Are AI Meeting Notes Protected Work Product? The Heppner–Warner Split and What It Means for Your Confidential Calls

If you use Otter, Fireflies, Zoom AI Companion, or any other cloud AI notetaker in confidential business meetings, the answer to whether your AI-generated meeting notes are protected work product just got more complicated — and more dangerous. On February 10, 2026, two federal courts issued opposite rulings on the same day. In United States v. Heppner, Judge Jed Rakoff of the Southern District of New York stripped both attorney-client privilege and work-product protection from a defendant's Claude prompts. The same day, in Warner v. Gilbarco, an Eastern District of Michigan magistrate judge reached the opposite result on the work-product question. For executives, in-house counsel, and any professional running AI on a confidential call, the practical answer is unforgiving: assume cloud AI meeting notes are discoverable unless the audio never leaves your device.

The Two Rulings That Split the Federal Bench

The same Tuesday in February 2026 produced two of the most important AI-discovery rulings to date. In United States v. Heppner, decided February 17, 2026 with a bench ruling on February 10, the Southern District of New York held that a criminal defendant's written exchanges with a "publicly available AI platform" were not protected by attorney-client privilege or work product doctrine. The ruling appears to be the first federal decision squarely addressing privilege claims for communications with a generative AI platform.

A week earlier — and on the same day as Rakoff's bench ruling — Magistrate Judge Anthony P. Patti of the Eastern District of Michigan reached the opposite conclusion. According to Paul, Weiss, Judge Patti ruled that work product protection applied to materials generated by a third-party AI tool prepared by a pro se plaintiff. In his words, generative AI programs "are tools, not persons," and a contrary holding "would nullify work-product protection in nearly every modern drafting environment, a result no court has endorsed."

Why Heppner Lost

Bradley Heppner, founder of Beneficient and former chairman of GWG Holdings, faced federal securities and wire fraud charges. After receiving a grand jury subpoena, he used the consumer version of Claude — on his own, without counsel's direction — to generate documents analyzing his potential defense. As STACK Cybersecurity's case analysis describes, Judge Rakoff identified three independent grounds on which privilege failed, any one of which would have been sufficient.

First, Claude isn't an attorney — all recognized privileges require "a trusting human relationship" with "a licensed professional who owes fiduciary duties and is subject to discipline." Second, the privacy policy destroyed any expectation of confidentiality. Gibson Dunn's analysis highlights the court's emphasis on Anthropic's policy disclosing that the platform "collects users' 'inputs' and 'outputs,' uses that data to 'train' its model, and reserves the right to disclose such data to multiple categories of 'third parties,' including the government." Third, Heppner did not use Claude at counsel's direction, so the work-product doctrine — which protects materials prepared by or at the direction of counsel — did not apply.

Why Warner Won

Sohyon Warner, a pro se plaintiff in an employment discrimination case against Gilbarco and Vontier Corporation, admitted to using ChatGPT to answer legal questions and draft filings. Defendants moved to compel "all documents and information concerning her use of third-party AI tools in connection with this lawsuit." Judge Patti denied the motion. As Cleary Gottlieb's analysis explains, he held that under Sixth Circuit law, disclosing information to ChatGPT did not constitute a waiver of work-product protection because such waiver requires disclosure to an adversary or in a manner likely to reach an adversary's hands.

The court rejected defendants' theory as a "fishing expedition" based on "speculation about what might exist in Plaintiff's internal drafting processes." Critically, as Kirkland & Ellis observed, Judge Patti characterized the defendants' theory as one that, if accepted, "would nullify work-product protection in nearly every modern drafting environment."

How the Two Rulings Diverged

The two opinions differ on three doctrinal axes. The table below maps the contrast:

The Heppner Conviction: From Doctrine to Evidence

Heppner is no longer just a privilege ruling — it is a conviction. On May 7, 2026, Bradley Heppner was found guilty by a federal jury on all counts following a three-week trial, and his unprivileged consumer AI prompts were officially introduced by prosecutors as active evidence during the proceedings. Sentencing by Judge Rakoff is scheduled for October 7, 2026, with Heppner facing a maximum of 20 years in prison on each fraud count.

