AI, privilege and litigation strategy: what follows Heppner and Warner

Two U.S. decisions issued the same day in February 2026 illustrate the emerging tension between generative AI and traditional privilege doctrines. Although the decisions appear to reach opposite conclusions, read together they confirm that privilege and work-product analyses in the AI context remain highly fact-specific, and that two questions now dominate: how an AI tool is used in connection with a legal matter, and whether the right tool was paired with the task.

Two cases, two outcomes

In United States v. Heppner^[1], the Southern District of New York held that a criminal defendant's exchanges with a public generative AI platform were not protected by attorney-client privilege or by the work-product doctrine. After receiving a grand jury subpoena and learning he was the target of an investigation, Mr. Heppner, on his own initiative and without any suggestion from counsel, used an AI tool to prepare reports outlining defence strategy and anticipated factual and legal arguments.

The court reasoned that the AI was not a lawyer, that the communications were not confidential in light of the platform's publicly available written privacy policy, which disclosed that inputs and outputs are collected, may be used for training, and may be shared with third parties, including regulators, and that the materials were not prepared by or at the direction of counsel. Nor could subsequent transmission to counsel cure the defect: non-privileged communications are not "alchemically changed" into privileged ones by being shared with a lawyer after the fact.

In Warner v. Gilbarco^[2], the Eastern District of Michigan reached the opposite result. A pro se litigant had used generative AI to prepare litigation materials, and the defendants sought all documents concerning her use of AI tools. The court refused, finding the request disproportionate and holding that work-product protection was not waived merely because an AI tool had been used. Waiver of work product requires disclosure to an adversary, or in a manner likely to reach one. Critically, the court characterized generative AI programs as tools, not persons, even if administrators exist somewhere in the background.

Why this matters in Canada and Québec

These issues will inevitably arrive in Canadian courtrooms, where the stakes are already high: the Supreme Court of Canada has elevated solicitor-client privilege from a mere rule of evidence to a substantive rule of law and a principle of fundamental justice, a fundamental civil and legal right that survives the end of the retainer and is now widely regarded as quasi-constitutional. In Québec, the protection is even more explicit: professional secrecy is enshrined in section 9 of Québec's Charter of Human Rights and Freedoms^[3]. Canadian law also recognizes litigation privilege, a distinct "zone of privacy" protecting materials prepared for the dominant purpose of litigation, and settlement privilege.

All of these protections, however, ultimately rest on confidentiality. Generative AI forces lawyers to revisit what confidentiality means where prompts and outputs may be retained, reviewed, reused for training, hosted outside Canada, or disclosed in defined circumstances.

The question echoes the email debates of the 1990s: does using a particular technology defeat the reasonable expectation of confidentiality?^[4] The jurisprudence ultimately concluded that the use of email to communicate or share information does not, in itself, eliminate professional secrecy. The use of AI tools raises different issues because the technology itself processes, retains and may repurpose the content. And since waiver of professional secrecy is never presumed, could a client who reasonably believed an AI exchange was confidential lose a quasi-constitutional protection simply for having used an AI tool or because his/her lawyer have used such an AI tool? The answer will likely be fact-driven, as Heppner and Warner demonstrate.

The Québec framework already points the way

Québec lawyers are not starting from a blank slate. The Code of Professional Conduct of Lawyers imposes duties of competence, prudence and confidentiality (art. 20)^[5], as well as a duty to preserve the confidentiality of all information concerning the affairs and activities of a client that comes to the lawyer’s knowledge in the course of the professional relationship. (arts. 60 and following)^[6].

It also requires lawyers to take reasonable measures to ensure protection of confidential information by anyone who collaborates with them and by their firm or organization (art. 61)^[7]. The Regulation respecting accounting and professional standards of advocates (art. 17^[8]) reinforces this obligation. Québec's private-sector privacy legislation likewise requires security measures proportionate to the sensitivity of the information, the purposes for which it is used, its quantity, distribution and medium (art. 10)^[9].

On April 1, 2026, the Barreau du Québec introduced mandatory training^[10] on the governance and use of generative AI in legal practice, which proposes, among other things, four questions that lawyers should ask before entrusting information to any AI tool: Is its use permitted with this type of data? Is the tool appropriate to the mandate's objective? Where does the data go and who can access it? What protective measures exist in case of an incident? The Barreau also recommends verifying vendor documentation, planning for incident response, minimizing and de-identifying the data transmitted, and framing AI use with clients through transparency, consent where required, and proportionate traceability.

A two-layer analysis

Practically, privilege questions involving AI should be assessed on two layers.

The legal layer asks whether the material is protected by professional secrecy, litigation privilege or settlement privilege in the first place. The traditional criteria: the lawyer-client relationship, the provision of legal advice, confidentiality, and the dominant purpose of anticipated litigation, remain the starting point.

The technological layer asks whether, even if the legal criteria are met, the environment has preserved confidentiality. Terms of use and privacy policies, retention and training practices, disclosure obligations, access controls, encryption, data residency, auditability and enterprise governance may become central facts in a privilege dispute, as they did in Heppner. A further nuance is the user environment: shared devices, personal accounts, weak passwords, browser synchronization and unsecured storage of prompts and outputs can all undermine the protection.

These questions are not theoretical. In England and Wales, Garfield AI received approval from the Solicitors Regulation Authority in May 2025^[11], becoming the first and, to date, only AI-only law firm licensed to provide regulated legal services. More recently, it was used to prepare the documents in a successful small claims action, illustrating how AI-enabled legal service delivery is moving beyond theory and into practice^[12]. In Québec, the Barreau has published a proposed pilot project for innovative legal services that contemplates generative AI for legal consultations and document drafting, while court representation would remain excluded.

The takeaway

Clients must be instructed early not to input privileged or litigation-sensitive information into public AI tools without guidance. Lawyers should build AI governance into file opening, litigation planning and privilege preservation. Organizations should tie tool selection to rigorous privacy and cybersecurity vetting of providers, contractual safeguards and documented controls.

The real question is no longer simply: "Is this privileged?" Rather, it is whether privilege has been preserved throughout the entire lifecycle of the information: legally, technologically and operationally.

This article was provided by LCM Attorneys Inc.