For lawyers · Ethics · AI
The Machine Is Not a Third Party
Why the bar’s AI-privilege panic fails its own test.
Every ethics alert on artificial intelligence tells some version of the same story. A lawyer types client information into a chatbot, the chatbot lives on someone else’s servers, and therefore the lawyer has “disclosed” confidential information to a third party: risking privilege waiver, violating ABA Model Rule 1.6, and needing the client’s informed consent before touching the tool at all. The NYSBA Task Force report sounds the alarm. New York City Bar Formal Opinion 2024-5 conditions use on the tool’s confidentiality protections or the client’s consent. ABA Formal Opinion 512 builds a fact-specific test around it. And United States v. Heppner, the S.D.N.Y. decision holding that a criminal defendant’s consumer Claude chats weren’t privileged, gets cited as the case that proves the danger is real.
The premise is confident, widely repeated, and wrong. It fails the simplest test available: Gmail.
The Gmail test
Take every element of the bar’s alarm about AI chat and apply it to email, the tool through which nearly all privileged client communication already flows:
Third-party servers. Every privileged email you have ever sent sits on Google’s or Microsoft’s servers, not yours.
Automated scanning. Google’s terms say its “automated systems and algorithms” analyze your content “as the content is sent, received, and when it is stored,” including to detect “spam, malware, and illegal content.” This is not hypothetical; it is the documented operation of the service.
Retention on the provider’s timetable. Google warns that “there may be delays between when you delete something and when copies are deleted from our active and backup systems.” Your “delete” button starts a process on Google’s schedule, not yours.
Terms reserving disclosure. Google’s privacy policy reserves the right to share information to “[r]espond to any applicable law, regulation, legal process, or enforceable governmental request.”
Legal-process exposure. Google complies with subpoenas and preservation orders, and it publishes a transparency report on the government demands it receives.
The bar answered the email question long ago, and it answered it the right way. ABA Formal Opinion 99-413 concluded that lawyers have a reasonable expectation of privacy in email. ABA Formal Opinion 477R (2017) reaffirmed that “the use of unencrypted routine email generally remains an acceptable method” of communicating with clients, and it framed the lawyer’s duty under Model Rule 1.6(c) as reasonable efforts that are “not susceptible to a hard and fast rule”: assess the risk, take responsive precautions, and reserve special measures for especially sensitive matters. No informed-consent form for each client. No presumption of disclosure.
New York wrote the same answer into its evidence law. CPLR 4548 provides that a privileged communication does not lose its privileged character “for the sole reason that it is communicated by electronic means or because persons necessary for the delivery or facilitation of such electronic communication may have access to the content of the communication.” (CPLR 4548 governs privileges under New York law; a federal criminal case like Heppner applies federal common law. But the principle is the same one 477R applies nationally.)
Nobody (not the NYSBA, not the City Bar, not the ABA, not any court) claims that sending a privileged email through Gmail waives the privilege.
So the bar’s theory faces a dilemma. Either the theory is correct, in which case every lawyer using Gmail has been systematically waiving privilege for twenty years; or the theory is wrong. It cannot be both. And since no one believes the first horn, we should stop pretending the second isn’t true.
An opted-out Claude Pro account is, structurally, Gmail with a different interface: third-party servers, automated processing, no training use, no employee access except for usage-policy enforcement, deletion on a fixed timetable, legal-process exposure. If one of these waives privilege, so does the other. The bar cannot have it both ways.
Disclosure requires human eyes
Waiver doctrine has always been about disclosure to someone. In the waiver cases, the “third party” is a human being or an entity acting through human eyes: the adversary, the government, the auditor, the co-defendant. The doctrine’s touchstone is conduct “inconsistent with the maintenance of confidentiality,” and confidentiality is a concept about human knowledge. A secret no human learns is still a secret.
Automated processing is not disclosure; it is instrumentality. Photocopying a privileged memo does not disclose it to the copier company. Running privileged documents through technology-assisted review does not disclose them to the e-discovery vendor. Spam filters “read” every privileged email ever sent, and no court has held that this waives anything. A large language model that processes text to produce text is a tool, closer to a photocopier than to a paralegal. It is not a confidant. It cannot be told a secret in any sense the law has ever recognized.
