A June 3, 2026 minute entry from the Texas Business Court protects a non-lawyer principal’s ChatGPT conversations as work product but still requires the plaintiff to disclose which discovery materials were shared with the tool. It is the newest data point in a question the courts are still sorting out.

ChatGPT and Claude are now part of how people work, including how litigants and clients think through a case. That ubiquity has produced something new in 2026: a run of discovery rulings, four in roughly four months, all testing how privilege and work-product rules apply when litigants use AI – and, in the civil discovery cases, what protective orders should say about it. When someone runs case materials through a generative AI tool, are the resulting conversations protected from discovery, or fair game? The answers have varied with the doctrine at issue, the tool involved, and how the litigant used it. On June 3, the Texas Business Court added one of the more useful rulings for companies setting AI policy.

In Tate Group Automotive, LLC v. Legacy Automotive Capital, LLC, No. 25-BC11B-0020 (Tex. Bus. Ct. 11th Div. June 3, 2026), Judge Grant Dorfman reviewed in camera the ChatGPT “conversations” of the plaintiff’s principal, a non-lawyer named Kris Tate, which the plaintiff had withheld as attorney work product. The defendants made two arguments: work product cannot cover a non-lawyer’s chats with an AI tool, and using the tool waived any protection regardless. After reviewing the materials, the court mostly sided with the plaintiff, though it ordered a handful of pages from one document produced because they were not work product. The rest of the conversations, it held, qualified under Texas Rule of Civil Procedure 192.5(a)(1), which protects material prepared or mental impressions developed in anticipation of litigation “by or for a party.” That language, the court reasoned, was broad enough to reach a party principal’s own litigation preparation, whether or not a lawyer created the material. The ruling does not make every AI prompt history immune; how far the protection reaches still turns on the governing rule and the role counsel played.

On waiver, the court took the standard from the two federal decisions the plaintiff cited rather than the authority the defendants leaned on. It agreed with Warner v. Gilbarco, Inc., No. 2:24-cv-12333, 2026 WL 373043 (E.D. Mich. Feb. 10, 2026), and Morgan v. V2X, Inc., No. 25-cv-01991-SKC-MDB, 2026 WL 864223 (D. Colo. Mar. 30, 2026), that work product is waived only by disclosure to an adversary, or in a way that substantially increases the chance an adversary obtains the material. Submitting material to ChatGPT, on that view, is not itself handing it to the other side. The court expressly rejected the defendants’ reliance on United States v. Heppner, No. 25-cr-503 (JSR), 2026 WL 436479 (S.D.N.Y. Feb. 17, 2026), the SDNY decision that drew national attention for finding a represented criminal defendant’s Claude exchanges unprotected.

The variables that decide these cases.

These four rulings have only begun to sketch the edges of a rule, and much of the apparent conflict eases once you separate the two doctrines in play. Attorney-client privilege protects confidential communications made to get legal advice, so it rises or falls on a reasonable expectation of confidentiality. Work product protects litigation-preparation material under the narrower waiver rule just described. The consumer-tool problem is mostly a confidentiality problem for privilege, but whether using AI waives work product is a different question. So far, the civil courts have not treated AI use alone as disclosure to an adversary.

Three variables do most of the work in predicting how a case comes out.

• The first variable is the tool’s terms. Judge Rakoff’s ruling in Heppner rested heavily on the defendant’s use of a consumer version of Anthropic’s Claude, whose terms let Anthropic collect prompts and outputs, use them for training, and disclose them to third parties, including regulators and in connection with claims, disputes, or litigation. With terms like that, the court found no reasonable expectation of confidentiality, which sank the attorney-client privilege claim. Warner and Morgan did not treat using an AI vendor as enough to waive work product; they asked whether the disclosure made adversary access materially more likely, and answered no.
   
• The second variable is direction. Heppner created his documents on his own initiative rather than at his lawyers’ direction, then handed them over afterward. That undercut the agency theory behind his privilege claim, and pre-existing, unprotected documents cannot be cloaked by routing them to counsel later. The cases that protected the work involved pro se or non-lawyer parties preparing their own litigation, where the work-product rules supplied the protection.
   
• The third variable is the governing standard. Texas Rule 192.5(a)(1) protects “material prepared or mental impressions developed” in anticipation of litigation “by or for a party,” which gave Judge Dorfman a cleaner textual path than the defendants’ agency-based argument. Federal Rule 26(b)(3) reaches party materials too, as Warner and Morgan note. But Heppner arose in a federal criminal posture and treated counsel’s direction and strategy as central to the work-product question. The forum’s exact language can decide the case, and counsel should not assume Heppner’s federal criminal reasoning travels to a state civil docket.