The procedural lesson is itself a warning. As STACK Cybersecurity's case file notes, the government learned about the AI documents because during pretrial discovery, defense counsel produced a privilege log entry describing the materials as "artificial intelligence-generated analysis conveying facts to counsel for the purpose of obtaining legal advice." That description flagged the materials for prosecutors, who then moved to compel production. Heppner is now the first reported federal conviction in which a defendant's consumer AI prompts were entered into evidence over a defeated privilege claim.

Why This Matters Beyond Litigants — Every Confidential Meeting Is at Risk

The Heppner reasoning is not confined to chatbots. It applies with equal force to any AI tool that processes confidential content under terms of service that reserve rights to log, train on, or disclose data. Cloud AI meeting notetakers — Otter, Fireflies, Fathom, Zoom AI Companion, Microsoft Teams Copilot — all fit that description to varying degrees. Otter.ai's privacy policy grants the company broad rights to process audio. Fireflies' privacy policy describes cloud storage and third-party processors. Under Heppner's reasoning, sending an attorney-client conversation or sensitive board discussion through any of these tools could waive privilege the moment the upload begins.

The OpenAI Preservation Order Makes It Worse

Even "deleted" cloud conversations may not be gone. According to OpenAI's own statement on the NYT data demands, a federal magistrate judge in The New York Times v. OpenAI ordered OpenAI to preserve consumer ChatGPT and API content that would otherwise be removed within 30 days. While ChatGPT Enterprise customers with Zero Data Retention agreements were exempt, ChatGPT Free, Plus, Pro, and Team users were subject to the preservation order. As The Hill put it, "privacy policies are not self-enforcing and, in many cases, they are not even binding" — a court order can override a vendor's published retention promise overnight.

Then in January 2026, the same SDNY court upheld a discovery order requiring OpenAI to produce 20 million de-identified ChatGPT user logs. As the National Law Review's analysis emphasizes, "AI conversation logs are discoverable electronically stored information," and organizations should treat conversational AI data as a discoverable record category. The same principle applies to AI meeting transcripts.

Does Enterprise AI Save You?

Maybe. Judge Rakoff expressly noted in Heppner that enterprise AI platforms may give rise to a reasonable expectation of confidentiality that consumer tools do not. Enterprise AI tools typically include contractual commitments not to train on user data, defined data segregation and retention practices, and explicit confidentiality terms. The ruling applied specifically to the free, publicly available version of Claude.

But — and this is critical — no court has yet ruled that enterprise AI use preserves privilege. Whether enterprise-tier tools would reach a different result remains an open question. And in late April 2026, a clear division emerged in federal jurisprudence, with multiple courts across different jurisdictions rejecting a blanket implementation of the Heppner reasoning, opting instead for a highly fact-specific approach. The boundaries of AI-driven legal privilege will continue to be litigated aggressively throughout 2026. Meanwhile, your boardroom calls and client meetings keep happening.

The State Bar Response: Lawyers Now Have Affirmative Duties

Bar associations have moved fast. According to the Illinois 2Civility commission's May 2026 guidance, AI notetakers, transcription tools, and meeting summaries can record and store attorney-client conversations, raising confidentiality and privilege risks. Under ethical rules, Illinois lawyers must perform a reasonable assessment of third-party AI vendors, including their data storage, access, retention, and model training practices.

The implications go beyond lawyers. Under Article 5 of the GDPR, organizations must minimize data processing and ensure storage limitation. Under the HIPAA Privacy Rule, any AI vendor processing PHI must sign a Business Associate Agreement and meet Security Rule requirements. Cloud meeting notetakers used in clinical conversations without these safeguards face real exposure.

