Does redacting before AI protect attorney-client privilege?

In February 2026 a federal judge in Manhattan ruled that about 31 documents a fraud defendant had written with Claude were open to prosecutors. Much of the coverage since then asks whether privilege survives AI at all. The question that reaches a law firm’s desk is narrower: does taking the names out first help?

It helps with some things, and not with the one in the title. Privilege is decided by who received a communication and why it was made. A redaction pass changes neither. Below is what it does change, using two 2026 rulings and the federal rules.

United States v. Heppner: what the court actually tested

Bradley Heppner had a grand jury subpoena and knew he was the target. On his own, he used Claude to prepare reports outlining his defense strategy, then shared them with his lawyers. FBI agents seized the documents along with his devices, and his counsel listed them on a privilege log.

Judge Rakoff applied the Second Circuit’s three-part test: a communication between client and attorney, kept confidential, for legal advice. The documents failed at least two parts, possibly all three. What a lawyer must tell the court about AI use is a separate matter, in our guide to AI disclosure in court filings.

Take each reason in the table and ask what a redaction pass would have touched. I count none, and that is why the answer above starts with no.

Does AI break attorney-client privilege? Identity versus advice

Privilege has always protected the conversation, not the facts inside it. In Upjohn, the Supreme Court quoted the rule plainly: a client may not refuse to disclose a relevant fact merely because the fact went into a message to the lawyer. The facts in your prompt were never the protected part.

What is protected is the exchange with counsel, above all the advice and the strategy behind it. A redaction tool looks for names, numbers and addresses. Legal advice carries none of those markers, so it passes through untouched, and it is exactly what a waiver argument goes after.

If an employee pastes that memo into a chatbot, I would worry far more about the second sentence than about the name. Upjohn also matters inside companies, because it extended privilege to employees’ answers to company counsel, so an AI acceptable use policy should name legal memos as a category of their own.

What destroys attorney-client privilege: third parties and vendor terms

Voluntary disclosure to a third party outside the relationship generally waives privilege; the Michigan court discussed below restated that rule from earlier cases. Heppner did not stop at calling Claude a third party, though. The court read the privacy policy Heppner had agreed to.

The version it cited, effective February 19, 2025, said Anthropic may disclose personal data to third parties in connection with claims, disputes or litigation, and to governmental regulatory authorities as required by law. So the court found no reasonable expectation of confidentiality. Footnote 3 went further: typing in privileged information waived it.

Redaction does nothing to those clauses. Before the next prompt I would want the plan’s terms open on screen, not the redaction settings, and we have compared them for Claude’s consumer and business plans.

The other three large providers write their own terms, and each has a guide of its own here:

A leak at the provider is also an insurance question, and policies differ on it; what cyber insurance does not cover lists the gaps that show up after a claim.

Insurers now ask about AI before they quote, and the AI section of a cyber insurance questionnaire asks about controls on these same accounts.

Is using ChatGPT a waiver of work product protection?

Work product is a separate shield with its own waiver rule. Federal Rule of Civil Procedure 26(b)(3) covers material prepared in anticipation of litigation by or for a party or its representative. If a court orders discovery of it anyway, the court must still protect the attorney’s mental impressions and legal theories.

On February 10, 2026, Magistrate Judge Anthony Patti in Detroit refused to order a pro se employment plaintiff to hand over her AI materials. Waiving work product, he wrote, takes disclosure to an adversary or in a way likely to reach one, and ChatGPT and similar programs “are tools, not persons.”

Rakoff ruled the other way from the bench that same day, and explained why in writing a week later, on different facts: a represented criminal defendant acting without his lawyers’ direction. Rakoff also openly disagreed with Shih v. Petal Card, a 2021 ruling from his own district that protected material no attorney had directed.

The split reads to me less like a conflict than a lesson in posture: who typed, and for whom. My guess is that clients drafting their own timelines paste whole files more than anyone, and cleaning a PDF properly first at least keeps other people’s numbers out of what gets seized.

Counsel-directed AI use and the Kovel question

For firms, the sentence in Heppner that matters most is a hypothetical. Had counsel directed Heppner to use Claude, the court wrote, Claude might arguably have worked like a lawyer’s agent, citing Second Circuit cases that go back to Kovel, where an accountant helped counsel. That sentence is dicta.

Direction is something a firm controls, unlike a provider’s privacy policy read after the fact. So the walk below starts with who typed, then asks about the terms, then about purpose. Redaction comes last, because that is its place in the analysis.

I would not build a firm workflow on that single sentence of dicta. A written instruction from counsel and a contracted account cost little now; arguing Kovel for a consumer chatbot later sounds far more expensive.

Since the Kovel agent was an accountant, the same question reaches the other side of that arrangement: CPA firms answer to a confidentiality rule of their own when AI enters the engagement.

For counsel who want no outside provider at all, a private model on the firm’s own servers is the other route, with its own costs.

