Are AI Prompts Discoverable? A Federal Ruling and the Expert Work-Product Question

By Michael Barr

Note: This article discusses a court decision based solely on publicly available reports and court filings. It is general commentary for technologists and litigators, not legal advice. Whether to use any AI tool on a given matter is a decision for counsel. Consult counsel about any specific situation.

Generative AI has quickly become a research aid and first-draft writer for many people involved in modern work, and litigation is no exception. A recent federal decision is a sharp reminder that the convenience carries a question few have stopped to ask: when someone types into a publicly available AI tool, are they creating a confidential work product, or a discoverable record?

A first-of-its-kind ruling

According to published reports, U.S. District Judge Jed S. Rakoff of the Southern District of New York confronted a question of first impression: whether a litigant's exchanges with a public generative AI tool, used in a pending case, are protected by the attorney-client privilege or the work product doctrine. The court held that they are not, and the documents had to be produced.

The facts, as reported, are instructive. A defendant facing securities and wire fraud charges anticipated his indictment and began preparing his defense. On his own initiative, and without any suggestion from his counsel, he used a publicly accessible version of the Claude AI platform to draft reports outlining his defense strategy and arguments. He later gave those documents to his lawyers. When the FBI executed a search warrant, it seized 31 documents memorializing his exchanges with the AI tool.

Applying the traditional elements of privilege and work product, the court reportedly found that the communications did not involve an attorney-client relationship, were not confidential, were not made to obtain legal advice, and did not reflect an attorney's trial strategy. The court also noted that the public tool's terms of service did not guarantee privacy. The documents had to be produced.

Why this reaches beyond one defendant

It would be easy to read this as a criminal-defense curiosity. It is not. The work product doctrine, codified for civil cases in Federal Rule of Civil Procedure 26, is the everyday shield that protects developing analysis, draft calculations, discarded theories, and notes from discovery. That protection matters a great deal to expert witnesses, including machine learning and AI experts, whose value lies in rigorous, candid, and often non-final work.

The ruling raises a direct question: if a publicly available AI tool were used anywhere in the course of that work, would those exchanges enjoy the same protection, or would they be discoverable like the documents in this case? Notably, the exchanges here were the litigant's own initiative, created without any direction from counsel. Independent use outside a specific attorney question was the posture the court found unprotected.

To be clear about what this article is not saying: it is not a suggestion that experts use AI tools, nor a claim that they do. Many courts, firms, and attorneys are understandably cautious about AI in expert work, and whether to use such tools on any given matter is a decision for the retaining attorney, not for an expert acting alone. The point here is narrower and more important. Where these tools are used by anyone on a team, the privilege and work-product consequences are now anything but settled.

The deeper puzzle: what counts as a "communication" with a tool

The ruling exposes a definitional problem the law has not resolved. We do not usually say we "communicate with" the software on our own computer. So where is the line?

• Do you communicate with a word processor running locally on your laptop?
• What about that same program running in a browser through a cloud account?
• What about an AI assistant suggesting text while you write?
• What about a public chatbot you type a research question into?

If using a tool becomes a "communication" the moment the tool is an AI, the distinction is doing a lot of work for a reason that may owe more to novelty than to principle. A coherent rule needs to explain why a query to a public AI tool could waive protection while a search-engine or encyclopedia lookup, also a query sent to a third party that logs it, presumably does not.

Taken to its logical end, the concern compounds. Mainstream productivity tools are increasingly cloud-connected and AI-enhanced by default. A common word processor may sync drafts to the cloud and offer built-in writing assistance, and email, search, and reference tools all route queries through third-party servers that retain them. If the reasoning here were read broadly and allowed to stand, where would it stop? Would it suggest that a professional, an expert included, cannot safely use any cloud-based or AI-enhanced tool, up to and including a cloud-synced version of an ordinary word processor like Microsoft Word, without risking that the resulting files become discoverable? That sweeping result is almost certainly not what anyone intends, which is precisely why the limits of this doctrine, and how courts draw them next, matter so much.

A wrinkle for patent work

The same uncertainty reaches innovation itself. If an inventor, or anyone developing a novel idea, were to work through it with a publicly available AI platform, has that idea been disclosed to a third party in a way that bears on novelty or on a non-publication strategy for a pending application? Most practitioners would say a private brainstorm is not a public disclosure. But if a court is willing to treat AI exchanges as communications that defeat confidentiality, no one should simply assume that prompts typed into a consumer tool stay private.

Practical, risk-aware steps while the law catches up

The technology is moving faster than the doctrine, so prudence falls to the people doing the work. For attorneys and experts weighing how, or whether, these tools fit a matter:

• Treat the choice as counsel's to make. Whether AI is used on a matter, and how, is a decision for the retaining attorney, informed by the court and the client. A legitimate answer is "not on this matter."
• If a public AI tool is used at all, assume the prompt is discoverable. Treat the input as a record that could surface later.
• Distinguish consumer tools from enterprise tools. A public chatbot whose terms disclaim privacy is not the same as an enterprise tool with confidentiality terms used under counsel's direction.
• Agree on a protocol up front. Decide deliberately rather than by default, and document what is and is not permitted.
• Mind data retention. If a tool stores and can export prompts, assume that history is discoverable.
• Keep privileged reasoning in protected channels with counsel.

The takeaway

This decision does not resolve whether AI belongs in litigation. That judgment is still forming among courts, counsel, and professional norms, and many are rightly cautious. What the decision does is puncture a soft assumption: that a private-feeling exchange with a machine is actually private. For everyone touching a case, including the experts whose analysis must withstand scrutiny, the lesson is that any decision to use such tools should be made deliberately and together with counsel, never by default, and with clear eyes about what any tool does with the information it receives.

Barr Group's team of electronics and software expert witnesses provide experienced and unbiased source code reviews, expert reports and testimony for product liability, patent infringement, software copyright, and trade secrets litigation involving computer-based technology and software. HIRE AN EXPERT

Sources