Recent court decisions in the United States and in the European Union have highlighted limitations on the scope of privilege protections, particularly when conducting internal investigations on behalf of corporate clients. These cases remind lawyers and companies to be disciplined in protecting privilege when conducting investigations and providing legal advice. They also highlight nuances and differences in privilege law across jurisdictions, and the importance of understanding privilege implications in cross-border investigations.
Recent decisions on U.S. privilege protections
The United States typically has strong privilege protections compared with other jurisdictions, but recent case law suggests counsel should not take these protections for granted. The U.S. Court of Appeals for the Sixth Circuit issued a highly anticipated ruling in In re FirstEnergy Corp. No. 24-3654 (6th Cir. Oct. 3, 2025). The Court vacated a lower court order that FirstEnergy, a utility company, had to disclose all documents related to internal investigations by outside counsel in a massive public corruption case.
The appellate court reaffirmed long-standing attorney-client and work-product privilege protections, emphasizing that when communications with counsel are for securing legal advice, privilege applies regardless of whether the advice was later used to make business decisions. The court also affirmed that work-product privilege applies where materials were created by counsel as part of an investigation in anticipation of litigation or regulatory enforcement, emphasizing that such work product does not merely recite facts, but contains analyses by counsel that render it protected.
Recent decisions on EU and French privilege protections
General texts such as the Charter of Fundamental Rights of the European Union guarantee respect for an individual’s private life, and EU case law favors the protection of legal privilege covering lawyers’ defense activity and legal advice (see CJEU, 26 September 2024, Case C-432/23).
But in some member states, case law applies a less protective standard. According to the German Federal Constitutional Court (2 BvR 1287/17, 2 BvR 1583/17, 27 June 2018), legal privilege doesn’t protect lawyers’ documents from seizure or disclosure unless criminal proceedings involving the client are pending.
In France, the criminal and regulatory authorities take a very strict position. The Financial Prosecutor’s Office and the French Anti-Corruption Agency stated in March 2023 in their Guidelines relating to internal anti-bribery investigations that documents drafted as part of an internal investigation (including the final report) are not protected by any professional secrecy (including the legal privilege), which triggered opposition from the French National Bar Council.
For the past few years, and notably in a decision dated 30 September 2025 (Cass. crim., 30 September 2025, No. 24-85.225), the French Court of Cassation has ruled several times that, during seizures in criminal proceedings, legal privilege protects only documents relating to the exercise of the rights of defense. The Court defines these documents as those relating to legal proceedings or proceedings aimed at imposing a penalty, which may include criminal, regulatory, or civil penalties.
In criminal proceedings, lawyers’ consultations (memos, advice, and so on) would only be protected from seizure when the person is being prosecuted, expects to be prosecuted in the near future or, knowing that they have committed an offense, is preparing their defense. Importantly, a lawyer’s advice for the purpose of assessing risks and making recommendations would not be protected unless the advice were part of a defense strategy in criminal proceedings.
The United States typically has strong privilege protections compared with other jurisdictions, but recent case law suggests counsel should not take these protections for granted.
One can assume the Court would adopt the same view about lawyers’ internal investigations reports. Interestingly, the In re FirstEnergy Corp. case could have led to a similar solution in France, because the company reasonably anticipated regulatory or criminal enforcement “in the near future”.
Which privilege law applies?
Given these potentially important differences between European countries’ laws and U.S. laws on privilege, it’s worth considering which privilege law could apply.
Under U.S. law, there are three tests to determine which jurisdiction’s privilege law applies in a cross-border investigation. The majority test is the touch-base test, under which American privilege laws will govern any communication “touching base” with the United States. Other courts may use the most direct and compelling test, in which they would look to which jurisdiction has the most direct and compelling interest in public disclosure of the communication. Finally, courts may apply the comity plus function approach, under which the U.S. court would consider the foreign jurisdiction’s privilege rules under principles of comity and look at the participants in the communication to determine whether their functions are similar to that of attorneys under U.S. law.
In the EU, because there is limited EU law covering the question of legal privilege, this question is mainly governed by the law of each member state. Therefore, the analysis of the applicable rules regarding legal privilege and the level of protection depends on the laws and court decisions of each member state. This requires a case-by-case approach in cross-border investigations.
Generally, one should keep in mind that it may be harder to invoke the legal privilege protection of a given country if documents are seized in a foreign entity of the company. As such, one should take a cautious approach when sharing documents produced by lawyers for one entity of a company to entities abroad.
How to preserve privilege claims
In light of recent case law, we recommend a cautious approach when deciding whether to conduct an internal investigation and how to structure it. Specifically, counsel should consider whether in some EU jurisdictions the resulting work may be seized and used by authorities in legal proceedings – or, in the United States, ordered produced – if careful steps aren’t taken to protect applicable privileges.
When conducting internal investigations, consider these steps:
- As a threshold matter, assess whether an internal investigation is advisable, considering factors such as whether legal proceedings are ongoing or reasonably expected, and whether mandatory internal investigation requirements exist in some jurisdictions (for example, the European Union has such requirements regarding whistleblowing alerts).
- Retain outside counsel to strengthen privilege protections and state in engagement letters that the purpose of the work is to provide legal advice.
- Label documents and communications “Attorney-Client Privileged” or “Attorney Work Product” in the United States, or in France for example, explicitly state that they are being prepared for the exercise of the rights of defense.
- Ensure that counsel conducting the investigation in the European Union is directly mandated by the entity subject to ongoing or expected legal proceedings. If the investigation is conducted to benefit another entity, the protection offered by the legal privilege might be weakened. In the United States, sharing investigation findings with any third party should be carefully analyzed for potential waiver concerns.
Additionally, the conduct of the internal investigation should be carefully framed and organized:
- Establish a restricted list of people (as limited as possible) who are within the company and who may participate and have access to information about the investigation.
- Do not circulate any information relating to the internal investigations outside attorney-client exchanges.
- Consider whether and how to prepare a final report in the most sensitive cases and, in all events, limit access to and communication of the report as much as possible.