Inadvertent disclosure and FRE 502: what the rule covers

Federal Rule of Evidence 502 is the rule people reach for after a mistake. Under subsection (b), an inadvertent disclosure is not a waiver if the holder took reasonable steps to prevent it and promptly to fix it. Its opening words limit it to a federal proceeding or a federal office or agency.

A paste into a chatbot between meetings is neither. Subsection (d) lets a federal court order that disclosure connected with the pending case is not a waiver. Whether that order should mention AI vendors is worth raising when it is drafted, not after.

Tracked changes are the textbook inadvertent disclosure, and they ride along into AI tools too; removing them for good takes a minute, and I would make it part of sending any draft anywhere.

When the paste has already happened, privilege is only one of the questions. Whether client data in a chatbot triggers a notice is covered in our guide on client data and breach duties.

ABA Formal Opinion 512: confidentiality is not privilege

Opinion 512, issued July 29, 2024, is the ABA’s main guidance on generative AI, and it mentions privilege only in passing. Its subject is the ethics duty in Model Rule 1.6, which reaches all information relating to the representation, regardless of its source. That is a wider net than any evidence rule.

That width is where redaction runs out. A fact pattern with every name removed is still information relating to the representation. The opinion’s example of a use needing no consent is idea generation without inputting such information, which is narrower than redacted input. Consent wording is in our engagement letter guide.

I keep the two columns apart because a firm can pass one and fail the other. A client’s informed consent does nothing for privilege in a later discovery fight, and a winning privilege argument does not excuse a missing consent.

What redaction does protect: other people’s data and what a seizure exposes

Redaction earns its place on a different ledger. The Heppner documents went to the government whole, and whatever names, account numbers or medical details sat in them went too. Fewer identifiers in a prompt means less exposure for the people in the file, whatever happens to privilege.

Some laws do treat removal as meaningful, with conditions attached. Our guide to de-identification under HIPAA and state law shows where removal changes a file’s legal status, and it never happens by deleting names alone.

If a firm asked me where to spend its redaction effort, I would point it at files full of other people’s identifiers, because there the edit changes a legal position and in privilege it doesn’t. A fuller list of what to remove goes well past names.

Social Security numbers are the identifier most often left in client paperwork, and taking one out before AI sees it has its own method.

Where Nonimo fits, and what it does not claim

Nonimo is an app that replaces client names and other identifiers in your text, on your own computer, before it goes to an AI tool, and writes them back into the reply. Each change shows on screen and can be undone. The mapping that restores them stays on that machine, as our security page explains.

Against the Heppner table, that covers none of the privilege elements: it doesn’t make a chatbot your lawyer or change a provider’s terms. It keeps identifiers out of what a provider stores and what an opponent could later read. I would rather say that plainly than see a placeholder sold as a privilege argument.

Where the firm’s own software calls a model, a similar step can sit in an AI gateway between the application and the provider.

Prompts are not the only exit in those applications; logs, retrieval and tool calls carry data too, as our guide to AI data leakage shows.

For a whole practice rather than one desk, I think the firm’s IT provider belongs in that conversation, and our partner page explains how they work with us.

Before the next prompt: what decides privilege and what redaction decides

Privilege is decided before anyone types: by who uses the tool, at whose direction, under which terms, and whether counsel’s advice goes in. Redaction decides something else, how much of other people’s data rides along. I would do both, and call only one of them privilege.

Two trial-level rulings from one February are thin ground, and an appeal or a ruling in your circuit could move it. Read this as a map of those cases, not advice on your matter. Matters abroad bring their own rules, starting with whether the EU AI Act reaches a US firm.

If the right-hand column is the part you want handled on every desk, Nonimo replaces identifiers on each attorney’s computer before a prompt leaves.

For rollout across a whole firm, see how we work with organizations.

Sources

• United States v. Heppner, No. 25 Cr. 503 (JSR), ECF No. 27 (S.D.N.Y., filed Feb. 17, 2026): the three privilege elements, the privacy policy, footnote 3 waiver, work product, the Kovel dicta, disagreement with Shih.
• Warner v. Gilbarco, Inc., No. 2:24-cv-12333, ECF No. 94 (E.D. Mich. Feb. 10, 2026): AI materials not discoverable, work product for a pro se party, waiver only toward an adversary, “tools, not persons” (pages 10 to 12 of the order, reproduced in a federal court conference packet).
• Anthropic, Privacy Policy, version effective February 19, 2025: the archived version Heppner cites, on disclosure in litigation and to regulators.
• Federal Rule of Evidence 502: scope of waiver, inadvertent disclosure, court orders, party agreements, definitions.
• Federal Rule of Civil Procedure 26: 26(b)(3) on trial-preparation materials and the protection of mental impressions.
• ABA Formal Opinion 512, Generative Artificial Intelligence Tools, July 29, 2024: confidentiality, informed consent, reading the provider’s terms (pages 6 and 7; read in the same packet, from the U.S. Court of Appeals for the Armed Forces).
• Upjohn Co. v. United States, 449 U.S. 383 (1981): privilege for employees’ communications with company counsel; facts versus communications (pages 395 and 396).

Checked on November 7, 2026.