On June 4, 2026, Justice Rhonda E. Fischer of the Supreme Court, Nassau County, quashed a subpoena that sought to pull a litigant’s ChatGPT history out of OpenAI’s servers. The plaintiffs in Assini v. Hayward, 2026 NY Slip Op 26086 (Sup. Ct. Nassau County June 4, 2026), a dispute among members of a lending company, had served OpenAI OpCo, LLC with a subpoena demanding every prompt, upload, and output that a pro se defendant, John Recchio, used to draft his filings, along with anything in his account referencing the parties, the company, or the claims and defenses. The court refused to enforce it, holding that the materials were protected litigation-preparation work.
In March I wrote about United States v. Heppner, the first federal decision to address AI and the work product doctrine head-on, and argued that its work product holding adopted a view of the doctrine narrower than the weight of authority supports, and that later courts should not treat that formulation as settled. Assini is one of three civil decisions in the last four months that have taken up the question and come out the other way. Read together, they begin to mark a line. The line is not quite the one the courts say they are drawing, and the reasoning they use to reach it imports a test that does not belong in the work product analysis.
What the court did
The procedural path was tangled. Recchio sought the same relief twice, once by motion and once by order to show cause. The court denied the order to show cause because he never filed proof of service, a jurisdictional defect under New York practice, and reached the merits through the motion to quash. The plaintiffs cross-moved to enforce the subpoena and for sanctions, characterizing Recchio’s AI interactions as relevant evidence bearing on the claims and on his own factual assertions.
Justice Fischer began with the governing framework. CPLR 3101(a) requires full disclosure of all matter material and necessary to the prosecution or defense of an action, the party seeking disclosure must show that the discovery will produce relevant evidence, and the burden of proving each element of a privilege rests on the party asserting it. Materials prepared in anticipation of litigation receive a conditional privilege under CPLR 3101(d)(2), immune from disclosure unless the requesting party shows substantial need and an inability to obtain the substantial equivalent without undue hardship.
The plaintiffs relied on Heppner for the proposition that a litigant’s self-directed AI use is not privileged. Recchio relied on Morgan v. V2X, Inc., No. 25-cv-01991-SKC-MDB (D. Colo. Mar. 30, 2026), a then-recent decision holding that a pro se litigant’s use of AI for litigation preparation resembles the confidential, iterative, strategy-laden work product that Federal Rule of Civil Procedure 26(b)(3) was designed to protect. The court found Morgan persuasive and quashed the subpoena.
Having protected Recchio’s AI history from his adversary, the court then faulted his AI use, observing that it “has not gone unnoticed” and that his “use of AI frustrates the litigation” and “cannot go unfettered,” quoting Augustin v. Formula 3 Brooklyn, Inc., 2025 NY Slip Op 51113(U) (Sup. Ct. Kings County 2025). It referred Recchio to 22 NYCRR Part 161, the Unified Court System’s rule on the use of artificial intelligence technology, effective June 1, 2026, and warned that failure to comply could result in sanctions. The same order carried two messages: the AI process is confidential, and the AI use is a problem.
A split along the wrong axis
The three civil decisions share a posture and a result. In Warner v. Gilbarco, Inc., No. 2:24-cv-12333 (E.D. Mich. Feb. 10, 2026), a magistrate judge denied a defense motion to compel “all documents and information concerning [the plaintiff’s] use of third-party AI tools,” holding that the request sought non-discoverable material, was disproportionate, and in any event reached work product that a pro se litigant may assert. Using ChatGPT—“tools, not persons,” in the court’s words—was not disclosure to an adversary and did not waive. The court protected both sides’ thought processes and ordered production of neither. One week later, Heppner, 2026 WL 436479 (S.D.N.Y. Feb. 17, 2026), held that a represented criminal defendant who used Claude on his own initiative, without his lawyers’ direction, could not claim work product over the results. Morgan then held that Rule 26(b)(3) protects a pro se litigant’s AI-assisted mental impressions and distinguished Heppner. Assini followed Morgan.
