Are AI Prompts Privileged or Discoverable in New York?

The Short Answer

It depends on who used the tool and why. The courts that have decided the question so far have sorted it this way:

• A client who uses a consumer AI tool on his own, without direction from counsel, has no attorney-client privilege and no work product protection in the conversations, and putting privileged information into the tool can waive the privilege. That is the Southern District's holding in United States v. Heppner (2026).
• Prompts written by counsel to investigate a case are opinion work product under Tremblay v. OpenAI (2024) and Concord Music Group v. Anthropic (2025). Relying on the outputs, or calling a witness to testify about them, waives protection to the extent fairness requires, not for everything.
• A self-represented litigant's AI-assisted litigation work has been protected as work product, including by the New York Supreme Court, Nassau County, in Assini v. Hayward (2026).
• The platforms keep the logs. In the Southern District's OpenAI copyright litigation, OpenAI was ordered to preserve ChatGPT output logs and later to produce millions of de-identified consumer conversations.

A Client's Own AI Conversations: United States v. Heppner

United States v. Heppner, 820 F. Supp. 3d 292 (S.D.N.Y. 2026)

After receiving a grand jury subpoena, the defendant used Anthropic's Claude on his own to outline his defense strategy, producing roughly 31 documents, and later shared the results with his lawyers. The FBI seized the documents under a search warrant, and the government moved for a ruling that they were not privileged. Judge Jed S. Rakoff granted the motion, in an opinion the court said “appears to answer a question of first impression nationwide.”

Attorney-client privilege failed on at least two elements. Claude is not a lawyer. The communications were not confidential, because the provider's privacy policy allowed it to collect the conversations, use them for training, and disclose them to third parties, including government authorities. And the purpose was not to obtain legal advice, because counsel had not directed the AI use. Sending the outputs to counsel afterward did not change the analysis.

Work product failed because the documents were not prepared by or at the behest of counsel and did not reflect counsel's strategy. In a footnote, the court added that putting privileged information into the tool waived the privilege, “just as if he had shared it with any other third party.”

Two limits matter. Heppner is a criminal case about a consumer tool the client chose to use on his own. And the court suggested that the result might differ if counsel had directed the AI use, in which case the tool “might arguably be said to have functioned in a manner akin to a highly trained professional who may act as a lawyer's agent.” One line from the opinion sums it up: “AI's novelty does not mean that its use is not subject to longstanding legal principles.”

New York Supreme Court: Assini v. Hayward

Assini v. Hayward, 2026 NY Slip Op 26086 (Sup Ct, Nassau County, June 4, 2026)

Plaintiffs served a subpoena on OpenAI seeking prompts, uploaded materials, and outputs, from accounts registered to a self-represented defendant, that were used in drafting filings or that referenced the plaintiffs or the litigation. Justice Rhonda E. Fischer granted the defendant's motion to quash. The court noted that “Materials prepared in anticipation of litigation are subject to a conditional privilege (CPLR § 3101[d]),” adopted the reasoning of the federal decision in Morgan v. V2X discussed below, and distinguished Heppner as a criminal matter. OpenAI “is not required to provide records in response to the Subpoenas unless a further court order should issue.”

The same decision referred the defendant to 22 NYCRR Part 161, New York's rule on AI in court papers, and warned that failure to abide by the court rules may result in sanctions. Protection from discovery and the duty to verify what you file are separate questions. Our guide to the New York AI disclosure rules covers Part 161.

Counsel's Own Prompts Are Work Product

Tremblay v. OpenAI, Inc., No. 23-cv-03223-AMO, 2024 WL 3748003 (N.D. Cal. Aug. 8, 2024)

The court set aside an order that had compelled plaintiffs' counsel to produce the pre-suit ChatGPT prompts, outputs, and account settings they used to investigate the case. The prompts “were queries crafted by counsel and contain counsel's mental impressions and opinions about how to interrogate ChatGPT,” which makes them opinion work product. Any waiver reached only the prompts and outputs counsel actually used in the complaint.

