Federal Ruling on AI and Attorney-Client Privilege Raises New Risks for Lawyers and Clients

A federal judge’s ruling in United States v. Heppner has become an early warning for lawyers, clients, and companies using generative artificial intelligence in legal matters: conversations with public AI chatbots may not be protected by the attorney-client privilege or the work-product doctrine.

The February 17 decision by U.S. District Judge Jed S. Rakoff of the Southern District of New York held that written exchanges between criminal defendant Bradley Heppner and Anthropic’s AI platform Claude could be reviewed by prosecutors. The ruling addressed what the court described as a question of first impression: whether a person’s communications with a publicly available AI platform, made in connection with a pending criminal investigation, are protected by traditional legal privileges. Judge Rakoff’s answer was no.

The ruling came before Heppner’s trial on securities fraud and wire fraud charges tied to GWG Holdings, a publicly traded company where he had served as chairman. According to the U.S. Attorney’s Office, a jury convicted Heppner on May 7, 2026, after a three-week trial of securities fraud, wire fraud, conspiracy to commit securities fraud and wire fraud, and making false statements to auditors. Sentencing is scheduled for October 7, 2026.

The privilege dispute arose after FBI agents searched Heppner’s home and seized electronic devices. Among the materials were roughly 31 documents memorializing exchanges between Heppner and Claude. Heppner’s lawyers argued that the documents were protected because Heppner used Claude after receiving a grand jury subpoena, after he understood he was a target of the investigation, and for the purpose of preparing to speak with counsel. His lawyers also said he entered information learned from counsel into Claude and later shared the AI-generated materials with them.

Judge Rakoff rejected those arguments. The court found that the documents were not communications between a client and a lawyer because Claude was not an attorney. The court also found that the exchanges were not confidential because they were made with a third-party AI platform governed by Anthropic’s privacy policy. Finally, the court concluded that Heppner did not communicate with Claude for the purpose of obtaining legal advice from counsel because his lawyers had not directed him to use the platform.

The court’s work product analysis reached the same result. Even assuming the materials were prepared in anticipation of litigation, Judge Rakoff found they were not prepared by counsel or at counsel’s direction and did not reflect defense counsel’s strategy at the time they were created. The fact that the documents later affected counsel’s strategy did not make them protected work product.

The immediate implication is straightforward: clients who use public AI tools to discuss legal strategy, summarize legal advice, draft defense theories or organize facts for a lawyer may create records that prosecutors, opposing parties or regulators can seek. That risk is especially acute when the user enters attorney communications, confidential business information or litigation strategy into a consumer-facing platform.

The decision does not mean that every AI-assisted legal document is unprotected. Judge Rakoff noted that the analysis could differ if counsel had directed the client to use the AI tool. In that situation, the platform might be argued to function like a non-lawyer agent assisting counsel, similar to an interpreter, an accountant, or other professional whose work may fall within the privilege under certain circumstances. But the court drew a clear line around self-directed use by a represented client.

That line matters because modern litigation increasingly involves clients who are accustomed to using AI tools before calling a lawyer, after receiving a subpoena, or while trying to make sense of a civil or criminal dispute. The ruling tells those clients that an AI prompt is not the same thing as a private note to an attorney. A chatbot may feel conversational, but the law may treat it as an outside recipient of sensitive information.

The ruling also creates pressure on lawyers to address AI use early in a representation. Engagement letters, preservation notices and client instructions may need to warn clients not to enter case-related information into public AI tools. Lawyers handling criminal defense, internal investigations, securities matters, employment disputes, and trade secret litigation may also need to ask whether clients have already used AI to analyze facts, prepare timelines, or draft statements.

The American Bar Association had already warned lawyers that the use of generative AI implicates duties of competence, confidentiality, client communication, and reasonable fees. Formal Opinion 512, released in 2024, said lawyers using generative AI must consider their ethical duties, including the obligation to protect client information. Heppner adds a litigation consequence to that ethics concern: mishandled AI use can become a privilege fight.

