# Does Using Claude Waive Attorney-Client Privilege?

Not by itself. One 2026 ruling found a client's own Claude chats weren't privileged; most courts since protected AI-assisted work. Here's what decides it.

By Gabe Pérez. Published 2026-11-13.
Original: https://gabezen.com/blog/does-claude-waive-attorney-client-privilege/

Not by itself, but it can. In the one federal ruling on whether Claude chats are privileged, [United States v. Heppner](https://www.akingump.com/a/web/ssTGsd5NHbtZ1onzXQMTye/1_25-cr-503-27-memorandum.pdf), a judge held that a defendant's own Claude chats about his case were neither privileged nor work product. He used Claude on his own, his lawyers hadn't asked him to, and the court judged his chats against the privacy policy for Anthropic's personal plans. At least eight more courts ruled on AI chats and work product in 2026: six protected them at least in part, one sided with Heppner, and one said it depends. What decides it is who directed the work, which terms the account runs on, and whether you're claiming privilege or work product, because the two are lost in different ways.

Lawyers ask me this when we talk about setting up Claude for their firm. I'm not a lawyer and this isn't legal advice: privilege is a question for your own counsel, under your state's law. I set up Claude Team for small firms, so I have a stake in the plan question. Everything below comes from the opinions, bar guidance and Anthropic's own pages, which I read on November 13, 2026.

## What did the court decide in Heppner?

In [Heppner](https://www.akingump.com/a/web/ssTGsd5NHbtZ1onzXQMTye/1_25-cr-503-27-memorandum.pdf), a securities fraud defendant got a grand jury subpoena and then, "without any suggestion from counsel," used Claude to write reports outlining his defense. The FBI seized about 31 of them with his devices. His lawyers conceded they "did not direct [Heppner] to run Claude searches." Judge Rakoff ruled from the bench on February 10, 2026 and explained why in a memorandum a week later.

Privilege needs a communication with a lawyer, kept confidential, for legal advice. The court found the chats lacked "at least two, if not all three":

- **No lawyer.** "Heppner does not, and indeed could not, maintain that Claude is an attorney."
- **Not confidential.** The court read the privacy policy Claude's users agree to, which let Anthropic collect inputs and outputs, train on them, and disclose them to third parties including "governmental regulatory authorities."
- **Not for legal advice.** The court called this one "a closer call." When the government asked Claude, it answered, "I'm not a lawyer and can't provide formal legal advice or recommendations."

Two more lines matter to any firm. Sending the chats to his lawyers afterward didn't help: "non-privileged communications are not somehow alchemically changed into privileged ones upon being shared with counsel." And where he'd typed in what his lawyers had told him, he "waived the privilege by sharing that information with Claude and Anthropic, just as if he had shared it with any other third party."

Work product failed too, because the documents weren't "prepared by or at the behest of counsel." The court left one door open: "Had counsel directed Heppner to use Claude, Claude might arguably be said to have functioned in a manner akin to a highly trained professional who may act as a lawyer's agent within the protection of the attorney-client privilege." For that idea it cited United States v. Kovel.

A jury [convicted Heppner on all four counts](https://archive.org/download/gov.uscourts.nysd.652137/gov.uscourts.nysd.652137.69.0.pdf) on May 14, 2026. In June he [moved for a new trial](https://archive.org/download/gov.uscourts.nysd.652137/gov.uscourts.nysd.652137.71.0.pdf), arguing the court "erred in concluding that the AI Documents are not protected by the work-product doctrine." The [government's reply](https://archive.org/download/gov.uscourts.nysd.652137/gov.uscourts.nysd.652137.74.0.pdf) notes he didn't renew the privilege argument. [Sentencing was postponed](https://archive.org/download/gov.uscourts.nysd.652137/gov.uscourts.nysd.652137.81.0.pdf) in October, and I found no decision on the motion in [the filings available](https://archive.org/details/gov.uscourts.nysd.652137) through October 16, 2026.

