Privilege, AI and the Kovel Question
In United States v. Heppner, Judge Rakoff (S.D.N.Y., 17 February 2026) ruled that a criminal defendant’s exchanges with Anthropic’s Claude were not protected by attorney-client privilege.1 That opening understates the split that followed within six weeks.
The American split
Three federal opinions issued between February and March now sit in tension. Heppner refuses both attorney-client privilege and work product protection to AI-generated material a client produced on his own initiative. Warner v. Gilbarco, Inc. (E.D. Mich., 10 February 2026), decided the same day as Heppner‘s ruling, protects pro se work product on the reasoning that generative AI tools “are tools, not persons” and that treating each prompt as a waiver would “nullify work-product protection in nearly every modern drafting environment”.2 Morgan v. V2X, Inc. (D. Colo., 30 March 2026) sits between the two. Magistrate Judge Dominguez Braswell upheld work product protection but compelled the litigant to disclose the AI tool used and prohibited uploads of confidential discovery into any platform not contractually barred from training on, retaining or sharing the inputs.3
All three opinions are first-instance. None has yet been tested on appeal. The pressure point is not the privilege analysis itself, which is conventional. It is the framing of the AI tool. Heppner treats Claude as a non-lawyer interlocutor whose receipt of the communication destroys it. Warner treats the tool as an instrument of the litigant, no different from a word processor with autocomplete. Morgan accepts the Warner framing but imposes a vendor-contract overlay borrowed from data protection practice.
The Kovel line
The unresolved question for practitioners is whether United States v. Kovel, 296 F.2d 918 (2d Cir. 1961), reaches AI. Kovel extended privilege to communications routed through an accountant engaged by counsel to assist in providing legal advice. Subsequent authority confirmed the principle that translators, investigators and experts hired by counsel can sit inside the privileged circle as the lawyer’s agent.
Heppner gestures at this without resolving it. Judge Rakoff observed that the outcome could have been different had counsel directed the use of Claude and the document fed back into the lawyer’s advice loop. The immediate route is therefore not an AI privilege, but the older agency question: whether the tool was deployed at counsel’s direction for the purpose of enabling legal advice. That test will probably arrive in a civil case in which counsel has directed the use of an enterprise AI tool with contractual restrictions on training, retention and disclosure. The question will be whether the Kovel principle survives the translation from a human professional to a model.
The English position and the practitioner read
The Upper Tribunal decision in Munir v Secretary of State for the Home Department [2026] UKUT 81 (IAC) takes the harder position. Uploading confidential client material into a public or open AI tool (what the Tribunal called an “open-source AI tool, such as ChatGPT”) is publication to the public domain that waives legal professional privilege. Closed-source enterprise systems sit outside that holding, but the Tribunal did not extend privilege to them affirmatively. The Three Rivers (No 6) [2004] UKHL 48 architecture, which already constrains legal advice privilege to lawyer-client communications and litigation privilege to anticipated proceedings, leaves little room for a Kovel-style agency extension to consumer AI in England and Wales.
For in-house counsel the strategic position is now clear in outline. Three propositions hold across both jurisdictions. The lawyer’s direction must be documented at the point the AI tool is deployed, not reconstructed later. The vendor contract must restrict training, retention and third-party disclosure. Consumer AI tools should be excluded from any workflow that touches privileged or work product material until the appellate position is settled.
The first federal case to test Kovel against an enterprise AI deployment is the one to watch. Until then, Heppner, Warner and Morgan identify the question without resolving it.
1 United States v. Heppner, S.D.N.Y., Memorandum Opinion of 17 February 2026 (Rakoff, J.).
2 Warner v. Gilbarco, Inc., No. 2:24-cv-12333, E.D. Mich., Order of 10 February 2026 (Patti, M.J.).
3 Morgan v. V2X, Inc., D. Colo., Order of 30 March 2026 (Dominguez Braswell, M.J.).