This is the same intuition behind copyright law’s human-authorship requirement: the law cares about human involvement because legal consequences attach to human acts. Disclosure to a non-human system, with no human in the loop, is not disclosure at all.
The cases where electronic communication has cost a client the privilege prove the point. In Scott v. Beth Israel Medical Center, 17 Misc. 3d 934 (Sup. Ct. N.Y. Cnty. 2007), a doctor lost the privilege for emails to his lawyer sent over his employer’s system, because the employer banned personal use and reserved the right to access and disclose employee email. The court’s explanation: the policy put “the employer looking over your shoulder each time you send an e-mail.” Id. at 938. The same court held that the access of the people who run the system was irrelevant, because CPLR 4548 had already decided that question. Id. at 942. The waiver came from a human with a reserved right to read, not from the machinery.
Heppner doesn’t answer the question
The decision everyone cites is doing more work than it can bear. In United States v. Heppner, 820 F. Supp. 3d 292 (S.D.N.Y. 2026), a criminal defendant used the consumer version of Claude on his own, after he knew he was a target, and with no direction from his lawyers; his counsel conceded they “did not direct [him] to run Claude searches.” Id. at 295. Judge Rakoff held that the resulting documents failed every element of the privilege. Claude is not a lawyer. The communications were not confidential, because the privacy policy Heppner accepted (the version in effect as of February 19, 2025) said Anthropic collected inputs and outputs, used them to “train” Claude, and reserved the right to disclose them to third parties, including “governmental regulatory authorities.” And Heppner was not seeking legal advice from a tool that disclaims giving it. Id. at 296–97. Sending the documents to counsel later could not make them privileged. Id. at 297.
Read closely, the opinion answers a narrower question than the one it is cited for.
First, it is about who used the tool and why. A client researching his own case, alone, is not a lawyer using a tool in the course of a representation, and the court said so: had counsel directed the use, Claude “might arguably be said to have functioned in a manner akin to a highly trained professional who may act as a lawyer’s agent within the protection of the attorney-client privilege.” Id. at 297.
Second, the confidentiality holding rests on the terms. The court did not hold that typing into an AI tool is disclosure in itself; it held that this policy, with training use and a broad reservation of disclosure rights, defeated any reasonable expectation of confidentiality. Id. at 296–97 & n.3. Change the terms and the analysis changes. Take away training use, as an opted-out or enterprise configuration does, and what remains is a provider’s reservation of the right to respond to legal process. Google reserves the same right. If that alone defeats confidentiality, it defeats confidentiality for every Gmail account in the country.
Third, the court rejected the argument that Claude is just software, but not in a way that helps the bar. It reasoned that using software “is not intrinsically privileged,” and that every privilege requires “a trusting human relationship,” which no one can have with Claude. Id. at 296. That is correct, and it is this article’s point. A client cannot create a privilege by confiding in a machine. By the same logic, a lawyer does not waive one by using a machine. A tool is neither a lawyer nor a third party.
Heppner is also one district-court decision. It is not the Second Circuit, not the New York Court of Appeals, and not a rule.
Other courts are already drawing the line
The courts that have looked at the question since Heppner have come out the other way on facts closer to ordinary practice. Each decided work-product protection, not the attorney-client privilege, and work product is waived only by disclosure to an adversary or in a way likely to reach one, a more forgiving standard. But each turned on the same question this article asks: is the machine a “third party”?
In Warner v. Gilbarco, Inc., 820 F. Supp. 3d 629 (E.D. Mich. 2026), the court held that a pro se plaintiff did not waive protection by using ChatGPT, because generative AI programs “are tools, not persons, even if they may have administrators somewhere in the background.” Id. at 636–37. The court agreed with the plaintiff that the contrary theory “would nullify work-product protection in nearly every modern drafting environment, a result no court has endorsed.” Id. at 637.
In Morgan v. V2X, Inc., No. 25-cv-01991, 2026 WL 864223 (D. Colo. Mar. 30, 2026), the court distinguished Heppner and ran the Gmail test itself: “Does that mean that anyone with a Gmail account has forfeited all rights to confidentiality and privacy?” Id. at 4. Routing information through a third-party system, it concluded, “does not forfeit all privacy,” and AI interactions “do not automatically compromise work product protections.” Id.* at *5.
