The Document Never Left the Building: Privilege Waiver Risks in the Age of Enterprise AI

November 3, 2026

What Claims Adjusters Need to Know

by Laura Bartlow, Jason Reeves, and Shannon O’Malley

A privileged coverage opinion comes in from outside counsel. Someone runs it through the company’s internal enterprise AI platform—a summarization tool, an analytics dashboard, a chat-based research assistant sitting inside the claims system—to get a quicker, one-page read on what it actually says. The summary gets routed to the adjuster, underwriting, or another business unit, with no privilege review or marking. No one thinks twice about it. The document never left the building. It reads like an efficiency gain. It might also be a waiver event.

This article explains why that practice deserves scrutiny, surveys the current state of the law, and explores approaches available to claims operations that are already living this fact pattern, whether or not they have named it yet.

Why this is urgent

Enterprise AI tools are no longer pilot projects. They are embedded in claims workflows, underwriting review, and legal-department document handling, which all use them as a matter of course now. That embedding has outpaced the case law.

Courts have started to address privilege in the AI context, but so far only with respect to public, consumer-tier tools, not enterprise deployments with contractual confidentiality protections, restricted access, and no model training outside of the organization. That gap is not a safe harbor. Opposing counsel will argue waiver, whether or not a court has ruled on the enterprise fact pattern directly, and they will use the consumer-tier decisions as their starting point. The absence of controlling authority on enterprise AI is a live litigation risk, not a resolved question in the policyholder’s or insurer’s favor.

A quick privilege refresher

Attorney-client privilege protects confidential communications made for the purpose of seeking or getting legal advice, so long as the communications stay within the circle of people entitled to receive them. Disclosure beyond the privileged circle can destroy the protection, so it’s critical to define who actually sits inside the privileged circle once an AI tool becomes part of the chain of custody. The hard question is, inside a company, who counts as within that circle?

There are two competing answers, and which one governs depends on the jurisdiction:

The narrow control-group test limits the privileged circle to those who actually direct or make decisions based on the legal advice—essentially, the decision makers themselves, who are typically senior management. Everyone else who receives, discusses, or acts on that advice sits outside the circle, and sharing the privileged materials with them risks waiver.
The broader subject-matter test, articulated in Upjohn Co. v. United States, 449 U.S. 383 (1981), extends protection to any employee communicating with counsel at the direction of a corporate superior about matters within the scope of the employee’s duties. This is the dominant framework in federal courts and most states today.

Privileged coverage opinions routinely get read by employees well outside a control group—adjusters, underwriters, reinsurance teams—precisely the population Upjohn brings within the privileged circle when their involvement is necessary and counsel-directed. But a handful of states still apply a control-group approach, and the test that governs is jurisdiction dependent. This distinction becomes even more consequential once an AI tool is part of the distribution chain: a broader Upjohn circle tolerates broader access to the AI workspace and its outputs without waiving privilege, while a narrow control-group jurisdiction leaves far less room for claims personnel outside senior management to touch privileged material, AI-mediated or not, without risk.

Work product is a separate and narrower protection than attorney-client privilege, covering materials prepared in anticipation of litigation regardless of who prepared them. Critically, waiver of work product protection requires disclosure to an adversary, or conduct that substantially increases the likelihood an adversary will obtain the material, not mere disclosure to any third party. That distinction does significant work in the case law discussed below.

What courts have said—Heppner and Warner

Two decisions, issued the same week, are now the leading authorities on AI and privilege, and they reached opposite results on similar facts.

United States v. Heppner, No. 25-cr-00503-JSR, 2026 WL 436479 (S.D.N.Y. Feb. 17, 2026), arose from a criminal securities-fraud prosecution. After learning he was a target of the investigation, the defendant used the consumer version of Anthropic’s Claude to generate 31 documents outlining potential defense strategy, then shared them with his lawyers. The court held the documents were neither privileged nor work product, for three reasons: (1) there is no attorney-client relationship between a user and an AI platform: Claude “is not an attorney,” and no recognized privilege exists without a “trusting human relationship” with a licensed, duty-bound professional; (2) there was no confidentiality, because Claude’s consumer-platform terms permitted data collection, retention, and use of inputs for model training; and (3) there was no retroactive privilege, as sharing the AI-generated documents with counsel after the fact did not convert them into privileged communications, because the defendant had used the tool on his own initiative, not at counsel’s direction.

Warner v. Gilbarco, Inc., No. 2:24-cv-12333, 2026 WL 373043 (E.D. Mich. Feb. 10, 2026), reached the opposite result on work product. A pro se civil plaintiff had used ChatGPT to help prepare filings in an employment case. The defendants moved to compel her AI queries and the platform’s responses, arguing that her use of a third-party tool waived any protection. The court disagreed, holding the materials were protected work product because she had prepared them in anticipation of litigation, and reasoning that generative AI platforms are “tools, not persons”: work-product waiver requires disclosure to an adversary or conduct likely to put the material in an adversary’s hands, not merely inputting information into software.

The key point for users of enterprise AI platforms: both cases involved public, consumer-tier tools, not enterprise deployments. Both courts anchored their reasoning in the specific terms governing the products actually at issue: Anthropic’s consumer privacy policy in Heppner, the absence of any adversarial disclosure in Warner. Neither opinion announced a categorical “AI equals waiver” or “AI equals safe” rule. That leaves open the harder question: how a genuinely closed, contractually restricted enterprise system fares.

Enterprise AI Deployments: Two Distinct Questions

A few questions worth asking:

Does inputting a privileged opinion into an enterprise tool constitute disclosure to a third party?

