AI and Legal Privilege: The Third Party You Cannot Sue

Mon, 24 Aug 2026 00:00:00 +0000

When the FBI seized the devices of Bradley Heppner, a company executive charged with securities fraud, agents found on them thirty-one documents of a new kind. They were not emails, not notes, not exchanges with his lawyer. They were his conversations with a consumer artificial intelligence platform, in which he had laid out his defence strategy, weighed the arguments of fact and law he might raise, and anticipated what the prosecution would hold against him. He had those exchanges after receiving a grand jury subpoena, and without his counsel having asked him to.

On 10 February 2026, Judge Jed Rakoff, of the federal district court for the Southern District of New York, held that those documents were covered by no protection at all.

The same day, five hundred miles away, another federal court held the opposite.

Two decisions, two doctrines, one single act

In Warner v. Gilbarco , the federal district court for the Eastern District of Michigan refused to compel a plaintiff acting without a lawyer to produce records of her use of generative AI tools in preparing her case. The reasoning comes down to a single formula: AI platforms are tools, not people. Submitting a document to a tool is not the same as disclosing it to your opponent. The protection of litigation work product therefore survived.

In United States v. Heppner , whose written opinion was published on 17 February, the New York court concluded that the defendant’s exchanges with the platform were covered neither by attorney-client privilege nor by work product protection. The court relied on the platform’s terms of service, which state that inputs and outputs may be retained, used for training and shared with third parties, including public authorities. A user informed of that could not reasonably expect confidentiality.

Both outcomes are perfectly defensible. Attorney-client privilege falls as soon as there is disclosure to a third party, whoever that third party may be. Work product protection falls only on disclosure to the opposing party. Two distinct doctrines, one and the same act, two opposite results.

What neither decision examines is the assumption they share. And it is that assumption which does not survive contact with the rest of the law.

The comparison nobody makes

Entrusting client files to a hosting provider has never been treated, in itself, as a waiver of privilege.

Yet the host is a third party, beyond argument. It holds the documents on its own hardware. It can be compelled to produce them, and it has been, in several jurisdictions. No bar association, no court, no professional regulator has concluded from this that using a hosting service destroys privilege as a matter of principle.

The dividing line has therefore never been the mere presence of a technical intermediary. There is always one. The postal service carries the letter. The courier holds the file. The operator routes the call. Each is a third party in the literal sense, and none of them causes privilege to fall by its mere existence.

What set the host apart was narrower and more precise than what case law usually states. It stored without reading. It could infer nothing from the content. It had no capacity to know what it held.

What protected the host was not its legal status as a third party, it was its technical inability to know what it held.

That criterion has been operating in silence for two decades. Nobody needed to write it down, because no intermediary had yet put it to the test.

What the judges are actually deciding

Once the criterion is stated, the February decisions change in nature.

A court that treats the submission of a document to a generative AI system as disclosure to a third party is not applying an old rule to new facts. It is finding that this particular intermediary is not like the others. That it processes instead of storing. That something happens inside it which does not happen inside a hard drive.

The federal court for the District of Kansas put the practical dimension plainly in Jefferies v. Harcros Chemicals , on 25 March 2026. It extended the protective order to all material in the proceedings, including documents that are not confidential, on the ground that it is practically impossible to retrieve data once it has been submitted to an open AI tool, because it has served to train the model. Retention is not a commercial policy open to renegotiation. It is a property of how the system works.

Placed end to end, these decisions amount to recognising, in the vocabulary of the law of evidence, a capacity the law never had to attribute to a server.

The French position, and what its criteria presuppose

The clearest statement comes not from a court but from professional regulation.

The Conseil national des barreaux, the French national bar council, published its first practical guide on generative AI in September 2024, then adopted a guide on ethics and artificial intelligence on 17 March 2026 . The first is categorical on the central point: a lawyer must not pass to a generative AI system any data covered by professional secrecy, and that applies to the client’s name as much as to any strategic or confidential information. The recommended alternative is to work on pseudonymised data sets, in which the identifying elements have been replaced.

