Why Professional Privilege Survives or Dies at the Inference Layer
Where your prompt goes determines whether professional privilege survives.
AI tools for privacy-conscious professionals should be judged by what happens to sensitive information at inference, with promises not to train on it providing only part of the assessment. Professional privilege can be lost when a prompt reaches a third-party server under terms that defeat confidentiality. Preserving it requires attention to the system’s architecture, its contractual protections, and the professional purpose and supervision of its use.
How privilege actually works and why confidentiality is its load-bearing wall
Privilege is a legal status. Attorney-client privilege belongs to the client and protects confidential communications made to ask for or give legal advice. A document does not qualify merely because its contents concern legal exposure. Confidentiality must exist when the communication is made and must survive its subsequent handling. One disclosure can therefore change the status of material that its author regarded as protected.
Physician-patient privilege also depends on confidentiality, while work-product protection raises a related but distinct question about litigation preparation and adversary access. These protections are not interchangeable, as the contrasting AI decisions show. In Heppner, the court held that subsequent disclosure to counsel could not “alchemically change” already-disclosed communications into privileged ones. The technical route taken by a communication can thus become part of the legal inquiry, rather than a background concern left to the software provider.
What happens at inference: the mechanics of a prompt leaving the device
An inference request is the point at which the user submits information for the AI system to process. On a consumer platform, that prompt leaves the device and reaches a third-party server, where the vendor’s data-handling terms govern its treatment. The provider does not become the user’s lawyer. Nor does the professional’s duty to protect client information mean that the provider has the same duty.
What rights does the provider acquire at that boundary? Consumer AI terms can permit collection of inputs and outputs, their use for model training, and disclosure to third parties, including governmental regulatory authorities. The court in Heppner treated Anthropic’s privacy policy as decisive evidence that the defendant lacked a reasonable expectation of confidentiality in his communications with Claude. The court focused on the permission granted by those terms, regardless of whether a particular disclosure had already occurred.
A closed enterprise platform with contractual prohibitions on retention and training presents a different arrangement, even when its chat window looks much the same. Appearance is a poor guide to confidentiality. The relevant questions concern who controls processing and what that party may do with the information. Crossing a server boundary is therefore not, by itself, a universal rule of waiver, but it is the moment at which the professional must know whether the protected relationship remains intact.
United States v. Heppner: the first federal ruling on what the inference moment costs
Judge Jed S. Rakoff ruled from the bench on February 10, 2026, and issued his written opinion on February 17, 2026. The opinion characterized the question as one of first impression at the federal level. Heppner had used Claude independently to prepare reports about potential defenses and legal exposure after learning that he was the target of a federal investigation. He later sent the reports to his lawyers. That sequence was central to the court’s analysis.
The court rejected attorney-client privilege because Claude was not an attorney and the exchanges were not confidential under Anthropic’s terms. Those terms let the provider collect inputs and outputs, use them for training unless users opted out, and share them with third parties. Counsel had not directed Heppner’s use of the platform. His later decision to share the results with lawyers did not establish that the original exchanges were protected communications made within their representation.
The work-product claim failed because the outputs reflected Heppner’s own thinking rather than defense counsel’s strategy or work product. The court also rejected reliance on the Kovel doctrine, which can extend privilege to intermediaries necessary for effective legal representation. Claude was not necessary for counsel to understand the client, and Heppner had engaged it on his own initiative. The consequences reached beyond a discovery dispute. On May 7, 2026, Heppner was found guilty on all counts, and prosecutors introduced his consumer AI prompts as evidence at trial.
Warner v. Gilbarco and why the same AI moment can go the other way
Warner v. Gilbarco, Inc. reached a different outcome in a federal district court on February 10, 2026. A pro se plaintiff in a race discrimination suit had used an AI tool for litigation preparation. The defendants asked for all AI-generated materials, arguing that putting litigation information into a public platform waived any protection. The court rejected that argument and protected the materials as work product.
The distinguishing facts explain why the decisions need not conflict. Warner’s use was litigation-oriented, and adversary access to the material was unlikely. The court had also issued a modified protective order in October 2025 prohibiting uploads of confidential discovery materials to AI platforms. Warner does not give everyone permission to upload confidential information or require lawyer supervision for every work-product claim.
Read together, the cases direct attention to who used the tool, for what purpose, under whose direction, and with what protection against disclosure. Counsel supervision was significant in Heppner, while litigation purpose and adversary access supported protection in Warner. The doctrines retain their separate tests. Jeffries adds the practical warning that data submitted to an open AI tool is “practically impossible” to claw back. A favorable argument about work product cannot substitute for deciding what may cross the boundary in the first place.