In Assini v. Hayward, 261 N.Y.S.3d 915 (Sup. Ct. Nassau Cnty. 2026), a New York court followed Morgan, declined to follow Heppner, and quashed a subpoena to OpenAI for a litigant’s prompts and outputs. Id. at 919–20.
None of these decides the privilege question for a lawyer’s own use. But together they show that “AI use is disclosure” is not the settled rule the ethics alerts assume.
The bar is arguing with itself
The guidance is internally incoherent. The NYSBA’s own Task Force report, approved by the House of Delegates in April 2024, opens its discussion of competence with this warning: “A refusal to use technology that makes legal work more accurate and efficient may be considered a refusal to provide competent legal representation to clients.” Comment [8] to New York’s Rule 1.1 makes keeping abreast of “the benefits and risks associated with technology the lawyer uses to provide services to clients” part of competence.
But the confidentiality guidance makes compliance with the competence duty practically impossible: treat AI interactions as presumptive disclosures, get informed consent per client per tool, verify terms that change quarterly. Nobody applies that regime to email hosting or e-discovery vendors, which involve the same third-party servers, automated scanning, retention, and legal-process exposure. Opinion 477R handled those risks with a reasonable-efforts standard, not a consent regime. Cloud storage gets the same treatment in New York: the State Bar’s Opinion 1020 requires the client’s informed consent only for a cloud tool that lacks “reasonable protection to confidential client information.” The City Bar’s own AI opinion cites that cloud rule (Formal Op. 2024-5 n.5). It is the right rule, and AI should get it too. AI exceptionalism here isn’t principle. It’s novelty panic: a new technology gets a new, stricter rule that the old technologies, indistinguishable in every relevant respect, never had to satisfy.
A better rule
The fix is a technology-neutral rule with three parts:
1. A safe harbor for verified configurations. A lawyer’s use of an AI tool under a verified configuration (no training on client data, no human review except for narrowly defined and disclosed safety or legal-compliance triggers) is deemed consistent with the duty of reasonable efforts under Model Rule 1.6(c) and its New York counterpart, and is not a disclosure to a third party for privilege-waiver purposes. This is the treatment email and cloud storage already receive under Opinion 477R and CPLR 4548. The rule should say what the practice already assumes. Courts are already drawing this line: in Morgan, the court’s protective order allows confidential material to go into an AI tool only if the provider is contractually barred from storing or training on it and from disclosing it except where essential to deliver the service. 2026 WL 864223, at *7.
2. Consent where disclosure actually happens. Informed consent should be required only for configurations that actually resemble disclosure: tools whose terms permit training on client content or general human review of it. When the provider’s humans may read the material as a matter of course, that is a third-party disclosure, and the existing consent framework fits. The trigger should be the terms, not the technology.
3. Verify, don’t just trust. The safe harbor must be earned. The lawyer has to actually verify the configuration: confirm the opt-out, know the retention terms, understand what triggers human review. Technological competence means knowing your tools’ settings, the same way it has always meant knowing where your files are. Ignorance of the settings is not a safe harbor; verified configuration is.
And one institutional point: instead of pushing consent paperwork onto individual lawyers, bar associations should be pressing providers for legal-professional configurations with contractual confidentiality commitments, the way HIPAA produced business-associate agreements. The bar has collective bargaining power it is currently leaving on the table while lecturing solo practitioners about pop-up consent windows.
Conclusion
The question was never whether AI is special. The question is whether we apply the rules we already have. We do: to Gmail, to the cloud, to every tool that came before. Automated processing without human eyes is instrumentality, not disclosure, and a rule that says otherwise indicts the entire existing practice of law.
The machine is not a third party. It’s time the guidance caught up.
1 My thanks to Carolyn Elefant for her comments on a draft of this article. ↩
I work with referring and co-counsel on employment matters. See referrals and co-counsel.
This article is general information for lawyers, not legal advice, and it does not create an attorney-client relationship. Attorney Advertising.