The civil courts describe the division as one between civil and criminal cases. Morgan distinguished Heppner on the ground that Heppner was a criminal matter governed by different rules, and Assini repeated the point. The distinction is convenient, and I do not think it is the operative one. Read the four opinions on their facts, and the variable that separates them is not the civil-criminal divide but who was driving the AI. In Heppner, the AI user was a represented defendant who turned to Claude on his own initiative rather than at his lawyers’ direction, and the holding turned on that gap between party and counsel rather than on the criminal setting. (Heppner shared the outputs with his lawyers and said he used Claude to prepare for conversations with them, which the court found insufficient because counsel never directed the use.) In Warner, Morgan, and Assini, the AI user was a self-represented litigant who was, at once, the party and the advocate. Morgan said as much: a pro se litigant “is simultaneously the party and the advocate,” so no gap exists. The cases line up on whether the person at the keyboard occupied the advocate’s role, not on the docket they were litigating.
That reframing exposes the case the civil decisions have not resolved. The scenario most lawyers will encounter is a represented civil client who opens ChatGPT on a weeknight, works through his dispute on his own, and then forwards the output to his lawyer or never mentions it. Heppner is the closest decision on point, and it denied protection, but it was a criminal ruling that binds no civil court and rests on a rationale those courts have rejected. Morgan did not merely set Heppner aside as criminal; it held that conditioning work product on the involvement of counsel “finds no support in the rule’s text,” a principle that protects a party’s own preparation and is not confined to pro se litigants. The represented client therefore sits between two rules: Heppner’s, that materials a party prepares without counsel’s direction are not work product, and Morgan’s, that a party’s own litigation-preparation materials fall within Rule 26(b)(3) regardless of counsel. The line to watch runs elsewhere: whether a court extends Morgan’s principle to a represented party, or reads Heppner to deny it. Heppner, whose defendant shared his AI work with counsel and still lost, shows what is at stake if courts take the narrower path.
Borrowing the wrong test
The civil courts reach a defensible result, but the rationale they lean on hardest does not support it. Morgan’s most quotable passage holds that “it is entirely reasonable for a person to expect some privacy and confidentiality when interacting with these tools, even though they understand a third party is behind the tool collecting and storing their information.” The court built that conclusion on Fourth Amendment cases: United States v. Warshak, on a reasonable expectation of privacy in email stored with a provider, and Carpenter v. United States, on the principle that information held by a third-party intermediary does not automatically lose its privacy protection. Morgan acknowledged that the Fourth Amendment “offers a wholly different legal framework from the work product doctrine,” then used the privacy principle anyway, calling it “informative.” Assini quoted the expectation-of-privacy language as though it stated the holding.
Work product protection does not turn on whether the preparer reasonably expected privacy. It turns on whether the material was prepared in anticipation of litigation and, for waiver, on whether it was disclosed to an adversary or in a manner that substantially increased the likelihood an adversary would obtain it. The civil courts had the right rule available and used it: disclosure to ChatGPT, a tool rather than a person, is not disclosure to an adversary, and the voluntary disclosure to a third party that waives the attorney-client privilege does not by itself waive work product. Warner rested on that distinction, citing United States v. AT&T and the Sixth Circuit’s recognition in In re Columbia/HCA Healthcare Corp. that the two protections waive on different terms. That analysis decides the case without any privacy intuition drawn from the law of searches and seizures.
The privacy framing is not a harmless flourish, because it reopens the inquiry I criticized Heppner for botching in the other direction: a fact-bound assessment of what the provider’s terms permit, what the user configured, and how likely a human is ever to read the conversation. Tie a litigant’s work product protection to the reasonableness of his privacy expectations, and the next adversary has a roadmap. Show that the user accepted terms allowing training and human review, that he never opted out, and that the provider retains consumer chats for years, and the “reasonable expectation” starts to wobble. The waiver rule does not wobble, because it does not depend on the provider’s data practices at all. The civil courts arrived at a sound result and propped it on the weaker of their two grounds.
What Assini left out
Even granting that AI-assisted litigation preparation can be work product, Assini did not do the work its own framework required. Justice Fischer recited the New York standard, that the conditional privilege under CPLR 3101(d)(2) covers materials prepared “solely in anticipation of litigation” and that the burden rests on the party claiming it, then applied neither part. The opinion does not ask whether Recchio’s prompts were prepared solely for the litigation, as opposed to the ordinary business of running the disputed company, or whether he carried his burden to show it. It does not reach the second half of the conditional privilege, under which even qualifying materials must be produced when the requesting party shows substantial need and undue hardship. It finds Morgan persuasive and quashes.