Probably not, if the system is genuinely closed, but the analysis isn’t automatic, and it matters why Heppner came out the way it did. The waiver ruling didn’t rest on the idea that inputting text into software is inherently a disclosure event. It rested on the fact that the consumer product’s vendor terms permitted training on user inputs, human review, and disclosure to law enforcement, meaning the user had no confidential relationship with the vendor at all.

That distinction maps directly onto settled third-party vendor law. Courts have long held that engaging outside vendors to facilitate legal services—e-discovery platforms, contract document-review staffing, translation services, and accountants—does not waive privilege, provided the engagement is confidential, the vendor functions as a necessary extension of the legal work, and the vendor has no unrestricted access to or use rights over the content. See United States v. Kovel, 296 F.2d 918 (2d Cir. 1961).

If an enterprise AI contract genuinely mirrors those conditions—no training on inputs, no human review of content, restricted or disabled logging, and contractual confidentiality commitments running to the client—the stronger the argument is that loading a privileged opinion into the system to generate a summary is not itself a disclosure event. But vendor terms matter, and they vary. Whether the platform trains on inputs, retains logs indefinitely, or gives vendor personnel access to workspace content is a genuine confidentiality question that a court will scrutinize closely if it is ever litigated; it cannot simply be assumed favorably because the product is labeled as “enterprise.”

Does the AI expand who’s in the room?

This question turns on human conduct, not tool architecture. Translate the control-group/Upjohn question into system-access terms: who is inside the privileged circle, and does the AI tool (or its output) expand that circle in practice? An AI workspace walled off to legal personnel only is a very different animal from one queried company-wide. If claims, underwriting, and legal all draw on the same workspace containing the same coverage opinion, the organization has functionally recreated the control-group problem: potentially non-privileged personnel now have access to privileged legal analysis, mediated by software instead of a forwarded email.

There’s also the related issue of purpose creep. The stated use—“get a quick read on what the opinion says”—is rarely the only use once the output exists in a shared system. It resurfaces in claims files, reserve discussions, reinsurance reporting. Each downstream use is its own disclosure question, and each one compounds the last. Unlike the first question, none of this is answered by the vendor contract; it is governed by who has access and what review sits between the output and the next reader.

Does the AI-generated summary of a privileged communication carry the same privilege as the source?

This question is an open one. An AI-generated summary may not itself be privileged even where the source document is, precisely because it was generated by software rather than by counsel providing legal advice. There is also a good argument the other way: that a summary circulated inside the circle is no different from one control-group employee restating counsel’s advice to another, which would leave the privilege intact. Work-product protection is more likely to attach to that summary in a litigation context, because work product protects mental impressions and materials prepared in anticipation of litigation regardless of who or what drafted them, whereas attorney-client privilege attaches specifically to communications with counsel for the purpose of obtaining legal advice.

However that question is ultimately resolved, the practical risk sits downstream. The real risk is not the act of AI summarization. It is what happens to the output afterward. Routing an AI-generated summary of a privileged opinion into the general claim file, into reinsurance discussions, or to business units outside the privileged circle, without a privilege review, is where waiver may actually materialize.

None of this is new law—it’s the same discipline organizations already apply to counsel’s opinions themselves, extended to whatever the AI produces from them. If an AI-generated output was built from counsel’s privileged coverage opinion, treat that output no differently than the opinion it came from: it should not be placed in the claim file, and it should not be circulated broadly within the company.

A practical filter

Before routing a coverage opinion—or anything derived from one—through an AI tool, ask the control-group question in system-access terms: would this many people be sitting in on the privilege conversation if it was a person in the room, not software?

Likely Fine:

Using enterprise AI to summarize privileged opinions, where the platform does not train on inputs, access is restricted to people already inside the privileged circle, and the resulting summary stays within that circle.
Generating internal analysis at the direction of counsel or for counsel’s own use in evaluating a matter.
Counsel review of AI output before any distribution.

Potentially Problematic:

Loading a privileged coverage opinion (or its AI summary) into a shared claims, underwriting, or reinsurance workspace, so multiple business functions can “see what it says.”
Routing AI-generated summaries of privileged opinions to the general claim file without adequate privilege markers—or routing it anywhere without review.
Operating without logging or access controls on the AI workspace.
Using a platform whose vendor terms permit training on inputs, or human review of workspace content.
Failing to mark as privileged AI-generated outputs that are derived from privileged sources.

Tips for building disciplined practices:

Restrict access to any AI workspace containing privileged material to personnel within the privileged circle and treat distribution of AI output the same way you would treat distribution of a paper memo.
Default to counsel-directed use: AI as a drafting aid for counsel, not a summarization tool deployed around
Implement a privilege-review protocol before anyone routes AI-generated output derived from privileged material beyond the privileged circle.
Label AI-generated outputs derived from privileged sources with appropriate privilege markings, so downstream recipients and, if necessary, a reviewing court can identify their provenance.
Train claims personnel on the distinction that matters most: the AI tool itself may be safe to use; the distribution of what it produces is where waiver risk actually lives.
Document the confidentiality measures in place—vendor terms, access restrictions, review protocols—so you can demonstrate them to a court if the question is ever litigated.
Review enterprise AI vendor contracts specifically for confidentiality commitments, training-on-inputs provisions, logging practices, and human-review rights.

Conclusion

This is a fast-moving area of law, and the absence of an enterprise-AI-specific ruling means the risk is unresolved. Heppner and Warner tell us how courts reason about consumer-tier tools; they do not tell us how a court will treat a closed, contractually restricted enterprise system used by a claims organization. The time to build disciplined practices around vendor terms, access controls, and privilege review is before a court is asked to rule on that question, not after discovery has already gone out the door. Carriers that put the recommendations above in place protect themselves regardless of how the open questions are eventually resolved.

The opinions expressed are those of the authors and do not necessarily reflect the views of the firm or its clients. This article is for general information purposes and is not intended to be and should not be taken as legal advice.