Concord Music Group, Inc. v. Anthropic PBC, No. 24-cv-03811-EKL (SVK), ECF No. 377 (N.D. Cal. May 23, 2025)

The court denied a motion to compel the music publishers' undisclosed pre-suit prompts and outputs, agreeing with Tremblay that they are attorney work product. The publishers' reliance on roughly 5,000 prompt-output pairs worked at least a limited waiver. The court rejected a sweeping subject-matter waiver, without prejudice to targeted discovery of facts behind specific contentions.

In a later order, ECF No. 545 (N.D. Cal. Dec. 18, 2025), the court confirmed that the prompts are opinion work product because they reflect “queries crafted by counsel and contain counsel’s mental impressions and opinions about how to interrogate [an AI agent].” But the publishers intended to call their investigator and client witnesses to testify about results they had obtained, so the court held that they had placed the post-suit investigation at issue and ordered production of all prompts and outputs those witnesses submitted, “negative as well as positive,” including prompts originally drafted by attorneys and given to the investigators. Prompts drafted by counsel that were never given to a testifying witness stayed protected.

Self-Represented Litigants

Morgan v. V2X, Inc., No. 1:25-cv-01991-SKC-MDB, ECF No. 65 (D. Colo. Mar. 30, 2026)

The decision Assini followed. The court held that a self-represented plaintiff's AI-assisted litigation work is protected under Rule 26(b)(3), reasoning that “the use of AI closely resembles the kind of confidential, strategy-laden iterative work product that Rule 26(b)(3) was designed to protect,” and that using a third-party AI tool does not automatically waive that protection. The court still required the plaintiff to identify which AI platform he had used with confidential material, and it amended the protective order to bar putting confidential discovery material into an AI tool unless the provider is contractually barred from training on or disclosing the inputs.

Warner v. Gilbarco, Inc., 820 F. Supp. 3d 629 (E.D. Mich. 2026)

The court denied, on alternative grounds, a demand for all of a self-represented plaintiff's materials on her use of AI tools as irrelevant, disproportionate, and protected work product. Waiver requires disclosure to an adversary or in a way likely to reach one, and “ChatGPT (and other generative AI programs) are tools, not persons, even if they may have administrators somewhere in the background.”

The Platforms Keep the Logs

In re OpenAI, Inc. Copyright Infringement Litigation, No. 25-md-3143 (SHS) (OTW) (S.D.N.Y.)

On May 13, 2025, Magistrate Judge Ona T. Wang directed OpenAI “to preserve and segregate all output log data that would otherwise be deleted on a going forward basis until further order of the Court,” including conversations users had asked to delete. The parties later stipulated to end most going-forward preservation as of September 26, 2025, while keeping most of the logs already segregated. The court then ordered OpenAI to produce 20 million de-identified consumer ChatGPT logs, and on January 5, 2026, Judge Sidney H. Stein overruled OpenAI's objections, observing that users' privacy interests in conversations they “voluntarily disclosed to OpenAI and which OpenAI retains in the normal course of its business” are weaker than the privacy interests in the wiretapped phone calls at issue in SEC v. Rajaratnam. Heppner quotes that passage.

The practical point for litigators: a conversation with a consumer AI tool is a record held by a third party. Whether it is protected is a question about the user and the purpose. Whether it exists is a question about the platform's retention, and a court may order it kept.

New York Ethics Guidance

The New York City Bar Association's Formal Opinion 2024-5, Generative AI in the Practice of Law (August 7, 2024), applies Rule 1.6 directly: “Without client consent, a lawyer must not input confidential client information” into a generative AI system that will share it with third parties. The opinion advises lawyers to confirm that the provider does not share inputs or use them to train its product, and to recheck the terms of use periodically. Closed systems that keep inputs within the firm's own protected environment do not raise the same concern.

