HR's Own Chatbot Use and Privilege: Why AI Investigation Prompts Are Discoverable

Pre-Flight Reality Check: Opposing Counsel Will Ask for Your Prompt Log

Standard employment discovery requests now demand every generative AI prompt, draft, and summary touching the plaintiff's termination. If you typed your reasoning into a consumer chatbot, plaintiff's counsel will read it aloud at your deposition.

Watch how fast a well-meaning solo HR director builds the plaintiff's best exhibit. At 7:30 p.m. on a Tuesday, an HR director finishes three witness interviews in a whistleblower retaliation complaint. Outside employment counsel emailed a confidential four-point legal analysis at 6:00 p.m. Feeling stretched thin, the HR director opens a personal ChatGPT or Claude browser tab and pastes counsel's bullet points alongside raw interview notes: "Help me draft a clean termination memo for Alex that emphasizes Q3 budget restructuring so it doesn't trigger the whistleblower issue our lawyer flagged."

Ten months later, Alex's lawsuit enters federal discovery. Plaintiff's First Request for Production of Documents includes Request No. 19: "All prompts, inputs, uploads, and outputs entered into or generated by any artificial intelligence or large language model tool by any HR, management, or executive custodian referencing Plaintiff, Plaintiff's complaint, or the termination decision."

Your company's privilege log will not save that Tuesday night chat. In fact, that single paste just caused two separate disasters: it created a timestamped, non-privileged draft proving pretext, and it exposed outside counsel's underlying legal advice to third-party waiver under Federal Rule of Evidence 502.

For the parallel governance trap—when the decision-maker or investigator has an executive conflict of interest—pair this protocol with our executive investigation conflict runbook.

What United States v. Heppner Changed in February 2026

On February 17, 2026, the Southern District of New York issued the nation's benchmark ruling on AI chats and legal privilege. Every HR leader and investigator needs to know all three pillars of Judge Rakoff's order.

In United States v. Heppner, No. 25-cr-0503 (S.D.N.Y. Feb. 17, 2026), U.S. District Judge Jed S. Rakoff ruled on an issue of first impression nationwide. After receiving a federal subpoena, the defendant used a consumer-grade version of Anthropic's Claude on his own initiative to analyze legal exposure and draft defense strategies—incorporating facts and legal points learned from his attorneys—and later shared those 31 AI prompt-and-response documents with defense counsel. Counsel asserted both attorney-client privilege and work-product protection.

Judge Rakoff granted the motion to compel all 31 files. Translate his three holdings directly into people operations rules:

1. Pillar 1 — A Chatbot Is Not a Lawyer (Nor Counsel's Agent Without Direction): Under Upjohn Co. v. United States, 449 U.S. 383 (1981), attorney-client privilege shelters confidential communications between a human client and a licensed attorney for the purpose of obtaining or rendering legal advice. Software holds no bar license. And unless outside or in-house counsel expressly directed the use of a vetted tool as an agent assisting legal representation (analogous to an accountant retained by counsel under United States v. Kovel, 296 F.2d 918 (2d Cir. 1961)), independent HR prompting is a non-privileged monologue with a vendor server.
2. Pillar 2 — Consumer AI Terms Destroy Confidentiality: Privilege requires a reasonable expectation of confidentiality. Sharing privileged counsel advice with an outside third party waives the privilege. Because consumer AI platforms reserve rights under their terms of service to log inputs, review conversations for trust/safety, or train models, typing counsel's advice into a consumer chatbot discloses confidential legal communications to a third party.
3. Pillar 3 — Sending Outputs to Counsel Later Does Not Create Work Product: Under Federal Rule of Civil Procedure 26(b)(3), work-product protection covers materials prepared in anticipation of litigation by or for a party or its representative acting under counsel's supervision. Generating AI drafts on your own and emailing the finished text to your lawyer afterward does not retroactively shield the underlying prompts.

The Second Trap: Ordinary-Course Investigation Waiver Under Faragher/Ellerth

Even an enterprise zero-data-retention AI tenant will not make routine workplace investigation files privileged. Understand which records you will eventually hand to a jury anyway before typing a single prompt.