How UK courts and regulators have hardened the same principle into binding expectation
The UK Upper Tribunal addressed confidentiality directly in Munir v. Secretary of State for the Home Department UKUT 81 (IAC). In an obiter observation, it said that uploading confidential documents into an open-source AI tool such as ChatGPT breaches client confidentiality and waives legal privilege by placing the information in the public domain. The procedural qualification is important here. An observation made in passing is not the same as a holding necessary to decide the case.
Even so, the tribunal distinguished between making information public and keeping it protected while a tool processes it. It said closed-source tools such as Microsoft Copilot could be used for tasks including summarising without putting information in the public domain. It also indicated that such uploads to public AI should be referred to the Information Commissioner’s Office and might warrant referral to the Solicitors Regulation Authority. The distinction concerned information handling. It should therefore not be read as approval of every configuration sold under a particular product name.
The SRA’s August 2026 warning notice turned the confidentiality concern into an express regulatory expectation. The notice cited UK v Secretary of State for the Home Department UKUT 81 (IAC), warned that privilege may be permanently waived, and said that both free and paid systems can pose risks. Payment does not resolve the underlying question. For practices that work across countries, the UK position makes the same boundary matter beyond US disputes over evidence and brings the risk of action by professional regulators.
Does an enterprise AI account protect sensitive client information?
Enterprise accounts can improve confidentiality protections by changing the provider’s contractual rights over submitted information. They do not control everything a practitioner pastes into a chat window, however, or establish that counsel directed its use. Courts can ask whether the platform is open or closed, whether confidentiality protections can be enforced, and whether a lawyer supervised the work. A contract addresses only part of that inquiry. How the system is set up and how professionals use it can each create risks.
The strongest objection is that third-party processing is already routine in professional communication. A client using Gmail to write to her attorney communicates through Google, yet the presence of that intermediary does not answer every privilege question. Why should AI processing necessarily be different? A consumer user who opts out of data collection may also argue that they had good reason to expect confidentiality. Those arguments call for examination of the actual arrangement rather than an assumption that every remote service destroys privilege.
An opt-out is a contractual setting and imposes no professional duty on the provider. Terms can change, and a prohibition on training does not itself prohibit storage, review, reuse, or disclosure. Nor does it make an independently prepared business analysis into litigation work product. For lawyers and accountants evaluating tools with a prohibition on training on their data, that promise is one criterion in a broader confidentiality assessment. The system’s operation still needs to be assessed for protection beyond the agreement describing it.
What architecture that preserves the inference layer actually requires
Harvey AI has stronger contract terms and security controls for use by firms. CMS Law deployed the purpose-built legal platform across its lawyers in more than fifty countries. Harvey has SOC 2 Type II certification, ISO 27001, third-party penetration testing each year, and a contract that bars the use of client inputs for model training. Its stated requirement of zero data retention with model providers is subject to a contractual carve-out for cloud storage providers added in January 2026. That qualification deserves attention because storage and training are different permissions.
A structurally distinct approach keeps inference data within the user’s controlled environment instead of relying solely on restrictions imposed on an outside processor. Confidant AI is positioned around an architecture designed to bypass a third-party server governed by a commercial privacy policy when routing inference data and to exclude collection or monetization of user data. Where the inference provider is not a separate party, its commercial privacy policy cannot become the route by which the communication leaves the protected relationship. That architectural distinction does not, by itself, establish the other requirements for privilege.
Consumer terms may authorize collection and reuse, closed enterprise arrangements can prohibit those activities by contract, and controlled-environment designs aim to remove the separate-party disclosure route. Harvey illustrates the contractual model, while the design described for Confidant AI illustrates the structural alternative. Neither a certification nor an architectural claim decides whether a particular communication qualifies as privileged. The functional test still includes a closed platform, restrictions on storing, reviewing, reusing, or training on inputs, and appropriate professional direction.
The practical steps professionals must take before the next prompt leaves the device
The lesson for professionals is to assess the platform before submitting sensitive information. That assessment should establish whether it is open or closed, identify who controls inference, and distinguish system-level protections from contractual promises. The privacy policy should be read for collection, retention, training, and third-party disclosure provisions. A “no training” statement is not enough. Heppner shows how the terms in force when information was first submitted can later become key evidence in a dispute over privilege.
For legal work, counsel should actively direct and supervise AI use in real time and in connection with the proceedings. The process should make that direction documentable. Firms and practices should also establish policies governing AI use in investigations and litigation before discovery forces them to reconstruct what happened. Those policies should keep sensitive information out of public tools and tie AI-generated legal content to confidential communications with counsel.
Work-product protection needs a separate review because materials made at counsel’s direction to analyze claims, defenses, or litigation strategy may qualify, while business or exploratory materials made without that direction generally do not. Architecture cannot supply a missing litigation purpose. Conversely, a proper purpose cannot reverse a disclosure already made under incompatible terms. For a practice considering Confidant AI, a closed enterprise service, or another controlled arrangement, the professional responsibility is to establish both conditions before use.
