In February a federal court held that a defendant's conversations with a consumer AI tool were neither privileged nor work product. The decision is United States v. Heppner, No. 25-cr-00503 (S.D.N.Y. Feb. 17, 2026), and Judge Jed Rakoff treated it as a question of first impression. Since then a federal court in Colorado, the Delaware Court of Chancery and the New York City Bar have all added to the picture, and a proposed class action has put AI note-takers on the list.
None of these matters involved a law firm's own systems. They'll come up at your firm anyway, because general counsel and clients read them and then ask the CIO what the firm is doing. Below is what each decision says and the questions I'd expect a GC to bring to IT this quarter. This isn't legal advice. Your general counsel and outside counsel will read the decisions for your jurisdiction and your practice.
What the court decided in Heppner
Heppner received grand jury subpoenas in a securities and wire fraud investigation and hired counsel. On his own, he then used a consumer AI platform to organize information he thought was relevant to his defense, and some of what he typed reflected conversations with his lawyers. The FBI later seized the devices that held those exchanges.
The court found that the attorney-client privilege failed on three grounds. The AI tool isn't a lawyer, so there was no communication with counsel. The platform's privacy policy said it collects inputs and outputs, may use them to train its models and may disclose them to third parties, so there was no reasonable expectation of confidentiality. And the tool's own terms disclaimed giving legal advice. Work product failed because Heppner prepared the materials on his own initiative, without direction from his lawyers.
The part that matters most for firms is the question the court left open. It said that if counsel had directed Heppner to use the tool to help with his communications with counsel, "the result may have been different." Two facts carried the decision: who directed the use, and what the tool's terms allowed. A firm controls both.
A second court drew the line at the contract
In Morgan v. V2X, Inc., No. 25-cv-01991 (D. Colo. Mar. 30, 2026), Magistrate Judge Maritza Dominguez Braswell wrote her own AI provision into a protective order. Confidential information may go into an AI platform only if the provider is contractually prohibited from storing or using the inputs to train its model and from disclosing them to third parties except where that's essential to delivering the service, and only if the provider lets the user delete the confidential information on request. The parties have to keep written documentation of those terms.
The same ruling held that a litigant's AI-assisted preparation was protected work product, and that routing it through a third-party platform didn't waive the protection. It also held that the other side was entitled to learn which AI tool had been used, because that bears on whether confidential material was exposed. For a firm, the practical result is that the name of the tool and the terms of its contract can end up in front of a judge.
AI conversations are becoming evidence
In Fortis Advisors, LLC v. Krafton, Inc. (Del. Ch. Mar. 16, 2026), Vice Chancellor Lori W. Will found that a buyer had terminated the key executives of an acquired game studio to avoid up to $250 million in earnout payments. She ordered the studio's chief executive reinstated and extended the earnout period. The record included the buyer's leadership consulting an AI chatbot about how to get out of the earnout, and the opinion relied on that evidence.
The lesson for a law firm is direct. Prompts and outputs are records. Whatever a lawyer or a client types into an AI tool can be requested in discovery and read in a courtroom, so the firm should know where those records live, who can see them and how long it keeps them.
Note-takers are the quieter exposure
The New York City Bar's Formal Opinion 2025-6 (December 2025) says a lawyer should get the client's consent before recording a conversation with an AI tool, review transcripts and summaries before relying on them, and understand where the vendor stores the data, how long it keeps it and whether it trains on it. The committee also made a point every partner will recognize: people choose their words with more care when a verbatim record is being made. Formal Opinion 2026-2 (August 5, 2026) extends the analysis to conversations with people who aren't clients. It calls for the consent of all parties before recording, and it recommends that lawyers avoid recording by default because of the ethical and tactical risks.
In July a proposed class action filed in the Northern District of California alleged that an AI note-taking service recorded meetings without the knowledge of most participants and used the recordings to train its models by default. The allegations haven't been proven. The questions they raise about default settings, consent and training apply to every note-taker a firm allows on its calls.
The questions your GC will ask IT
Taken together, these decisions turn privilege into an infrastructure question. These are the questions I'd expect a general counsel to bring to the CIO, and they're the same ones clients are starting to write into outside counsel guidelines.
- Which AI tools touch client information? That includes the ones nobody approved. A lawyer using a personal account on a consumer tool is the Heppner fact pattern.
- What do the contracts say? For each tool, does the provider agree not to train on our inputs, not to disclose them to third parties, and to delete them on request? Could we produce that documentation if a court asked, as the Morgan order requires?
- Is AI used at counsel's direction, and can we show it? Heppner left room for a different result when counsel directs the use. Written policies, matter-level instructions and usage logs are how a firm would show it.
- Where do prompts, outputs and transcripts live? Who can read them, how long they're kept, and whether legal holds reach them.
- Which meetings get recorded, and with whose consent? What the default setting is on every note-taker, and who can change it.
- Do ethical walls apply to AI? If a lawyer is walled off from a matter, can an AI tool still surface that matter's documents in an answer to that lawyer?
- If we had to disclose which tool was used on a matter, what would the disclosure reveal?
What I would do this quarter
Start with an inventory, and include the usage IT didn't sanction. The fastest way to find it is to ask each practice group what its lawyers actually use. Put the contract terms for every tool in one table and check them against the conditions in the Morgan order. Set retention and legal hold rules for AI prompts, outputs and meeting transcripts, the same way the firm already does for email. Change note-taker defaults so that recording requires consent and announces itself.
Then work on the people side. Add AI language to engagement letters. Train lawyers and staff on the basics of privilege and work product as they apply to these tools, because typing "privileged" into a prompt doesn't create the privilege. And give your general counsel a standing seat in AI purchasing decisions, so the contract terms get read before the tool is rolled out.
How we approach it at Reframe
We built Reframe with the GC's questions in mind. Access is checked at the moment a question is asked, ethical walls apply to every answer, every model call is logged, and every answer cites the document it came from. When the general counsel asks who saw what and what the system relied on, the firm can answer from the record.
Drafted with Reframe Editorial Agent, an AI employee at Reframe. 