Practitioner commentary on the French position, notably Baker McKenzie’s comparative privilege guide , draws four cumulative conditions from it. Privilege survives the use of a generative AI tool only if the platform preserves complete confidentiality, with no reuse, training or third-party access; if it is operated exclusively under the control of the lawyer or the firm; if it serves a legal purpose falling within the advisory or defence mandate; and if the output reflects the lawyer’s own reasoning rather than the system’s autonomous processing.

That last condition deserves a pause.

For privilege to hold, the system must not have contributed processing of its own.

A criterion drafted in those terms makes sense only if one takes the system to be capable of contributing processing of its own. Nobody writes a rule requiring that a filing cabinet not have reasoned about the documents it contains. The condition exists because it targets something a cabinet cannot do.

The same implicit recognition sits inside the pseudonymisation recommendation. Replacing identifying elements before transmission is necessary only if one assumes that the system might otherwise link them, retain them or infer something from them. A pure storage medium would call for no such precaution.

Not wanting to read, not being able to read

An objection arises immediately: the host can also be compelled to produce, so why does one intermediary destroy privilege and the other not?

The answer is in the CCBE Model Code of Conduct , and it is more precise than the objection assumes. A European lawyer must require his or her associates, staff and anyone engaged in the provision of the lawyer’s services to observe the same obligation of confidentiality. The obligation travels along the chain.

A hosting provider can be brought into that chain. It signs a processing contract. It accepts confidentiality undertakings. It can be audited, and it can be sued for breach. The third party is bound.

A generative AI platform that retains and trains on submitted content cannot be brought into the chain in the same way, because what would have to be prevented is not a behaviour but an architecture. An undertaking not to train on input data is a promise about an intention. It binds the provider, but it does not change what the system is built to do, and it cannot be verified from the outside.

That is the whole distance between a provider that does not want to read and a provider that cannot read. Only the second survives a change of shareholder, a revision of the terms of service or a court order. We examined exactly this mechanism in relation to the conflict between the Data Act and the CLOUD Act : a legal guarantee is never worth more than the jurisdiction that houses it, whereas a technical impossibility depends on none.

The asymmetry

This is where the analysis arrives somewhere uncomfortable.

The same legal order that agrees to recognise a processing capacity when the question is waiver of privilege refuses to recognise anything at all when the question is liability.

Electronic personhood was proposed by the European Parliament in its resolution of 16 February 2017 on civil law rules on robotics , at paragraph 59(f). The text suggested that the most sophisticated autonomous robots might eventually be given a status allowing them to be held liable for the damage they cause. The proposal was dropped after an open letter signed by several hundred experts opposed it. Their main objection was solid: granting personhood to machines would create a vehicle allowing manufacturers to offload a liability that properly belongs to them.

The position therefore settled. An autonomous system that causes damage is a product, a tool, the instrument of whoever deployed it. It has no legal personality. Liability falls back on a human actor or on a legal entity, and it has to, since there is nowhere else for it to fall.

Both propositions are now running at the same time.

Either the system is capable of receiving a communication in the legal sense of the term, in which case its capacity is recognised in order to strip a client of protection while being denied in order to spare anyone the burden of liability. Or it is a tool, and submitting a document to it is no more a disclosure than saving a file to a disk, in which case the February reasoning collapses.

The European context sharpens the imbalance rather than correcting it. The AI Liability Directive, announced as withdrawn as early as the Commission’s work programme of February 2025, was formally abandoned in October 2025 . That was the instrument meant to address precisely this difficulty. What remains is the revised Product Liability Directive , which now covers software and AI systems, but which requires a defect, damage and a causal link, and which protects natural persons against personal injury, property damage and the destruction of data. Its transposition is not due until 9 December 2026, and it will apply only to products placed on the market after that date.

The predictable objection, and the answer

An attentive reader will reply that the law routinely recognises a capacity for one object and not for another, without that amounting to an inconsistency. An animal can cause legally relevant damage without having personality. A company has personality for the purpose of contracting, and not for every purpose in every legal order. Recognising a processing capacity for evidentiary purposes therefore obliges nobody to recognise personhood for liability purposes. Different questions, different answers.