## Have other courts agreed with Heppner?

Mostly not, on work product. These are the 2026 decisions I could read in full:

| Case | Who used AI | Result |
|---|---|---|
| [Warner v. Gilbarco](https://law.justia.com/cases/federal/district-courts/michigan/miedce/2:2024cv12333/379552/94/) (E.D. Mich., Feb. 10) | A party with no lawyer, ChatGPT | Protected work product; she didn't have to hand the chats over |
| [Morgan v. V2X](https://www.govinfo.gov/content/pkg/USCOURTS-cod-1_25-cv-01991/pdf/USCOURTS-cod-1_25-cv-01991-0.pdf) (D. Colo., Mar. 30) | A party with no lawyer | Protected, and the court named Claude among the tools |
| [Tym v. Cerno](https://websitedc.s3.amazonaws.com/documents/Tym_v._Cerno_USA_22_April_2026.pdf) (D.N.M., Apr. 22) | A plaintiff's own filings | Protected, adopting Morgan "for this case only" |
| [Tate Group v. Legacy Automotive](https://websitedc.s3.amazonaws.com/documents/Tate_Group_v._LEgacy_USA_3_June_2026.pdf) (Tex. Bus. Ct., June 3) | A non-lawyer at a represented company, ChatGPT | Mostly protected; some pages had to be produced, and the company had to list the discovery documents it had put into ChatGPT |
| [Assini v. Hayward](https://web.archive.org/web/20261019194708/https://www.nycourts.gov/reporter/current/3dseries/2026/2026_26086.shtml) (N.Y. Sup. Ct., June 4) | A defendant with no lawyer, ChatGPT | Subpoena to OpenAI quashed |
| [Shealy v. Seaside](https://www.damiencharlotin.com/documents/2641/Shealy_v._Seaside_Investment_uSA_June_2026.pdf) (Mass. Super. Ct., June) | A represented party's partner, at his request, ChatGPT | Not protected "unless performed at the direction of counsel" |
| [Villanueva v. LVMPD](https://archive.org/download/gov.uscourts.nvd.166491/gov.uscourts.nvd.166491.112.0.pdf) (D. Nev., Sept. 29) | A party's expert witness, ChatGPT | Prompts and draft report protected, privilege not waived; the case summaries ChatGPT wrote had to be disclosed |
| [Fontainebleau v. Botach](https://www.damiencharlotin.com/documents/3309/2026-10-21-fontainebleau-florida-hotel-v-botach.pdf) (S.D. Fla., Oct. 21) | A represented defendant, ChatGPT and Grok | Neither automatically protected nor automatically discoverable; subpoenas to the AI providers allowed for some topics |

The courts that protected AI work leaned on one difference. Showing privileged material to a third party generally waives privilege. Work product survives unless it goes to an adversary or somewhere likely to reach one. Warner put it this way: "the work-product waiver has to be a waiver to an adversary or in a way likely to get in an adversary's hand," and "ChatGPT (and other generative AI programs) are tools, not persons, even if they may have administrators somewhere in the background." Morgan agreed that AI providers collecting user data "does not eliminate all expectations of privacy or automatically waive protections."

In Warner, Morgan and Assini the party had no lawyer. Morgan used that to square its ruling with Heppner: "A pro se litigant is simultaneously the party and the advocate." The split is over the client who has a lawyer and uses AI alone. Tate "disagrees with" Heppner, and Fontainebleau "does not read Heppner as establishing that all materials independently prepared by a represented party are categorically unprotected." Shealy went with Heppner. For a firm, Heppner is still the risk to plan around.

*Chart: Most of the protection went to people with no lawyer; for a client who has one and uses AI alone, the courts split.*

| Who used the AI | Case | Result |
|---|---|---|
| A party with no lawyer | Warner (E.D. Mich.) | Protected |
| A party with no lawyer | Morgan (D. Colo.) | Protected |
| A party with no lawyer | Assini (N.Y. Sup. Ct.) | Protected |
| A plaintiff; the order doesn't say if he had a lawyer | Tym (D.N.M.) | Protected |
| A represented party on his own | Heppner (S.D.N.Y.) | Not protected |
| A represented party's partner, at his request | Shealy (Mass. Super. Ct.) | Not protected |
| A non-lawyer at a represented company | Tate (Tex. Bus. Ct.) | Mostly protected |
| A represented party on his own | Fontainebleau (S.D. Fla.) | Case by case |
| A party's expert witness | Villanueva (D. Nev.) | Prompts and draft report protected; ChatGPT's case summaries disclosed |
| A lawyer directing it | None found | No ruling yet |


Anthropic's [help article on legal work](https://support.claude.com/en/articles/15707726-using-claude-for-legal-work-privilege-confidentiality-and-how-to-think-about-configuration) says later decisions went the other way "in the context of both pro se litigants' and attorneys' use of AI," and cites Warner, Morgan, Tate and Assini. None of those four protected a lawyer's own use of AI. The parties in Warner, Morgan and Assini had no lawyer, and the chats in Tate were a non-lawyer's.

