The Texas Business Court’s June 3, 2026 minutes protect the non-attorney principal’s ChatGPT conversations as work product, but still require plaintiffs to disclose what exhibits were shared with the tool. This is the latest data point in a matter that is still being finalized by the court.
ChatGPT and Claude are now part of the way people work, including how litigants and clients think about litigation. That ubiquity has given rise to something new in 2026. There has been a series of four discovery decisions in roughly four months, each testing how privilege and work rules apply when litigants use AI, and a civil discovery case examining what a protective order should say about AI. If someone runs litigation material through a generative AI tool, is the resulting conversation protected from discovery? The answer depends on the legal doctrine at issue, the tool involved, and how the litigants used it. On June 3, the Texas Business Court added one of its more helpful decisions for companies setting AI policies.
in Tate Group Automotive LLC v. Legacy Automotive CapitalLLC, No. 25-BC11B-0020 (Tex. Bus. Ct. 11th Div. June 3, 2026), reviewed by Judge Grant Dorfman. in camera A ChatGPT “conversation” with a non-lawyer named Chris Tate, who represents the plaintiff. The plaintiff had refrained from doing so as a lawyer’s duty. The defendant made two allegations. The work product cannot cover chats with non-lawyer AI tools, and using the tool waives any protections. After reviewing the material, the court largely sided with the plaintiff, but ordered several pages from a document to be produced because it was not a work product. The remaining conversations qualified under Texas Rule of Civil Procedure 192.5(a)(1), which protects material or mental impressions created in anticipation of litigation “by or for a party,” the court held. The court reasoned that the language was sufficiently broad to extend to the party leader’s own litigation preparation, whether or not it was prepared by a lawyer. This ruling does not exempt all AI prompt history. The extent of protection still determines governing rules and the role played by lawyers.
Regarding waivers, the court adopted its standard from two federal decisions cited by the plaintiffs, rather than the authority relied upon by the defendants. agreed to that Warner v. Gilbarco, Inc.No. 2:24-cv-12333, 2026 WL 373043 (ED Mich. February 10, 2026), and Morgan v. V2X Inc.No. 25-cv-01991-SKC-MDB, 2026 WL 864223 (D. Colo. March 30, 2026), the work product may only be disclosed to an adversary or surrendered in a manner that significantly increases the likelihood that an adversary will obtain the material. From that perspective, sending material to ChatGPT does not itself pass the material to the other party. The court expressly rejected the defendant’s reliance. United States v. Heppner; No. 25-cr-503 (JSR), 2026 WL 436479 (SDNY, February 17, 2026), this SDNY decision received national attention for finding that the Claude Exchange of a represented criminal defendant was unprotected.
variables that determine these cases.
These four decisions only begin to outline the rules, and separating the two principles in practice alleviates many of the apparent contradictions. Attorney-client privilege protects confidential communications made for the purpose of receiving legal advice, and thus increases or decreases depending on the reasonable expectation of confidentiality. Work Product protects litigation preparation materials under the narrower waiver rules discussed earlier. While the issue with consumer tools is primarily a confidentiality issue regarding privileges, whether the use of AI results in surrender of artifacts is another issue. Until now, civil courts have not treated the use of AI alone as disclosure to an adversary.
Three variables play most of the role in predicting how an incident will turn out.
- The first variable is the tool’s term. Judge Rakoff’s decision heppner The lawsuit relies heavily on the defendants’ use of Anthropic’s consumer version of Claude, the terms of which allow Anthropic to collect prompts and output, use them for training, and disclose them to third parties, including regulators, and in connection with claims, disputes, and litigation. Under these conditions, the court held that there was no reasonable expectation of confidentiality, and the attorney-client privilege claim was sunk. Warner and morgan Failure to treat AI vendor use as sufficient to waive deliverables. They asked whether disclosure would significantly increase the likelihood of access by an adversary, and the answer was “no.”
- The second variable is direction. Mr. Heppner prepared the documents on his own initiative, not at the direction of an attorney, and subsequently filed them. This undermines the agency theory behind his privilege claim, which cannot hide existing unprotected documents by later turning them over to lawyers. Litigation to protect copyrighted works involved lawyers or nonlawyers preparing their own cases, and the Copyright Works Rule provided protection.
- The third variable is the control criterion. Texas Rule 192.5(a)(1) protects “material prepared or impressions made mentally” in anticipation of litigation “by or on behalf of a party,” giving Judge Dorfman a clearer textual path than the defendant’s agency-based claims. Federal Rule 26(b)(3) also applies to party materials. Warner and morgan Note. but heppner It arose from a federal criminal stance that treated counsel’s direction and strategy as central to the issue of work product. The exact wording of the forum could decide the case and lawyers should not assume Heppner’s Federal criminal inferences move to state civil proceedings.
