The Emerging Framework on AI Prompts, Privilege, and Discovery

Courts have now addressed AI prompts in enough distinct litigation contexts that a framework is beginning to take shape. Yesterday’s ruling in Conservation Law Foundation v. Shell Oil Co., holding that an expert witness’s AI prompts are discoverable as part of their methodology, is the latest addition to a body of case law that has been developing since 2024. The picture that emerges is that the treatment of AI prompts turns less on the technology and more on who created the prompts, for what purpose, and under what terms of service.

The existing decisions address four distinct situations: whether AI prompts crafted by attorneys in connection with litigation strategy qualify as protected work product; whether prompts generated by clients or employees without counsel’s direction are similarly protected; whether an expert witness’s AI prompts are discoverable as part of their disclosed methodology; and whether courts will restrict the use of consumer AI tools on discovery materials through protective orders.

Attorney-Crafted Prompts

When a lawyer crafts AI prompts in furtherance of litigation strategy, the prompts and their outputs are likely protected as opinion work product, the near-absolute tier of protection. In Tremblay v. OpenAI, Inc., No. 23-cv-03223, 2024 WL 3748003 (N.D. Cal. Aug. 8, 2024), the court held that such prompts contain counsel’s mental impressions. Another court reached the same conclusion the following year in Concord Music Group, Inc. v. Anthropic PBC, No. 24-cv-03811, 2025 WL 1482734, at *3-4 (N.D. Cal. May 23, 2025), finding that attorney-crafted investigative prompts and their outputs were similarly protected.

Party-Generated Prompts

Where AI prompts are generated by a party rather than counsel, the result depends heavily on the facts. In United States v. Heppner, No. 25-cr-00503, 2026 WL 436479 (S.D.N.Y. Feb. 17, 2026), Judge Rakoff held that 31 documents a criminal defendant created by prompting a publicly available AI platform were neither privileged nor work product. The defendant acted without counsel’s direction and used a publicly available AI platform whose privacy policy permitted data collection and disclosure to third parties, including government authorities. The court rejected the privilege claim on every element: the platform is not an attorney and expressly disclaims providing legal advice, negating both the required attorney-client relationship and any claim that his purpose was to obtain legal advice; the platform’s terms negated any expectation of confidentiality; and his intent to later share the outputs with counsel did not change the analysis. The work product claim failed as well: the materials were not prepared at counsel’s direction and did not reflect counsel’s strategy.

Warner v. Gilbarco, Inc., No. 2:24-cv-12333, 2026 WL 373043 (E.D. Mich. Feb. 10, 2026) presented distinct facts and reached a different result. A pro se plaintiff in an employment discrimination case used a generative AI tool to prepare litigation materials, and the defendants moved to compel production of all materials related to that AI use, arguing that doing so waived any applicable protections. The court denied the motion. On the work product question, the court drew an important distinction: while attorney-client privilege is waived by disclosure to a third party, work product protection is waived only by disclosure to an adversary or conduct likely to result in the material reaching an adversary’s hands. Because AI tools are “tools, not persons,” inputting litigation materials into one does not constitute disclosure to an adversary. The court also found that the defendants’ request improperly sought the plaintiff’s internal analysis and mental impressions, which qualified as work product because they were prepared in anticipation of litigation by the pro se plaintiff herself.

Heppner and Warner are consistent, notwithstanding their different outcomes. Both courts applied long-established principles to new facts. In Heppner, there was no attorney-client relationship between the defendant and the AI tool, the platform’s terms affirmatively disclaimed confidentiality, and the defendant acted on his own initiative without counsel’s involvement. Each of those facts independently defeated protection. In Warner, none of those obstacles were present: the materials were prepared in anticipation of litigation by a pro se party, and using an AI tool is not disclosure to an adversary. Generative AI neither confers protection nor automatically destroys it. Courts are asking the same questions they have always asked: whether there was a qualifying relationship, whether confidentiality was maintained, and whether the materials were prepared in anticipation of litigation and reflect a party’s or counsel’s mental processes. Generative AI presents a new factual context for those questions, not a new set of rules.

Expert Prompts

Yesterday’s ruling in Conservation Law Foundation v. Shell Oil Co., Civil No. 3:21-cv-00933 (D. Conn. May 18, 2026), addresses a category the prior cases did not reach. The court held that AI prompts used by an expert witness to narrow a document production for analysis are discoverable as part of the expert’s methodology. The reasoning was straightforward: expert methodology is subject to discovery under Rule 26(b); using AI to narrow a document set is part of that methodology; the prompts are therefore within scope. The analysis is not about privilege; it is about the ordinary scope of expert discovery.

AI Use in Protective Orders

A related body of cases addresses whether parties may use consumer AI tools to process discovery materials. In Morgan v. V2X, Inc., No. 25-CV-01991-SKC-MDB, 2026 WL 864223 (D. Colo. Mar. 30, 2026) and Jeffries v. Harcros Chemicals, Inc., No. 25-2352-KHV-ADM, 2026 WL 820218 (D. Kan. Mar. 25, 2026), courts issued or amended protective orders restricting such use. Morgan established a floor: the AI provider must be contractually prohibited from training on user inputs and disclosing them to third parties, must allow deletion of data on request, and, where third-party disclosure is essential to service delivery, must bind that third party to equivalent protections. A party intending to rely on those safeguards must retain written documentation of them. Jeffries went further, prohibiting the use of consumer AI tools not only for confidential documents but for all discovery materials, citing the practical impossibility of retrieving or deleting data once incorporated into a model and the risk of violating domestic and international data privacy laws.

Both decisions underscore that AI tool selection is a structural discovery issue that belongs in protective order negotiations, not an afterthought once a dispute arises.

Practical Implications

Across all four categories, a few principles emerge. Enterprise AI tools with strong contractual confidentiality protections fare better than consumer platforms, both for privilege and work product purposes and for compliance with emerging protective order standards. The identity of the prompt author matters: attorney-crafted prompts in furtherance of litigation strategy receive the strongest protection; client-generated and expert-generated prompts receive less protection, and in some cases, none. Agreements and protocols that predate the dispute — engagement letters, discovery protocols, Rule 29 agreements, protective orders — are the primary vehicle for managing these risks. Silence on AI tools in any of those documents is a vulnerability.

© Arnold & Porter Kaye Scholer LLP 2026 All Rights Reserved. This Blog post is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.