The Late-April 2026 Jurisprudence Split: It's Getting Messier

Heppner and Warner v. Gilbarco are no longer the only data points. In late April 2026, additional federal courts rejected a blanket implementation of the Heppner reasoning. As STACK Cybersecurity's updated analysis documents, several judiciaries have reasoned that when an unrepresented individual uses an AI tool to format arguments or refine drafts, the platform acts more like a sophisticated extension of a traditional cloud word processor rather than an independent third party.

The result is what Sergenian Law's analysis calls a "genuine disagreement between two federal district courts on two distinct questions" — first, whether work-product waiver requires disclosure to an adversary versus any third party, and second, whether AI platforms are themselves "third persons" within that doctrine at all. Until the appellate courts or the Supreme Court resolve this, every confidential meeting recorded through a cloud AI tool is a controlled experiment in waiver doctrine.

How Basil AI Solves This: On-Device Eliminates the Third Party

The cleanest legal posture for confidential meeting capture is to eliminate the third-party vendor from the analysis entirely. That is what on-device transcription does. Basil AI processes audio using Apple's Speech framework running locally on the Neural Engine of your iPhone, iPad, or Mac. Audio never leaves your device. Transcripts are stored in your Apple Notes and iCloud — your data, under your account, subject to Apple's privacy architecture — not a vendor's discoverable database.

Compare the architectures across the dimensions Heppner actually analyzed:

This is not a theoretical advantage. The Heppner court's confidentiality finding rested on the AI platform's privacy policy permitting data collection, training, and third-party disclosure. Remove the platform from the architecture and the entire confidentiality analysis changes — there is no "third party" to whom disclosure was made, no privacy policy reserving disclosure rights, and no vendor that could be served with a preservation order or subpoena.

Practical Steps for Executives, Counsel, and Compliance Officers

What should you do today?

1. Map your AI meeting tools. Inventory every AI notetaker, transcription tool, or meeting recap feature your organization uses. Note the vendor's privacy policy, retention periods, training rights, and whether enterprise ZDR agreements are in place.
2. Disable AI notetakers on privileged calls. Until appellate guidance clarifies the Heppner–Warner split, treat any conversation involving legal advice, M&A strategy, personnel matters, or regulatory issues as off-limits for cloud AI.
3. Update litigation holds and protective orders. Add AI prompts, outputs, and locally saved AI interaction records to preservation protocols, as Kirkland & Ellis recommends.
4. Move sensitive capture on-device. For meetings where you genuinely need notes — and that's most of them — use on-device transcription that keeps audio and transcripts on the participant's hardware, not a vendor's cloud.
5. Train employees. Many cloud AI features are enabled by default in Microsoft Teams, Zoom, and Google Meet. People need to understand what's recording, where it's going, and what happens if a court later orders production.

For further reading on the related discovery risk for executives, see our earlier piece on whether AI chatbot conversations are discoverable for corporate executives. For lawyers specifically navigating state bar requirements, our buyer's guide for AI notetakers for lawyers walks through the ABA, NYC Bar, and Boston Bar guidance. And for a head-to-head on the architecture that drives this risk, see our Granola vs. Basil bot-free vs. on-device comparison.

The Bottom Line

The Heppner–Warner split is not academic. One ruling has already produced a conviction. The other has been narrowed by subsequent late-April 2026 fact-specific decisions. The trajectory points the same direction: cloud AI tools are increasingly being treated as third-party recipients whose terms of service can defeat confidentiality. The simplest, most defensible answer for any professional capturing confidential meetings is to never put the audio in a vendor's cloud in the first place. On-device transcription is the only architecture that makes the question go away.

Take Your Confidential Meetings Off the Cloud

Basil AI processes audio entirely on-device using Apple's Neural Engine. No vendor receives your meeting audio. No subpoena target outside your control. No privacy policy reserving disclosure rights.