Courts protecting AI research have relied on the framework that chatbots are tools, not people, which, while intuitive, obscures data architecture points. heppner That’s correct. A tool that allows you to send input to a vendor’s server for storage and reuse is not the same as a word processor. heppneron that part is interpreted more broadly than the facts require. As a Harvard Law Review commentary pointed out, courts will not ask whether using Gmail or Google Docs to contact a lawyer invalidates privilege, and a fact-specific analysis is better than almost categorically excluding AI. None of these decisions celebrates lawyers who drop privileged client materials into consumer chatbots.
Problem: Protection does not cover detection inputs.
The most practical part of the Texas ruling is that the ruling requires that even after most of the conversations are protected. borrow from morganin which Judge Maritza Dominguez Braswell forced the plaintiffs to disclose the AI platforms they used, Judge Dorfman ordered the plaintiffs to identify by Bates number, if applicable, all “evidential materials or products” they shared with ChatGPT, including those covered by the protective order. He also pointed to potential violations of the protective order and asked the parties to amend the order to specify whether and how sensitive information could enter the AI tools.
This requirement takes away much of the shine from victory. Hiding the content of conversations will do little good if a company has to admit that it executed material under a confidentiality order using tools it has never cleared. If this information is made public, it could give adversaries the ability to fight protective orders and provide a partial map of what discoveries were made on the tool. And so are broader trends. In the OpenAI copyright case, a court forced the production of a sample of 20 million anonymized logs of ChatGPT conversations over user privacy challenges. This is a reminder that relevant retained AI logs will be subject to practical discovery if safeguards are agreed to by the court.
What does the judgment require of compliance programs?
Each lesson traces the facts that determined one of these cases.
Scrutinize the data terminology of your tools, not your marketing. heppner We’ve turned on what vendors can do with your input in the Consumer Tools clause. A term worth checking is done in reverse. No training on data required. Short-term or controlled retention with deletion rights. Restrictions on Subprocessor and Third Party Access. Disclosure is also prohibited except to bind the service provider or pursuant to legal process, with notice where permitted. The “enterprise” label doesn’t solve this problem. What matters is what the contract allows the provider to do with what the user enters.
In cases where privilege is important, AI-assisted legal proceedings are conducted through lawyers. Work product can protect a party’s own case preparation, especially under broad rules like Texas’s, but attorney-client privilege becomes stronger when lawyers direct the use of AI and incorporate it into their advice. Mr. Heppner’s materials failed in part because he conducted the searches himself and then sent the results to his attorney, and was unable to turn unprotected documents into privileged ones. If AI is involved in the problem, record who directed the work, why, and under what conditions.
Treat detection uploads as discoverable facts. The Texas ruling protected most of the chats, but still required plaintiffs to disclose what materials they shared with ChatGPT. Even if instant response communications are protected, a court may require disclosure of which documents produced entered the tool, especially if a confidentiality order is in place. Prioritize tools that put AI conversations on legal hold from the start, export them, preserve them as needed, and delete them when retention obligations end.
Write the AI into a protective order before production begins. both morgan and Tate This is exactly what is needed, and it is much cheaper to set rules before sensitive material moves than to sue later for alleged infringement. The enforceable clause states whether the specified material may be incorporated into the AI tool. Separate public consumer tools from authorized enterprise or API environments. Bar training and reuse. Set retention, retention, and deletion conditions. Controls subprocessors. You can also require parties using AI using protected materials to attest to their compliance with those safeguards and retain documentation. In doing so, a tool’s identity and associated safeguards will be disclosed only by agreement, court order, or reasonable good faith compliance request associated with the protected material actually submitted to such tool.
Despite the lessons learned from these opinions, these issues are far from resolved. All four are trial court decisions that are persuasive at best. morgan This is a judge’s order for discovery of evidence. Tate This is a small entry ostensibly not intended to be final. The first appellate decision could reshuffle any of those threads, since the appellate court has not weighed in and the four cases span different contexts, from federal criminal cases to civil cases in Texas.
A blanket ban on all AI uses is unlikely to remain in place simply because the practice is already being done everywhere. However, a categorical prohibition on putting privileged, customer confidential, trade secret, or nondisclosure-ordered material into unauthorized public tools is becoming difficult to argue against. The perimeter that protects your company is data, not tools. Keep the material out of tools that aren’t on the approved list, and make sure everyone who touches the issue understands the rules. A more stable pattern under the heading is that the use of AI does not itself result in a loss of deliverables. The tools a company chooses, the conditions they protect, and how they use those tools determine whether their protection is effective. It also determines whether a company must communicate its protection to the other party, even if it retains it.