Many IT teams assume buying an enterprise AI license with Zero Data Retention (ZDR) and a no-training Data Processing Addendum solves the privilege problem completely. Pause and separate two distinct legal concepts:

• Track A — Ordinary-Course Fact Investigations (Assume Discoverable): When HR investigates a harassment or discrimination complaint to satisfy Title VII duties, the employer almost always relies on that investigation later as its Faragher/Ellerth reasonable-care affirmative defense. Asserting the adequacy of an investigation waives privilege over the factual investigation file itself. Even inside a locked enterprise tenant, if an investigator prompts an enterprise LLM ten times to "soften witness #2's statement so the VP looks less culpable," enterprise audit logs preserve an unprivileged trail of biased editing.
• Track B — Counsel-Directed Legal Risk Assessments (Protectable Only Under Strict Controls): Separate from the neutral fact-finding report, in-house or outside counsel may conduct a privileged legal exposure analysis (evaluating litigation risk, settlement valuation, or OWBPA adverse-impact exposure). Track B stays privileged only if (1) counsel initiates and directs the work in writing for legal advice, (2) zero consumer tools touch the data, and (3) any AI processing runs strictly inside a counsel-approved, zero-retention, contractually confidential enterprise environment segregated from the general HR file.

Step-by-Step Runbook + Copy-Ready Red-Line Card

Install hard operational guardrails across your ER and HRBP seats today. Four bright-line rules stop inadvertent waiver before anyone opens a browser tab.

1. Gate 1 — Enforce the Five-Item "Never Paste" Ban: Prohibit all HR, ER, and management staff from ever pasting (a) attorney emails or memos, (b) named witness statements, (c) draft termination or RIF rationales, (d) ADA/FMLA medical details, or (e) executive board/comp decks into any consumer or personal AI tool.
2. Gate 2 — Segregate Fact Files from Legal Strategy: Keep neutral workplace investigation timelines factual, objective, and clean enough to hand to twelve jurors without embarrassment. Never ask any AI tool—enterprise or otherwise—to "reframe," "spin," or "minimize" inconvenient witness testimony.
3. Gate 3 — Require a Written Counsel Protocol Before AI Touches Contested Exits: If in-house or outside counsel permits using a locked-down legal or enterprise zero-retention AI tool during anticipated litigation, execute the written directive below before running a single query.
4. Gate 4 — Preserve Existing Prompt Histories Once a Dispute Surfaces: If you discover an HR generalist or manager already used a consumer chatbot on a now-contested termination, do not instruct them to delete their chat history—deleting non-privileged ESI once litigation is foreseeable triggers FRCP Rule 37(e) spoliation sanctions! Freeze it and call counsel immediately.

PRIVILEGED & CONFIDENTIAL — COUNSEL-DIRECTED AI PROTOCOL & HR RED-LINE CARD

SECTION A: ABSOLUTE "NEVER PASTE" LIST FOR CONSUMER / PERSONAL AI TOOLS
HR, Employee Relations, and People Managers may NEVER enter the following into any personal or public AI account (ChatGPT Free/Plus, Claude Free/Pro, Gemini Consumer, Perplexity, or unvetted browser plugins):
  [X] Emails, memos, edits, or verbal advice from in-house or outside legal counsel
  [X] Investigation interview notes, complainant/respondent names, or credibility assessments
  [X] Draft PIPs, involuntary termination rationales, severance calculations, or RIF selection tables
  [X] Employee SSNs, compensation data, medical/ADA/FMLA records, or immigration files

SECTION B: COUNSEL-DIRECTED WORK-PRODUCT ENGAGEMENT NOTE (COMPLETE BEFORE USE)
Matter Name / Ref: [Privileged Legal Review — Matter #YYYY-NN]    Date: [YYYY-MM-DD]
Supervising Attorney: [Name, Bar #, Title / Firm]
Assigned HR Representative: [Name & Title]

1. Purpose & Direction: Supervising Counsel hereby directs [HR Representative] to assist Counsel in gathering and formatting factual chronology data solely to enable Counsel to render confidential legal advice regarding anticipated litigation / agency proceedings in the matter above.
2. Approved Environment Only: Any computational or AI processing authorized hereunder MUST occur exclusively within [Enterprise Zero-Data-Retention Legal Workspace ID], governed by executed Corporate DPA #[Ref] prohibiting vendor retention, human review, and model training.
3. Segregation & Access: Outputs generated under this directive shall be stored exclusively in Restricted Legal Folder [Path], segregated from routine HRIS personnel files, and shared strictly on an Upjohn need-to-know basis.

Role Discipline Across HR, In-House Legal, and IT Security

Privilege fails at the seam between late-night HR drafting and shadow SaaS habits. Coordinate controls across AI and changing work so solo practitioners have an approved, safe workflow.