## Does a Claude Team plan change the answer?

It changes the part of [Heppner](https://www.akingump.com/a/web/ssTGsd5NHbtZ1onzXQMTye/1_25-cr-503-27-memorandum.pdf) that turned on the terms, and nothing else. The court's confidentiality reasoning rested in part on the privacy policy for personal accounts. A Team or Enterprise account runs on Anthropic's [Commercial Terms](https://www.anthropic.com/legal/commercial-terms), which read differently on each point the court raised:

| What the court looked at | Personal plans (Free, Pro, Max, Ultra) | Team and Enterprise |
|---|---|---|
| Is your content confidential? | The [Consumer Terms](https://www.anthropic.com/legal/consumer-terms) don't say it is | "Customer Content is Customer’s Confidential Information." |
| Training | [A setting each person chooses](https://privacy.claude.com/en/articles/10023580-is-my-data-used-for-model-training) | "Anthropic may not train models on Customer Content from Services." |
| Handing it to the government | The [privacy policy](https://www.anthropic.com/legal/privacy) allows sharing with "government authorities, law enforcement, or other third parties" to comply with legal process | Only when "required by law, or court or administrative order," and Anthropic must notify the customer promptly unless that's prohibited, and help narrow it |

Anthropic's [policy on government requests](https://privacy.claude.com/en/articles/10023650-what-is-anthropic-s-policy-for-handling-governmental-requests-for-user-information) adds that "if data is sought on an API or enterprise customer, we will generally ask the requester to contact our customer in the first instance." It doesn't say whether a Team account counts, and I found nothing public on how it treats a civil subpoena.

Courts have started to draw the same line. [Fry v. Fry](https://www.damiencharlotin.com/documents/3053/Fry_v._Fry_USa_27_August_2026.pdf) (E.D. Pa., Aug. 27) refused to seal documents a party had uploaded to "non-enterprise versions of Claude and Claude CoWork," because Anthropic's pages "make clear that such information is not private." A Colorado magistrate judge, writing a protective order in [Dunn v. LexisNexis](https://www.damiencharlotin.com/documents/3037/Dunn_v_LexisNexis_Risk_Solutions_Inc.pdf), said a party may ask to keep confidential material out of "consumer-grade AI tools that do not offer the same assurances and configurations found in certain enterprise offerings."

The New York State Bar's [guidelines](https://nysba.org/wp-content/uploads/2026/10/APPROVED-REPORT-AIETC-Ethics-Guidelines-2026-10-23-11AM-V7-FINAL-with-comments.pdf), approved October 31, 2026, say "Heppner should not be read as establishing that any use of generative AI forfeits privilege or work-product protection," and that for work product the provider's confidentiality terms "will be a substantial, perhaps determinative, factor."

### Does Team meet a protective order like Morgan's?

Maybe not in full. [Morgan's order](https://www.govinfo.gov/content/pkg/USCOURTS-cod-1_25-cv-01991/pdf/USCOURTS-cod-1_25-cv-01991-0.pdf) lets a party put confidential material into an AI tool only if the provider is contractually barred from "storing or using inputs to train or improve its model" and from sharing inputs beyond what the service needs. The provider must also let you delete everything on request, and the party must "retain written documentation of these contractual protections."

The Commercial Terms cover training and sharing. They promise to destroy your confidential information on request, "except where retained to comply with law or copies in Recipient’s automated back-up systems." Storing is the hard part. Team [keeps chats until someone deletes them](https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data), and [Anthropic's own article](https://support.claude.com/en/articles/15707726-using-claude-for-legal-work-privilege-confidentiality-and-how-to-think-about-configuration) paraphrases Morgan as barring a provider from "training on, retaining, or disclosing" data, which is the stricter reading. Zero data retention [doesn't cover Claude chats](https://privacy.claude.com/en/articles/8956058-i-have-a-zero-data-retention-agreement-with-anthropic-what-products-does-it-apply-to) on any plan. [Enterprise can set a retention period](https://privacy.claude.com/en/articles/10440198-configure-custom-data-retention-controls-for-enterprise-plans), but no shorter than 30 days.

Dunn's agreed clause is easier to meet: "no model training on inputs, no third-party disclosure beyond what is essential for service delivery, and the ability to delete information." If you're negotiating an order, that wording fits a Team account. Whether a given order is met is for the lawyer reading it.