The courts protecting AI work leaned on the framing that a chatbot is a tool rather than a person, which is intuitive but glosses over the data-architecture point Heppner got right: a tool that sends your inputs to a vendor’s servers, where they can be stored and reused, is not the same as a word processor. Heppner, for its part, reads more broadly than its facts require. As a Harvard Law Review commentary noted, courts do not ask whether using Gmail or Google Docs to reach a lawyer defeats privilege, and a fact-specific analysis fits better than a near-categorical exclusion of AI. None of these decisions blesses a lawyer dropping privileged client material into a consumer chatbot.

The catch: protection doesn’t cover discovery inputs.

The most practical part of the Texas ruling is what it requires even after most of the conversations were held protected. Borrowing from Morgan, where Magistrate Judge Maritza Dominguez Braswell made the plaintiff disclose which AI platform he used, Judge Dorfman ordered the plaintiff to identify, by Bates number where applicable, all “discovery materials or products” it had shared with ChatGPT, including anything covered by the protective order. He also flagged possible protective-order violations and urged the parties to amend the order to spell out whether and how confidential information may go into an AI tool.

That requirement takes much of the shine off the win. Shielding the substance of the conversations does little good if a company must then admit it ran protective-order materials through a tool it never cleared. The disclosure can hand an adversary a protective-order fight and a partial map of what discovery went into the tool. And the broader trend runs the same way: in the OpenAI copyright litigation, the court compelled production of a 20-million-log de-identified sample of ChatGPT conversations over user-privacy objections, a reminder that relevant, retained AI logs are realistic targets in discovery once the safeguards satisfy a court.

What the rulings ask of a compliance program.

Each lesson traces to a fact that decided one of these cases.

Vet the tool’s data terms, not its marketing. Heppner turned on what a consumer tool’s terms allowed the vendor to do with the inputs. The terms worth checking run the other way: no training on your data; short or controlled retention with deletion rights; limits on subprocessors and third-party access; and no disclosure except to bound service providers or under legal process with notice where permitted. An “enterprise” label settles none of this. What matters is what the contract permits the provider to do with whatever your people type in.

Route AI-assisted legal work through counsel where privilege matters. Work product can protect a party’s own litigation preparation, especially under a rule as broad as Texas’s, but attorney-client privilege is sturdier when counsel directs the AI use and folds it into the advice. Heppner’s materials failed in part because he ran the searches himself and sent the output to his lawyers afterward, which could not turn unprotected documents into privileged ones. Where AI touches a matter, keep a record of who directed the work, why, and under what tool terms.

Treat discovery uploads as discoverable facts. The Texas ruling shielded most of the chats but still made the plaintiff disclose which materials it had shared with ChatGPT. Even when the prompt-and-response exchange is protected, a court can require disclosure of which produced documents went into the tool, especially where a protective order is in play. Bring AI conversations within legal-hold scope from the start, and favor tools that let you export, preserve when required, and delete when retention obligations end.

Write AI into protective orders before production begins. Both Morgan and Tate urged exactly this, and it is far cheaper to set the rule before confidential material moves than to litigate a suspected breach after. A workable clause says whether designated material may go into an AI tool at all; separates public consumer tools from approved enterprise or API environments; bars training and reuse; sets retention, preservation, and deletion terms; and controls subprocessors. It can also require a party using AI with protected material to certify compliance with those safeguards and retain documentation, with tool identity and relevant safeguards disclosed only by agreement, court order, or a reasonable good-faith compliance request tied to protected material actually submitted to such a tool.

Despite the lessons gleaned from these opinions, these issues are far from settled. All four are trial-court rulings, persuasive at most: Morgan is a magistrate judge’s discovery order, and Tate is a minute entry that says on its face it is not meant to be final. No court of appeals has weighed in, and the four span different settings, from a federal criminal case to a Texas state civil docket, so the first appellate decision could reshuffle any of these threads.

A blanket ban on all AI use is unlikely to hold, if only because the conduct is already everywhere. But a categorical ban on putting privileged, client-confidential, trade-secret, or protective-order material into unapproved public tools is getting hard to argue against. The line that protects a company is about data more than tools: keep that material out of any tool not on the approved list, and make sure everyone who touches a matter knows the rule. Underneath the headlines, the steadier pattern is that AI use does not by itself forfeit work product. The tool a company picks, the terms it secures, and the way it uses that tool decide whether the protection holds – and whether, having kept it, the company still has to tell its opponent what went in.