United States v. Heppner: A Landmark Decision on AI and Privilege
On February 10 and 17, 2026, Judge Rakoff, of the United States District Court, Southern District of New York, issued an order marking the first time a federal court addressed the intersection of generative artificial intelligence (“AI”) and privileged information, finding that communications with publicly accessible AI platforms are not protected under either the attorney-client privilege or work product doctrine.
While this decision is one of first impression, many anticipate that other jurisdictions and courts will follow Judge Rakoff’s decision and reasoning. See e.g., Elizabeth E. Schlissel & Daryl T. Caffarone, Loose AI Prompts Sink Ships: How Heppner Shook the Legal Community, N.Y. St. B. Ass’n (Mar. 10, 2026); Stephen Embry, Hate to Say I Told You So Again: Your Chats Ain’t Private, Above the Law (March 2, 2026); Micaela McMurrough, Matthew Harden, & Bryan Ramirez, AI and Legal Privilege: Key Takeaways from U.S. v. Heppner, Inside Privacy (March 2, 2026); Pamela Langham, AI Platforms and Confidentiality: A Closer Look at United States v. Heppner, Md. State B. Ass’n (Feb. 25, 2026).
Accordingly, “the proper advice is that clients shouldn’t risk talking about their cases with AI.” Joe Patrice, Does Asking ChatGPT a Legal Question Make It Discoverable? It Depends!, Above the Law (Feb. 24, 2026).
Case Background
On October 28, 2025, a grand jury returned an indictment charging Defendant Bradley Heppner “with securities fraud, wire fraud, conspiracy to commit securities fraud and wire fraud, making false statements to auditors, and falsifying corporate records.” United States v. Heppner, 2026 U.S. Dist. LEXIS 32697, at *2 (S.D.N.Y. Feb. 17, 2026). “In connection with Heppner’s arrest…, [the FBI]… seized numerous documents and electronic devices.” Heppner, 2026 U.S. Dist. LEXIS 32697, at *3. Among the materials seized, there “were approximately thirty-one documents that memorialize communications that Heppner had with the generative AI platform ‘Claude,’ which is operated by the private company Anthropic.” Id., at *4.
“According to Heppner’s counsel, the documents represent communications between Heppner and Claude that took place ‘in 2025, after Mr. Heppner had received a grand jury subpoena [and] after it was clear with discussions with the government that Mr. Heppner was the target of this investigation.’” Heppner, 2026 U.S. Dist. LEXIS 32697, at *4. “Without any suggestion from counsel that he do so, Heppner ‘prepared reports that outlined defense strategy, that outlined what he might argue with respect to the facts and the law that we anticipated that the government might be charging.’” Id. (emphasis added). Heppner’s counsel asserted that Heppner “‘was preparing these reports in anticipation of a potential indictment.’” Id.
Heppner’s Assertion of Privilege
Heppner’s counsel “asserted privilege over these documents (the ‘AI Documents’), arguing that (1) Heppner had inputted into Claude, among other things, information that Heppner had learned from counsel; (2) Heppner had created the AI Documents for the purpose of speaking with counsel to obtain legal advice; and (3) Heppner had subsequently shared the contents of the AI Documents with counsel.” Heppner, 2026 U.S. Dist. LEXIS 32697, at *4–5 (emphasis added).
The Government disagreed and filed a motion for an order stating that these AI Documents were neither protected “by attorney-client privilege nor the work product doctrine.” Heppner, 2026 U.S. Dist. LEXIS 32697, at *5.
Judge Rakoff’s Attorney-Client Privilege Ruling
After noting the requirements for attorney-client privilege attachment, which only occurs in “‘communications (1) between a client and his or her attorney (2) that are intended to be, and in fact were, kept confidential (3) for the purpose of obtaining or providing legal advice,’” and that courts construe this privilege “narrowly,” the Court found that “the AI Documents lack at least two, if not all three, elements.” Heppner, 2026 U.S. Dist. LEXIS 32697, at *5–6.
First, Claude is not an attorney and the use of Claude, “like any other form of software” “cuts against the invocation of privilege because all ‘[r]ecognized privileges’ require, among other things, ‘a trusting human relationship…’” and “No such relationship exists, or could exist, between an AI user and a platform…” Heppner, 2026 U.S. Dist. LEXIS 32697, at *6–7 (brackets in original) (emphasis added).
