Generative AI Prompts: Discovery and Privilege After Recent Cases
Here's the short version: prompts are discoverable, and they're not automatically privileged. Courts are treating prompts, settings, and outputs like any other ESI under Rule 26(b)(1). If you want protection, you have to meet the traditional privilege and work-product standards, document why they apply, and avoid waiver.
How lawyers are actually using AI in litigation
- Document review at scale to spot relevance, patterns, and anomalies.
- Research support across caselaw, statutes, and precedent with quick synthesis.
- Scanning multiple databases and surfacing results fast.
- Drafting support for pleadings, motions, and forms based on standards.
- Outcome analysis to inform case strategy and risk.
- Strategy development from analogs in similar cases.
- Risk profiling based on case factors.
- Settlement assessments against history and predicted outcomes.
Relevance: prompts are discoverable, but only if they matter
Courts apply strict relevance and proportionality. One SDNY decision denied a motion to compel broad AI discovery because the requesting party did not tie prompts, settings, or AI product development to any specific claim or defense under Rule 26(b)(1). The moving party carries the initial burden on relevance and proportionality.
Other courts have compelled targeted production. In Concord Music Group, Inc. v. Anthropic PBC, the court ordered production of non-lawyer prompts and outputs by identified employees (including founders or executives), limited by ordinary proportionality limits. Irrelevant prompts and outputs were out of scope by definition.
Work product: some attorney prompts qualify
When counsel crafts prompts in anticipation of litigation, courts have treated those prompts and related settings as work product because they reveal mental impressions and strategy. Concord Music expressly rejected the argument that attorney prompts are not privileged, aligning with other decisions recognizing counsel-crafted prompts as opinion work product.
Watch for waiver. In the same litigation, counsel waived protection where prompts were provided to an expert. If you share prompts or settings with third parties without protection, expect challenges.
Attorney-client privilege: consumer AI breaks the chain
In United States v. Heppner, the court held a defendant's AI chats were not privileged and not work product. The communications failed all three privilege elements: there was no attorney on the other end, no confidentiality due to the tool's data-use policy (inputs/outputs collected, used for training, and shared with third parties), and the tool disclaimed providing legal advice.
The work-product claim also failed because the materials were not prepared by or at the direction of counsel and did not reflect counsel's strategy. Non-privileged materials do not become privileged just because they were later sent to a lawyer, and any originally privileged content was waived when shared with the tool.
Internal AI development communications: copying counsel isn't enough
Courts apply the usual corporate privilege rules to AI development. Technical emails about training data, model development, and repositories are not privileged simply because an attorney recommended their creation or was copied. Privilege requires a primary purpose of obtaining or providing legal advice, not business or engineering discussions.
Practical steps to protect what can be protected
- Use enterprise AI with strong privacy terms. Disable training on your data, negotiate DPAs, restrict third-party sharing, and document the settings. Avoid consumer tools for client matters.
- Route legal prompts through counsel. Label and store attorney prompts/outputs in a secure workspace. Separate non-lawyer experimentation from litigation work product.
- Tighten retention. Define what you log (prompts, outputs, settings, versions), where you store it, and how long you keep it. If you keep it, assume it may be discoverable.
- Privilege process. Build privilege-log descriptions that identify attorney prompts as mental impressions without revealing substance. Add a 502(d) clawback to your protective order covering AI artifacts (prompts, outputs, settings).
- Expert protocols. Sharing prompts or settings with experts can waive work product. Use written instructions, limit what is shared, and align with Rule 26(b)(4) and local rules.
- Discovery requests. If you seek prompts, tie them to specific claims, dates, custodians, and model versions. Broad "all AI" requests will draw proportionality objections.
- Team training. Ban pasting client confidences into consumer AI. Require use of approved tools and spaces. Teach staff that copying a lawyer or mentioning legal risk does not create privilege.
What courts are signaling
General industry fishing expeditions are getting shut down. Targeted, relevant requests tied to the pleadings are getting traction. On privilege, courts look at content, purpose, participants, and confidentiality-one message at a time, not by label.
Ethics and competence
Courts are aligning with ethics guidance that lawyers must understand the tech they use and its security risks. See ABA Model Rule 1.1, Comment 8.
For teams building responsible AI practices
If you're operationalizing AI across litigation support, research, and drafting, this resource can help your team build repeatable, defensible workflows: AI for Legal.
Bottom line
Prompts are discoverable. Attorney prompts can be protected as work product, but only if you meet the elements and avoid waiver. Use enterprise tools, document your controls, and design discovery and privilege protocols that assume a judge will read every prompt you keep.
Your membership also unlocks:
