Client Alert – AI Tools in the Corporate Legal Department: What General Counsel Need to Know

In light of United States v. Heppner, 2026 U.S. Dist. LEXIS 32697 (S.D.N.Y. Feb. 17, 2026)

The emergence of AI as a routine legal research and drafting tool creates risks for corporate legal departments. A February 2026 ruling from the Southern District of New York provides the clearest judicial statement yet on those risks. The core holding: AI-generated legal analysis transmitted to a public platform carries no attorney-client privilege and no work product protection. Being an attorney does not change that result.

The Heppner Framework

In United States v. Heppner, that the court held documents prepared using Anthropic’s Claude — outlining a defendant’s legal defense strategy in anticipation of federal prosecution — were fully discoverable. Three grounds: no attorney-client relationship with an AI; no confidentiality, because Anthropic’s privacy policy permits voluntary third-party disclosure of user inputs; and no work product protection, because the documents were transmitted to a third-party platform outside the control of the attorney-client relationship. The court noted this was a question of first impression and the ruling is not nationally binding — but its logic applies directly to in-house practice.

Three Risks Specific to Corporate Legal Departments

Risk 1:  Business Personnel Using AI Without the Legal Department

In many companies, trademark clearance, initial responses to cease-and-desist letters, and preliminary contract reviews are handled at the business level before reaching counsel. When a brand manager or business development team member uses a public AI platform for that analysis, the result is an unprotected, discoverable business record.

The governing principle is straightforward: corporate attorney-client privilege attaches to communications between employees and in-house counsel made for the purpose of obtaining legal advice. It does not attach to employees’ independent AI-assisted research conducted before — or instead of — consulting counsel. An employee’s AI-generated assessment of a competitor’s mark, later forwarded to the general counsel, remains discoverable. In trademark litigation, that document can establish willful infringement or bad faith. The employee’s subjective intent, memorialized in a prompt, becomes evidence.

Risk 2:  In-House Counsel Using Public AI in Their Own Legal Work

Being an attorney does not cure the public AI confidentiality problem. When in-house counsel inputs the corporation’s trademark strategy, litigation assessment, or settlement position into a public AI platform, the attorney’s own work product is transmitted to a third party under terms that permit further disclosure. Heppner’s reasoning applies directly: the platform’s privacy policy eliminates the reasonable expectation of confidentiality that both attorney-client privilege and work product protection require. In-house counsel’s litigation strategy memo drafted with public AI assistance is no more protected than the defense strategy documents at issue in Heppner. The prohibition on public AI platforms applies equally to legal department personnel and business personnel.

Risk 3:  Absence of a Corporate AI Governance Policy

A company without a clear AI use policy for legally sensitive work faces compounded exposure: business personnel generating discoverable conflict analyses, counsel inadvertently forfeiting work product protection, and potential breach of confidentiality clauses in existing settlement agreements and licenses submitted to AI platforms. Each of these is an independent litigation risk. Together they represent a systemic vulnerability.

Where In-House Counsel Have a Genuine Advantage

The picture is materially better for in-house counsel using a properly configured closed enterprise AI system — one with contractual data isolation that prevents the vendor from retaining, training on, or disclosing inputs.

On such a system, in-house counsel’s AI-assisted legal analysis qualifies as attorney work product without requiring the untested agency theories that apply to non-attorney AI use. The attorney’s analysis is the attorney’s work product, generated with a tool — analogous to using a legal research platform or document review software. The closed system avoids the third-party disclosure that defeats protection on a public platform.

In-house counsel who direct AI-assisted research on a closed system are also in a stronger position with respect to their business clients’ use of the same tools. When counsel directs a business team member to use a designated closed AI system for a specific, defined analytical task — and then incorporates that output into counsel’s own legal analysis — the resulting work carries the protection of attorney work product. The key is that counsel must be the one directing the use and owning the analytical output. An employee’s independent AI research, even on a closed system, does not acquire privilege simply because counsel later reviews it.

A Governance Framework for the Legal Department

A sound corporate AI policy for trademark and legal matters should address at minimum:

• A categorical prohibition on public AI platforms for any legally sensitive analysis — trademark clearance, infringement assessment, litigation strategy, or contract review — by any employee, including legal department personnel.
• Designation of approved closed enterprise AI systems with contractual data protections for legal department workflows, with verification of vendor terms before deployment.
• A protocol requiring that in-house counsel direct any AI-assisted analysis touching legal matters, and that counsel — not the business team’s raw AI output — owns the analytical conclusion.
• An audit of existing trademark settlement agreements, licenses, and consent-to-use agreements for confidentiality provisions that may be breached by submitting terms to any AI platform.
• Training for both legal and business personnel, updated as the law develops. Business teams need to understand their AI research is discoverable. Legal staff need to understand that professional status does not protect public-platform use.

This alert reflects the law as of March 2026. The Heppner ruling is persuasive authority from the Southern District of New York and is not nationally binding. This area will continue to develop. Please reach out with questions about your jurisdiction, your company’s existing AI tools, or your vendor contracts.

Contact – We regularly assist corporate legal departments in developing AI governance frameworks, reviewing enterprise AI vendor agreements, and auditing existing contracts for AI-related confidentiality exposure.

Please contact: Lawrence R. Robins  |  Partner, Chair — Brand Management Practice Group [email protected]. 

If you are interested in a more in-depth analysis of this decision please reach out.