Second, these communications were not confidential. Heppner, 2026 U.S. Dist. LEXIS 32697, at *7–8. “This is not merely because Heppner communicated with a third-party AI platform but also because the written privacy policy to which users of Claude consent provides that Anthropic collects data on both users’ ‘inputs’ and Claude’s ‘outputs.’” Id., at *7. Moreover, “Anthropic reserves the right to disclose such data to a host of ‘third parties.’” Id.
Thus, “AI users do not have substantial privacy interests in their ‘conversations with’” “‘publicly accessible AI platform[s] which users voluntarily disclosed’ to the platform and which the platform ‘retains in the normal course of its business’” especially when the privacy policies of these platform inform their users that they “may ‘disclose personal data to third parties in connection with claims, disputes, or litigation.’” Heppner, 2026 U.S. Dist. LEXIS 32697, at *8 (brackets in original omitted).
Third, while the Court noted this factor was a “closer call,” ultimately, “Heppner did not communicate with Claude for the purpose of obtaining legal advice” because “Heppner did not do so at the suggestion or direction of counsel” but rather “of his own volition.” Heppner, 2026 U.S. Dist. LEXIS 32697, at *8–9. It was of no import that “he later shared Claude’s outputs with counsel.” Id. at *9.
It is worth noting, however, that “[h]ad counsel directed Heppner to use Claude, Claude might arguably be said to have functioned in a manner akin to a highly trained professional who may act as a lawyer’s agent within the protection of the attorney-client privilege.” Heppner, 2026 U.S. Dist. LEXIS 32697, at *9 (emphasis added).
Judge Rakoff’s Work Product Doctrine Ruling
Similarly, the Court found that the AI Documents were not protected by the work product doctrine. Heppner, 2026 U.S. Dist. LEXIS 32697, at *10–14.
The “work product doctrine… ‘shelters the mental processes of the attorney’” and thus “‘provides qualified protection for materials prepared by or at the behest of counsel in anticipation of litigation or for trial.’” Heppner, 2026 U.S. Dist. LEXIS 32697, at *10.
Given that the AI Documents were “not ‘prepared by or at the behest of counsel,’” “nor did they reflect defense counsel’s strategy,” they did “not merit protection.” Heppner, 2026 U.S. Dist. LEXIS 32697, at *11, *14.
Heppner Takeaways
Heppner Takeaway # 1: AI Platforms Are Not Confidential Spaces
An individual’s use of AI platforms that are publicly available and whose terms of service permit model training, permit data retention, and/or provide notice that disclosure to third parties are likely to be found not confidential.
Accordingly, client should avoid using AI platforms to draft or analyze legal strategies, as these communications may be subject to discovery.
Heppner Takeaway # 2: A Client’s Communications with AI Platforms May Only Be Protected In Limited Circumstances
Judge Rakoff did not create a new privilege exception but rather applied settled doctrine to new technology. Thus, in order for privilege protections to apply, the client’s communications must involve direct participation or direction from legal counsel and be confidential.
A client’s independent communications with publicly accessible AI platforms, such as ChatGPT, Claude, or Gemini, even for legal purposes, do not meet these requirements. Rather, the client must be using the AI platform under the direction and supervision of counsel. And, as it was not at issue or discussed in Heppner, there is not clear guidance as to what extent attorney involvement and direction demonstrates requisite participation in order to gain privilege protections.
Moreover, these communications also must be confidential. As highlighted in the first takeaway: using publicly available AI platforms are likely not confidential.
Given the foregoing, “the proper advice is that clients shouldn’t risk talking about their cases with AI.” Joe Patrice, Does Asking ChatGPT a Legal Question Make It Discoverable? It Depends!, Above the Law (Feb. 24, 2026).
However, in the event a client communicates with an AI platform at the direction and under the supervision of counsel, counsel’s involvement and direction should be well documented.
Consulting Attorneys for AI Guidance
This decision reinforces the importance of understanding the legal implications of emerging technologies. As AI use continues, attorneys and clients alike must remain vigilant in safeguarding privilege and confidentiality.
Navigating the complexities of the intersection of generative AI and the law can be daunting, which is why consulting with experienced attorneys is essential. Shelby and her colleagues at Pia Hoyt are here to help!
Contact our offices for more information.