The ruling is also significant because courts have not yet settled on one approach. In a Harvard Law Review analysis, Elizabeth X. Guo argued that the Heppner opinion appears to lean toward categorically excluding a client’s self-directed AI use from privilege, while a more fact-dependent approach could protect AI use in some circumstances. The article compared AI tools to technologies such as Gmail, Google Docs, and cloud storage, which courts do not automatically treat as destroying privilege merely because a third-party provider has technical access.

Other courts have already taken a different view in some settings. Reuters reported that courts in Michigan and Colorado have protected some AI-assisted work product for self-represented litigants, reasoning that AI can function as a drafting tool rather than as a human third party. Those cases involved pro se civil litigants, a key distinction from Heppner, where the defendant had lawyers and used Claude without their direction.

For businesses, the implications extend beyond attorney-client privilege. If executives, employees, or in-house teams enter legal, investigative, or proprietary information into public AI tools, those prompts and outputs may later become discoverable. They may also weaken claims that the company took reasonable steps to protect confidential information. The more sensitive the material, the greater the risk that a routine AI interaction becomes evidence.

For criminal defendants, the stakes are even higher. Heppner shows that AI-generated defense notes can be included in the government’s evidence review if they are not protected. The ruling also underscores that sharing privileged lawyer advice with an AI platform can be treated like sharing it with any other third party. Once privilege is waived, later sending the AI output to counsel does not restore it.

Future courts are likely to focus on several facts: whether the AI tool was public or enterprise-grade, whether its terms allowed training or disclosure, whether counsel directed the use, whether the user entered privileged information, whether the material reflected counsel’s mental impressions, and whether disclosure increased the chance that an adversary would obtain the information.

For now, the practical rule is conservative. Clients should not treat AI platforms as confidential legal advisers. Lawyers should not assume that AI-assisted materials are protected merely because they relate to a case. And courts will likely continue applying old privilege rules to new technology until appellate courts, legislatures, or ethics authorities provide clearer standards.

United States v. Heppner is not the final word on AI and privilege. But it is one of the first major signals that courts may view public AI tools less like private legal notebooks and more like third-party platforms. In the age of generative AI, the safest legal advice may be the simplest: do not put into a chatbot what you would not want an opponent, regulator, or prosecutor to read.

What Attorney Work Product Protects and Why It Matters

Attorney work product is related to attorney-client privilege, but it protects a different interest. The attorney-client privilege protects confidential communications between a lawyer and a client for the purpose of legal advice. The work product doctrine protects the lawyer’s preparation for litigation.

At its core, the doctrine shields an attorney’s mental impressions, legal theories, strategy, notes, research, witness outlines, draft arguments and other materials prepared because litigation is pending or expected. The protection allows lawyers to investigate facts, test arguments, and prepare a case without handing their roadmap to the opposing side.

That protection matters in both civil and criminal cases. A lawyer defending a client must be able to assess strengths and weaknesses, decide which facts matter, prepare witness examinations, and develop trial themes. If prosecutors or opposing parties could freely obtain those materials, they could gain an unfair look into the defense strategy before trial.

The doctrine is not unlimited. Courts generally look at whether the material was prepared by a lawyer, at a lawyer’s direction, or by someone acting as the lawyer’s agent. A client’s own document can qualify in some circumstances, but the key question is whether disclosure would reveal counsel’s actual thought process or litigation strategy.

That was the problem for Heppner. Judge Rakoff found that even if the Claude exchanges were made in anticipation of litigation, they were not prepared by defense counsel or at counsel’s direction. The court also found that they did not reflect defense counsel’s strategy at the time Heppner created them. According to the ruling, the AI documents may have later affected counsel’s strategy, but that was not enough to make them protected work product.

The distinction is important for AI users. A client who independently asks an AI platform to analyze a legal problem, draft arguments, or brainstorm defenses may believe the exchange is part of preparing for a case. Under Heppner, that belief alone does not make the exchange work product. The legal protection turns on the role of counsel, the purpose of the material, and whether the document reveals the lawyer’s own litigation preparation.

For lawyers, the ruling suggests that AI use must be managed as part of litigation strategy, not left to happen informally in the background. For clients, it sends a practical warning: creating a defense memo through a public chatbot is not the same as creating a confidential document under a lawyer’s supervision.