A Banksy AI Tracker

AI Privilege Law

A running log of how U.S. courts treat one question: when you put your words into a generative-AI tool, do they stay privileged — or private — at all? The body of law is young, fast-moving, and already split. This page tracks it, case by case.

The state of play: as of September 2026, three courts have found that using a consumer AI tool can defeat privilege, work product, or privacy, while two have preserved protection. And in Kansas, a court has now drawn the line directly — barring public "open loop" AI in discovery while expressly allowing private, closed AI. The dividing line isn't the tool's quality. It's whether the material left the building.
3
Protection broke — Heppner, Shealy, Fry
2
Protection held — Warner, Morgan
1
Court drew the line — Jeffries (public barred, private allowed)

When protection broke Disclosure / waiver

Courts holding that routing material through a third-party AI vendor's servers stripped privilege, work-product protection, or any reasonable expectation of privacy.

United States v. Heppner
S.D.N.Y. · Rakoff, J. · Feb. 17, 2026
A defendant's written exchanges with consumer Claude were not protected by attorney-client privilege or work product: the AI is not a lawyer, the vendor's terms permit collection and disclosure, and there was no reasonable expectation of confidentiality.
United States v. Heppner (S.D.N.Y. Feb. 17, 2026)
Shealy v. Seaside Investments, LLC
Mass. Super. Ct. (Suffolk, BLS) · June 16, 2026
Documents a party's romantic partner generated with AI were denied work-product protection: "neither the queries of AI programs for legal assistance by a party's romantic partner nor the AI output are protected from disclosure under the work product doctrine unless performed at the direction of counsel."
Shealy v. Seaside Investments, LLC, No. 2684CV00799-BLS2 (Mass. Super. Ct. June 16, 2026)
Fry v. Fry
E.D. Pa. · Marston, J. · Aug. 27, 2026
On a pro se plaintiff's renewed motion to seal records in a Hague Convention petition for the return of children, the court reviewed in camera and refused a wholesale seal. A footnote had required disclosure of AI use; the plaintiff had uploaded the redacted documents to non-enterprise Claude and Claude Cowork. Because that material is "processed on Anthropic's servers" and "not private," it would be "inappropriate for the Court to seal a document that has already been provided to a private, for-profit research and artificial intelligence company." Cites and follows Heppner.
Fry v. Fry, 2026 WL 2531956 (E.D. Pa. Aug. 27, 2026)

When protection held Protection preserved

Courts extending work-product protection to a litigant's interactions with generative AI — the other side of the split.

Warner v. Gilbarco, Inc.
E.D. Mich. · Feb. 10, 2026
"ChatGPT (and other generative AI programs) are tools, not persons" — so work product prepared in anticipation of litigation retains protection despite being run through an AI platform.
Warner v. Gilbarco, Inc. (E.D. Mich. Feb. 10, 2026)
Morgan v. V2X, Inc.
D. Colo. · Mar. 30, 2026
A pro se litigant's AI-assisted materials qualified as work product — but the party had to disclose which AI platform was used, and the court can impose confidentiality conditions where the platform's terms lack data protections.
Morgan v. V2X, Inc. (D. Colo. Mar. 30, 2026)
The line courts are starting to draw

A court just banned public AI in discovery — and named the private alternative

Jeffries v. Harcros Chemicals, Inc. · D. Kan. · Magistrate Judge Angel D. Mitchell · Mar. 25, 2026

On a motion to amend the protective order, the court barred the parties from uploading any produced discovery material — even documents not marked confidential — into public, "open loop" AI tools. Its reasoning: data fed to open tools can't be clawed back, which makes the standard "return or destroy" obligation impossible to satisfy. But the order didn't ban AI. It drew a line through the middle of it.

"Defendants' proposal does not foreclose a party from using any AI Tools; it only prohibits using open AI Tools while allowing the use of closed AI Tools."
✗ Open / public AI — barred

Uploading discovery into widely available consumer tools is off the table, confidential or not — a centralized public repository whose contents can't be retrieved or destroyed when the case ends.

✓ Closed / private AI — allowed

The court kept AI squarely on the table for the real work — document review, summarization, privilege review, entity extraction, and drafting — so long as it runs in a closed system.

This is the first case that doesn't just warn you off public AI. It tells you which kind of AI a court will let you use: the private, closed kind.
Jeffries v. Harcros Chemicals, Inc., 2026 WL 820218 (D. Kan. Mar. 25, 2026)
The through-line

The split isn't about the tool. It's about where the data goes.

Read the cases together and the fault line is clear. The courts that preserved protection (Warner, Morgan) treated AI as a tool used in the litigation's own protected workspace — often at counsel's direction, with the output kept in-house. The courts that broke protection (Heppner, Shealy, Fry) all turned on the same fact: the material was handed to a third-party, for-profit company whose terms let it keep and disclose what it receives.

Two of the three "broke" cases involved pro se or non-lawyer users reaching for the most helpful tool they had — and losing protection because of where that tool sends the data. That's a structural problem, not a prompting one. No paid-tier privacy toggle changes the core fact that the file traveled.

The one architecture the split can't reach is the one where nothing travels — where the model runs on hardware you own and the confidential file never reaches an AI vendor at all. In Jeffries, a court said as much out loud: closed, private AI stays on the table; open, public AI does not.

Keep the work confidential — and off everyone else's servers

The Banksy Box runs the AI on hardware in your office — a closed system, not an "open loop." Your clients' words never reach a "private, for-profit research and artificial intelligence company."

See the Banksy Box Read the privilege deep-dive

This tracker is legal-news commentary by Banksy AI, not legal advice, and does not create an attorney-client relationship. Case summaries are drawn from the opinions and reputable secondary coverage; confirm any citation against the slip opinion before relying on it. Last updated September 2026.