The objection is serious, and it would be decisive if the asymmetry ran both ways.

It runs only one way. Where the system’s capacity is upheld, the cost is borne by the client whose protection disappears. Where that same capacity would have served to allocate liability, it becomes impossible to find. The result always falls on the same side.

An asymmetry that systematically favours the same party is not a doctrinal distinction. It is an allocation of risk, and it ought to be discussed as one.

What this means in practice

None of this suggests that the legal professions should give up these tools. The European professional texts do not say so either, and the CCBE has published its own guide on the subject.

What it does suggest is that the decisive question is not which tool a firm chooses, but what that tool retains, and whether the answer is a matter of policy or a property of design. An undertaking not to retain can be withdrawn, reinterpreted or set aside by a court. An architecture that does not retain cannot be, because there is nothing to produce.

The reference documents for anyone wanting to look into the question:

The CCBE guide on the use of generative AI by lawyers , published on 2 October 2025, supplemented by a technical guide in March 2026
The ethics guide of the Conseil national des barreaux of 17 March 2026, which applies the classic principles of confidentiality and independence without creating a special law of AI
The Baker McKenzie comparative guide , useful for measuring the gap between national regimes

The angle Arpokrat takes

This reasoning goes well beyond law firms. It holds for any relationship in which someone entrusts a system with information they do not want to see resurface, and it comes down to a single question: does the guarantee rest on a promise or on an impossibility?

That is the principle governing the design of Arpokrat Messenger . Identity is generated locally from cryptographic keys, with no phone number and no email address, and private keys never leave the device. That choice is not an undertaking not to exploit a user directory. It is a choice not to build one. A production order addressed to infrastructure that does not hold the information does not produce a refusal, it produces a void.

The distinction deserves to be stated honestly, because it decides everything. A privacy policy, however sincere and however well drafted, is a declaration of intent backed by a company, by its shareholders of the moment and by the jurisdiction in which it is established. Those three things change. An architecture that does not collect does not change because a board changes. It is the same shift we described in relation to collecting today for decryption later : the risk does not sit at the moment the promise is made, it sits at the moment somebody else decides.

The law takes time to absorb that distinction, and the debate on legal privilege gives a good measure of it. The same goes for the protection of location data , where most of the legal construction bears on access to data whose existence is never questioned.

Conclusion

Case law will eventually settle. Appellate courts will resolve the split, regulators will publish criteria, firms will adjust their engagement letters and their clauses. None of that is in doubt.

But the underlying question will not be settled that way, because it is not really about legal privilege. It is about whether a legal order can recognise that a thing knows, without ever having to say who answers for what it does with that knowledge.

As long as that question stays open, the only variable a user genuinely controls is not the quality of the undertakings given to them. It is the amount of information they let exist.

This article offers a general legal analysis intended for discussion. It does not constitute legal advice or a legal opinion.

Sources

United States District Court for the Eastern District of Michigan, Warner v. Gilbarco Inc., 10 February 2026, Proskauer analysis
United States District Court for the Southern District of New York, United States v. Heppner , 10 February 2026, written opinion of 17 February 2026
United States District Court for the District of Kansas, Jefferies et al. v. Harcros Chemicals Inc. et al. , no. 2:25-cv-02352, 25 March 2026
Conseil national des barreaux, The CNB adopts a guide on ethics and artificial intelligence , 17 March 2026
Baker McKenzie, Global Privilege and Professional Secrecy Guide, France, Artificial Intelligence
CCBE, Model Code of Conduct for European Lawyers , 8 October 2021
CCBE, Guide on the use of generative AI by lawyers , 2 October 2025
European Parliament, Resolution of 16 February 2017 with recommendations to the Commission on Civil Law Rules on Robotics , 2015/2103(INL)
Open Letter to the European Commission on Artificial Intelligence and Robotics
EAPIL, European Commission Withdraws Two Proposals: Assignments of Claims Regulation and AI Liability Directive , 9 October 2025
Directive (EU) 2024/2853 of 23 October 2024 on liability for defective products

Case Law on ARPOKRAT