direct human operation to autonomous AI agents capable of transacting in our economy with human and corporate counterparties themselves?
The rise of agentic litigation--A new challenge
While courts currently scrutinize the AI tools widely used today, the next phase of this evolution is already here: agentic AI. Unlike the static chatbots of 2025, AI agents built using open-source harnesses such as OpenClaw and Hermes operate with autonomy, interacting with decentralized finance protocols, managing supply chains and entering into contracts without continuous human prompting.
This autonomy creates a looming crisis of legal personality. In Argentina, President Javier Milei's administration has already proposed a framework for "non-human corporations," effectively creating a regulatory sandbox where AI can possess its own legal identity to facilitate transactions. While the United States remains firmly attached to the human-centric "legal person" model, we must consider the friction this creates. If an AI agent, operating via a Delaware LLC, enters into a cross-border contract and breaches that agreement, does the AI have standing to sue? Can it be served?
Under current U.S. civil procedure, the answer is a resounding "no." Standing requires a justiciable stake, and courts have not yet accepted the concept of an algorithm as an entity with "standing" to suffer real-world damages. Yet, if we continue to build "agentic commerce" infrastructure, where businesses are increasingly run by autonomous code, we create a paradox. We allow these agents to act as legal entities in the commercial sphere but deny them the procedural rights to defend themselves in court. The result will likely be the "piercing of the corporate veil" as a standard litigation strategy: plaintiffs will try to ignore the agent owned-and-operated LLC entirely and instead target the human programmers or corporate operators behind the code (if they can be identified).
As commerce becomes increasingly agentic, so too must our litigation strategies. We are moving toward a future where the primary actor in a high-stakes commercial dispute may not be a human CEO, but an autonomous agent that has executed a complex series of algorithmic trades or contractual engagements.
In this landscape, the lawyer's role is shifting from the drafter of contracts to the architect of "governance-by-design." Practitioners must prepare for a world where:
1. Evidence is algorithmic: Litigation will shift from discovering emails and memos to auditing prompt-logs, model-versioning and inference-layer guardrails.
2. Accountability is pre-programmed: Liability will be defined by the technical constraints placed on the agent at the time of its deployment.
3. The "human-in-the-loop" is a legal requirement: Just as the courts have demanded transparency in expert methodology, they will likely mandate that any agentic activity impacting third parties be tethered to a verifiable human chain of command.
For the modern lawyer, the message is clear: do not wait for statutory resolutions of the question of "AI personhood." The risks of discovery, the waiver of privilege and the mounting pressure for technical transparency are here today.
The businesses who thrive in this environment will not be those who try to shield their AI in a "black box," but those who treat their algorithmic agents as the most highly scrutinized members of their companies.