Morgan, by contrast, did the analysis. It applied the burden-shifting that work product requires: once the requesting party shows relevance, the burden shifts to the party resisting discovery to establish protection. And it held that the plaintiff failed to carry that burden as to one of the items he sought to shield, the identity of the AI tool itself, which the court ordered him to disclose. Assini borrowed Morgan’s conclusion without Morgan’s method, quashing a subpoena in its entirety where Morgan had granted protection in part and compelled disclosure in part. A trial court order that will be cited as the first state-court decision on AI discovery would have been more durable had it engaged the standard it announced.
The strongest case for the other side
I want to be careful not to overstate the criticism, because the plaintiffs in Assini had a better argument than the parties seeking AI discovery in Warner and Morgan, and the doctrine leaves room for it. Work product shields a litigant’s thoughts and litigation strategy. It does not shield underlying facts, party admissions, or evidence of fabrication, and a litigant cannot take a discoverable fact, type it into ChatGPT, and convert it into immune material. The Assini subpoena was not aimed only at Recchio’s strategy. Its first category sought the prompts and outputs used to generate the filings, motions, and sworn statements actually submitted to the court. Where a party’s sworn statement may have originated as a machine’s fabrication rather than the party’s own knowledge, the authenticity and candor of the filing are squarely in issue, and the adversary has a real interest in the source.
The Warner court itself drew the relevant line. It denied a sweeping demand for “all documents and information concerning [the plaintiff’s] use of third-party AI tools,” and stressed that the defendants had no evidence she had done anything improper, agreeing with her that the request was a “fishing expedition.” A narrow, predicated request for the AI provenance of specific sworn statements is a different animal from a roving demand for a litigant’s entire account history. New York practice supplies tools for that middle ground: a court can order in camera review, or require a privilege log identifying what is withheld and why, rather than quash outright. Assini ordered neither. The result may well be right on the facts Justice Fischer had, including a pro se defendant whose filings the court itself found troubling. The wholesale quash, with no in camera look at the prompts that became sworn filings, gives the resisting party more than the doctrine requires and more than Morgan gave.
The platform is the soft target
One feature of Assini separates it from the federal cases and points to where this is heading. The discovery demands in Warner and Morgan ran to the litigant: produce your AI materials, identify your tool. The demand in Assini ran to OpenAI. The plaintiffs went around Recchio and subpoenaed the platform that holds his data, and Recchio had to learn of the subpoena and move to quash under CPLR 2304 to stop it. He did, and a quirk of the record nearly cost him the protection: his order to show cause was dismissed for lack of proof of service, and only his separately filed motion preserved the merits.
That is the practical exposure. As I detailed in the Heppner post, the major providers retain consumer prompts and outputs for months or years unless the user has opted out, and a consumer account holder is the data controller’s subject rather than its customer. The work product protection these civil courts recognize is good against a party who demands the materials in discovery. It is only as good as the user’s vigilance against a subpoena to the platform, which the user may never see in time to object. A litigant who treats a chatbot as a private thinking space is relying on a protection that has to be asserted, on a short clock, against a third party with no stake in protecting him.
The protection, even when it holds, does not reach the conduct. The same order that shielded Recchio’s prompts referred him to Part 161 and warned that his AI use could be sanctioned. Confidentiality attaches to how a litigant prepares; accountability attaches to what he files. A court can keep an adversary out of your ChatGPT history and still sanction you for the hallucinated citation that history produced.
This post draws on Assini v. Hayward, 2026 NY Slip Op 26086 (Sup. Ct. Nassau County June 4, 2026); Morgan v. V2X, Inc., No. 25-cv-01991-SKC-MDB (D. Colo. Mar. 30, 2026); Warner v. Gilbarco, Inc., No. 2:24-cv-12333 (E.D. Mich. Feb. 10, 2026); United States v. Heppner, 2026 WL 436479 (S.D.N.Y. Feb. 17, 2026); and 22 NYCRR Part 161, Use of Artificial Intelligence Technology, effective June 1, 2026. It builds on prior posts on privilege and the consumer chatbot after Heppner and the anatomy of an AI-contaminated filing.