Is It Safe to Use ChatGPT for Privileged Legal Work?

No, not for anything genuinely privileged — and a federal court said so directly in February 2026. Attorney-client privilege only survives if a communication stays within a reasonably confidential relationship between a lawyer and client. A public AI chatbot doesn't offer that: it isn't a lawyer, its outputs come with disclaimers against providing legal advice, and its privacy policy typically permits your inputs to be stored, reviewed, or used to improve the model. Paste privileged facts into that box, and you may be handing opposing counsel a document they can compel in discovery.

What Does "Privileged" Actually Mean Here?

Attorney-client privilege protects confidential communications between a lawyer and client made for the purpose of getting or giving legal advice. A related but separate protection, the work-product doctrine, shields materials an attorney (or someone working at the attorney's direction) prepares in anticipation of litigation. Both depend on the same fragile ingredient: confidentiality. Once a privileged communication reaches someone outside that protected relationship, a third party with no duty of confidentiality, courts generally treat the privilege as waived, whether the disclosure was deliberate or careless.

That's the trap. A chatbot session doesn't feel like disclosure to a third party. It feels like typing into a search box. Legally, though, the input travels to a company's servers, gets logged, and, depending on the product tier, may get reviewed by human trainers or folded into future model training. None of that resembles the closed, protected channel privilege requires.

Why Would ChatGPT Break Privilege in the First Place?

Two separate problems stack on top of each other here. First, OpenAI's consumer products, the free tier and ChatGPT Plus, use conversation data to improve models by default unless a user manually opts out through account settings, according to OpenAI's own help center (opens in a new tab). A setting a paralegal forgets to check, or a new hire who never opens the account admin panel, is all it takes to expose matter details to a system built to retain them.

Second, and more fundamentally: even with training turned off, ChatGPT still isn't a party to the attorney-client relationship. It can't receive privileged communications, because privilege requires a lawyer, or the lawyer's agent acting at the lawyer's direction, on the other end. A chatbot answering questions independently, without a supervising attorney directing the work, sits outside that relationship no matter how the data gets handled afterward.

What Did the Federal Court Actually Rule in February 2026?

United States v. Heppner, decided in the Southern District of New York on February 17, 2026, put both of those problems on the record. Judge Jed S. Rakoff ruled that a defendant's conversations with a public generative AI platform were not protected by attorney-client privilege or the work-product doctrine, and he ordered roughly three dozen AI-generated documents turned over in discovery.

The reasoning tracked the structural gaps above. No attorney-client relationship could exist with the platform itself, since it isn't a licensed attorney and its own terms disclaim giving legal advice. The platform's privacy policy, which permitted data collection and potential third-party sharing, meant the defendant had no reasonable expectation of confidentiality to begin with. And because the defendant used the tool on his own, without direction from counsel, the resulting material never carried an attorney's mental impressions, so work-product protection didn't attach either. Showing the AI-generated documents to a lawyer afterward didn't retroactively fix any of that. For a fuller breakdown of the opinion, see Akin Gump's client alert (opens in a new tab).

What Does the American Bar Association Say About Using AI on Client Matters?

The American Bar Association (ABA) got there first, in July 2024, with Formal Opinion 512. It tells lawyers they're responsible for understanding how a given generative AI tool handles data before feeding it client information, and that they must "put in place adequate safeguards to ensure that data processed by GAI is secure and not susceptible to unwitting or unauthorized disclosure to third parties." On consent, the opinion goes further than most lawyers expect. It requires informed consent from the client before using their confidential information in an AI tool, and it says plainly that "boilerplate consent included in engagement letters will not be adequate." A blanket clause buried in your standard retainer agreement doesn't cover this; clients need to know, specifically, that AI tools may touch their matter. More detail on the opinion's scope is in the American Bar Association's own summary (opens in a new tab).

Does ChatGPT Enterprise or Business Change the Calculus?

Partly, and it's worth knowing exactly where the line sits. According to OpenAI's enterprise privacy page (opens in a new tab), ChatGPT Business, Enterprise, Edu, and the API platform don't train on customer data by default, and deleted conversations are purged within 30 days absent a legal hold. Admins also get audit logs and single sign-on, which at least creates a record of who accessed what and when.

That closes the training-data gap. It doesn't close the relationship gap. Nothing about an enterprise data agreement makes ChatGPT a lawyer, and nothing about it establishes that an attorney directed the work, which were the two findings that actually sank privilege in the Heppner case. An enterprise contract is a real security improvement over the free tier. It is not, by itself, a privilege-preserving one.

What Should a Law Firm Actually Do With Sensitive Matters?

Keep the genuinely privileged work, anything involving client facts, litigation strategy, or draft legal advice, out of any AI tool the firm doesn't fully control. Route what does go through AI under an attorney's explicit direction, documented as such, so work-product protection has a chance of attaching later if it's ever challenged. Save consumer AI tools for the parts of the job that were never privileged to begin with, like general legal research, formatting, or drafting templates built from public precedent.

For firms handling regulated or high-stakes matters as a matter of routine, the more durable fix is architectural rather than procedural: keep the data inside the firm's own environment instead of routing it through a vendor's cloud servers at all. Monarch's ForgeAI industries page (opens in a new tab) describes exactly this use case for legal teams: contract review, case research, and internal knowledge retrieval running on hardware the firm owns, rather than a public chatbot the firm merely subscribes to. That doesn't manufacture privilege by itself; the direction-of-counsel requirement still applies regardless of where the AI runs. But it does remove the third-party-disclosure problem that made the Heppner ruling possible in the first place.

None of this puts AI off-limits in legal practice. The ABA opinion assumes lawyers will keep using these tools and focuses on how, not whether. What changed in February 2026 is that "privileged" and "typed into a public chatbot" are, per an actual federal ruling, treated as mutually exclusive unless a firm has built the safeguards first.