### What happens to deleted chats?

Deleting a chat doesn't settle it. In the New York Times case against OpenAI, a magistrate judge [ordered OpenAI](https://archive.org/download/gov.uscourts.nysd.612697/gov.uscourts.nysd.612697.551.0.pdf) to "preserve and segregate all output log data that would otherwise be deleted." The district judge [later upheld](https://archive.org/download/gov.uscourts.nysd.640396/gov.uscourts.nysd.640396.1021.0.pdf) an order to produce a sample of 20 million logs, calling them conversations "which users voluntarily disclosed to OpenAI." [OpenAI's own account](https://web.archive.org/web/20261028153433/https://openai.com/index/response-to-nyt-data-demands/) says the order covered its Team plan and not Enterprise. In Fontainebleau the AI providers said they keep deletion logs, and the court [ordered the defendant to consent](https://archive.org/download/gov.uscourts.flsd.682106/gov.uscourts.flsd.682106.322.0.pdf) to their release.

On Claude Team, only the [Primary Owner can export](https://support.claude.com/en/articles/13346720-export-your-organization-s-data) the organization's chats, and chats deleted before an export are left out of it.

### Should a firm that litigates pay for Enterprise?

For the contract, no: Team already runs on the Commercial Terms. Enterprise adds what you'd use to preserve and collect chats: [retention settings, audit logs and a Compliance API](https://claude.com/pricing) that eDiscovery tools such as [RelativityOne pull from](https://support.claude.com/en/articles/15167101-get-started-with-claude-compliance-api-integrations). [The audit logs post](https://gabezen.com/blog/does-claude-team-have-audit-logs/) covers what Team shows instead. Enterprise has a 20-seat minimum, which is more than most small firms have. On Team, preservation is a written rule against deleting matter chats plus the Primary Owner's export.

One gap on Team: a thumbs up or down can be used for training, and a rating sends Anthropic [the whole conversation](https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-model-training). An Owner can turn rating off for everyone, and a firm should.

A Team seat doesn't fix the other two elements of privilege. Claude still isn't your lawyer, and a client using their own account is still Heppner. I found no ruling yet on a Claude Team or Enterprise account.

## Is privilege the same as my duty of confidentiality?

No. Privilege is a rule of evidence about what a court can make you produce. Your duty under Rule 1.6 is wider, and you can breach it without anyone ever asking for the chats. [ABA Formal Opinion 512](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf) describes it as keeping confidential "all information relating to the representation of a client, regardless of its source."

The same opinion says that for "self-learning" tools, "a client’s informed consent is required prior to inputting information relating to the representation." It also says every lawyer "should read and understand the Terms of Use, privacy policy, and related contractual terms" of the tool. D.C.'s [Opinion 388](https://www.dcbar.org/for-lawyers/legal-ethics/ethics-opinions-210-present/ethics-opinion-388) ties the two duties together: clients "typically should not be asked to consent" to "wide ranging disclosures that could waive attorney/client privilege."

State bars split on whether a business plan that doesn't train needs the client's consent. The [New York State Bar](https://nysba.org/wp-content/uploads/2026/10/APPROVED-REPORT-AIETC-Ethics-Guidelines-2026-10-23-11AM-V7-FINAL-with-comments.pdf) says it plainly: "Authorities differ on when client consent is required."

- **Consent for any outside AI.** Kentucky's [E-457](https://kybar.org/Portals/0/Admin/Ethics%20Opinions/KBA%20E-457.pdf) says "If an outside AI service will be receiving information protected by the lawyer's duty of confidentiality under SCR 3.130(1.6), then obtaining client consent is required," though a written promise not to share "may" make it allowable. Florida's [Opinion 24-1](https://www.floridabar.org/etopinions/opinion-24-1/) says "it is recommended that a lawyer obtain the affected client's informed consent prior to utilizing a third-party generative AI program if the utilization would involve the disclosure of any confidential information."
- **Depends on the tool.** Washington's [Opinion 2025-05](https://www.wsba.org/docs/default-source/legal-community/committees/committee-on-professional-ethics/ao-202505.pdf?sfvrsn=9754e5f1_3) says "no specific discussion of AI tools may be required when, for example, they are tailored to law practice and offer contractual assurances of confidentiality consistent with RPC 1.6." Oregon's [Opinion 2025-205](https://www.osbar.org/_docs/ethics/2025-205.pdf) requires consent for "open" models and, for closed ones, says the lawyer "must consider whether" consent is needed. Texas's [Opinion 705](https://www.legalethicstexas.com/resources/opinions/opinion-705/) asks you to be "reasonably satisfied that the program will not reveal confidential information to others," and to get consent if you aren't.

