In February 2026, a federal judge in Manhattan ruled that 31 documents a defendant generated with a consumer AI chatbot were not protected by attorney-client privilege, even after he handed them to his lawyers. The Heppner decision is the first published U.S. ruling to squarely address what happens to privilege when a person types confidential facts into a public generative AI tool. The answer, for now, is that the privilege can vanish before a lawyer ever sees the file.

That isn't a niche procedural question. It reaches into every corner of a modern practice: how associates draft, how litigators cull discovery, how partners price a matter, and how clients are told to prepare. The cases below are the ones firms are working through right now, each with its own confidentiality problem and its own fix.

The Consumer-Chatbot Trap in Client Intake

The most common privilege risk sits at the front door. A prospective client, trying to be helpful, pastes a dispute summary into a free chatbot and forwards the polished output to counsel. Under existing doctrine, that voluntary disclosure to a third-party vendor can waive privilege over the underlying facts, and forwarding the file to a lawyer doesn't repair it.

Firms are responding with intake language that reads more like a warning label than a welcome. New clients are told, in plain terms, not to use public AI tools to organize their case, summarize documents, or draft communications about the matter. Some engagement letters now include a specific representation that the client hasn't shared confidential facts with a consumer AI product, and a duty to disclose it if they have. Preserving privilege is easier than arguing it back into existence.

Document Review Moves Inside a Private Perimeter

Large-scale document review was the first place AI paid for itself, and it's also where confidentiality exposure compounds fastest. A single review project can involve millions of files touching trade secrets, medical records, and privileged communications. Sending any of that to a general-purpose model with unclear data-retention terms is a problem a court doesn't need to invent. The black-letter rule on third-party disclosure already answers it.

The workaround firms have settled on is architectural rather than procedural. Review runs on tenanted or on-premises models where prompts and outputs never leave the firm's control, retention is set to zero, and training on client data is contractually prohibited. Vendor diligence has become a matter-opening question rather than an IT afterthought, and the general counsel signs off before the first batch is loaded.

Drafting With a Machine, and the Work-Product Question Behind It

Drafting is where AI feels most useful and where lawyers get the sloppiest. A first-pass memo, a discovery response, a demand letter, all of it drafts faster when a model has read the file. The confidentiality question is whether the mental impressions a lawyer feeds into the prompt survive as protected work product on the way out.

The safer answer treats the model the way a firm treats a consulting expert: usable, but only under counsel's direction and only inside an environment the firm controls. Prompts that reveal litigation strategy don't go into public tools. Draft outputs get reviewed and rewritten before they leave a lawyer's screen, and the audit trail (who prompted, what was returned, what was kept) is preserved with the matter file.

Discovery and the Vendor Chain Nobody Mapped

Discovery has long relied on outside vendors, and AI has lengthened the chain. A hosting platform may call an embedded model. That model may call a foundation provider. Each hop is a place where privileged material can be logged, cached, or used for training.

Firms that assumed a signed BAA or protective order covered them are re-papering their vendor stack.

The practical steps look like this:

• Map every subprocessor. Before a matter starts, the firm gets a written list of every model, host, and API the vendor will touch, and confirms no client data is used to improve those systems.
• Lock down retention. Prompts, outputs, and logs are set to a defined retention window tied to the matter, not a vendor default.
• Segregate by matter. Data from one client shouldn't be searchable or retrievable in another client's workspace, even inside the same firm tenant.

The Economics Shift Only Works If the Confidentiality Story Holds

AI changes law firm economics because it compresses the hours between a file arriving and a usable draft going out. Buyers of legal services have noticed, and engagement letters are being renegotiated around fixed fees, capped budgets, and outcome-linked pricing. None of that survives a privilege incident. A single waiver ruling on a big matter can erase a year of efficiency gains and then some, which is why the firms moving fastest on pricing are also the ones investing hardest in governance, building the kind of secure infrastructure and human approval gates highlighted in what what Law.co found about legal AI found about legal AI.

The academic debate isn't settled. A recent Harvard Law Review critique argued that the reasoning in the February ruling swept too broadly and undersold the ways courts already handle non-lawyer intermediaries. Whether higher courts narrow it or extend it, the direction of travel is clear: firms that can show a defensible workflow (private infrastructure, documented oversight, retention controls, client warnings at intake) are the ones that will keep both the efficiency and the privilege.