The New York State Bar Association's Task Force on Artificial Intelligence, in its report approved by the House of Delegates on April 6, 2024, reached the same point: “Confidentiality concerns arise when entering information into AI engines, such as chatbots, and when such entries are then added to the training set for the AI.” In June 2026, the City Bar's Presidential Task Force on AI and Digital Technologies issued a report on AI, privacy, and privilege that discusses Heppner critically and argues that waiver should turn on practical exposure to adversaries and on whether the tool is an enterprise or consumer product.

Practical Guidance for Litigators in New York

1. Tell your client, in writing, not to put anything about the matter into a consumer AI tool. Heppner is the case that shows why, and the warning costs one sentence in the engagement email.
2. If AI work is done on the case, have counsel direct it. Tremblay and Concord protect prompts crafted by counsel, and Heppner left open the agency argument when counsel directs the use.
3. Use tools whose terms bar training on and disclosure of your inputs. That is the line drawn by City Bar Formal Opinion 2024-5 and by the protective order amended in Morgan.
4. Think before citing AI output in a pleading or putting a witness on to describe it. Under Tremblay and Concord, reliance waives protection for what was relied on, and in Concord a testifying investigator's prompts were ordered produced, including the unsuccessful ones.
5. Expect protective orders to address AI. Courts are now writing terms on which tools may receive confidential discovery material. Propose your own language before the other side does.
6. Treat AI conversations as potentially discoverable records. The OpenAI litigation shows that platform logs exist and can be ordered preserved. Address them in litigation holds and in discovery demands.

Frequently Asked Questions

Are ChatGPT or Claude conversations protected by attorney-client privilege in New York?

Not when a client uses a consumer AI tool on his own. In United States v. Heppner (S.D.N.Y. Feb. 17, 2026), Judge Jed S. Rakoff held that a defendant's own Claude conversations about his defense were neither privileged nor work product, because the tool is not a lawyer, the provider's privacy policy defeated confidentiality, and counsel had not directed the use. The court also held that entering privileged information into the tool waived the privilege.

Are an attorney's AI prompts discoverable?

Generally not. In Tremblay v. OpenAI (N.D. Cal. 2024) and Concord Music Group v. Anthropic (N.D. Cal. 2025), prompts written by counsel to investigate a case were held to be opinion work product. Relying on particular outputs worked a limited waiver tied to what was relied on. In Concord, once the plaintiffs decided to call their investigator to testify about AI results, the court ordered production of all prompts and outputs the investigator submitted.

Has a New York state court ruled on subpoenas for AI chat history?

Yes. In Assini v. Hayward, 2026 NY Slip Op 26086 (Sup Ct, Nassau County, June 4, 2026), the court quashed a subpoena to OpenAI for a self-represented defendant's prompts, uploaded materials, and outputs, citing the conditional protection for materials prepared in anticipation of litigation under CPLR 3101(d) and following the federal decision in Morgan v. V2X. The court distinguished Heppner as a criminal case.

Can a court order an AI company to preserve or produce user conversations?

Yes. In the OpenAI copyright litigation in the Southern District of New York, the court ordered OpenAI on May 13, 2025 to preserve output log data that would otherwise have been deleted, and later ordered production of 20 million de-identified consumer ChatGPT logs. Judge Sidney H. Stein overruled OpenAI's objections on January 5, 2026.

May a New York lawyer put client information into an AI tool?

Not confidential information, without client consent, if the tool will share it with third parties. New York City Bar Formal Opinion 2024-5 applies Rule 1.6 to generative AI and advises lawyers to confirm that the provider does not share inputs or use them for training, and to recheck the terms of use periodically.

Related: AI Disclosure Rules in New York Courts · Local Counsel and AI Briefs · Pro Hac Vice Overview · PHV in SDNY and EDNY · New York Local Counsel

This article is general information, not legal advice. It describes decisions and guidance as of October 2026. Courts are deciding these questions case by case and the law is changing quickly, so confirm current authority before relying on any of it. Attorney advertising.