[Whether a plan that doesn't train counts as "self-learning"](https://gabezen.com/blog/can-i-put-client-data-into-claude/#what-i-couldnt-confirm), and what to tell a client before the first paste, are in the client data post. [The law firm page](https://gabezen.com/for/law-firms/) maps each duty in Opinion 512 to how I set Claude up.

## How do I keep a firm's Claude use protected?

Set it up so your facts look nothing like Heppner's:

1. **Firm work on the firm's account.** Team or Enterprise, never a personal Free, Pro, Max or Ultra seat, even with training off.
2. **A lawyer directs it.** Note in the matter file that the lawyer asked for the analysis and why. [Anthropic's article](https://support.claude.com/en/articles/15707726-using-claude-for-legal-work-privilege-confidentiality-and-how-to-think-about-configuration) says a lawyer "visibly directing the work" strengthens the protection.
3. **Turn off thumbs up and down** for the whole organization, and keep a dated copy of the Commercial Terms with your engagement records. The [New York State Bar](https://nysba.org/wp-content/uploads/2026/10/APPROVED-REPORT-AIETC-Ethics-Guidelines-2026-10-23-11AM-V7-FINAL-with-comments.pdf) warns that proving a provider's terms is "often complicated by changes in terms of service." Between October and November 2026, Anthropic's own legal article [changed who it says can set retention](https://web.archive.org/web/20261010004522/https://support.claude.com/en/articles/15707726-using-claude-for-legal-work-privilege-confidentiality-and-how-to-think-about-configuration), while its "as of June 2026" line stayed the same.
4. **Keep each matter apart.** One private project per client, with account memory off, so nothing from one matter turns up in another. [The client data post](https://gabezen.com/blog/can-i-put-client-data-into-claude/#will-claude-mix-up-my-clients-data) has the settings.
5. **Keep the Primary Owner role inside the firm.** That person [can export every chat in the organization, Incognito ones included](https://gabezen.com/blog/can-my-employer-see-my-claude-chats/#can-my-employer-see-my-incognito-claude-chats). If an outside IT person or consultant holds it, someone outside the firm can read client chats. [The roles post](https://gabezen.com/blog/claude-team-owner-vs-admin/) covers who should hold what.
6. **Stop deleting when a hold starts.** On Team each member can delete their own chats, and deleted chats drop out of later exports. Put the hold in writing and have the Primary Owner run an export the day it starts.
7. **Ask clients about their own AI, then warn them off it.** This is where Heppner bites. At intake, ask whether they've already used an AI tool on the matter. [New York City's bar](https://www.nycbar.org/wp-content/uploads/2025/12/20221554-AIRecordingEthicsOpinion-1.pdf), writing about clients who record calls with their own AI, says lawyers "should advise clients of the risks of the loss of confidentiality and privilege." A sentence in the engagement letter or the first email covers it:

> Please don't put anything about this matter into ChatGPT, Claude or another AI tool on your own account, even to prepare for our calls. A federal court has ruled that a client's own AI chats about a case weren't privileged. If you've already done this, tell us. If AI would help, ask us, and we'll do that work under our firm's account.

## What's still unsettled?

- **No appeals court has ruled.** Every decision above comes from a trial court, and Heppner's new-trial motion was still undecided in the last filing I could read.
- **The client who has a lawyer and uses AI alone.** Heppner and Shealy say no protection; Tate and Fontainebleau say it can be protected.
- **Whether a lawyer-directed Claude is a Kovel agent.** Heppner says only "might arguably," and I found no case that tests it. The nearest is Villanueva, and it rests on the rules for expert witnesses.
- **A business account.** I found no ruling on a Claude Team or Enterprise account.
- **Your state.** Privilege and work product are matters of each jurisdiction's law, and so are the ethics rules above.

If you run a small firm, [the law firm page](https://gabezen.com/for/law-firms/) shows how I set up Claude Team for one, with the sources for each rule. If you want to talk through your firm's setup first, [bring it to a 30-minute call](https://gabezen.com/contact/).

Sources for the facts on this page, checked November 7, 2026: [Configure custom data retention controls for Enterprise plans](https://privacy.claude.com/en/articles/10440198-configure-custom-data-retention-controls-for-enterprise-plans), [Claude pricing](https://claude.com/pricing), [Commercial Terms of Service](https://www.anthropic.com/legal/commercial-terms), [Is my data used for model training? (consumer)](https://privacy.claude.com/en/articles/10023580-is-my-data-used-for-model-training), [Is my data used for model training? (commercial)](https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-model-training).

---

More posts: https://gabezen.com/blog/
The whole site in one file: https://gabezen.com/llms.txt