The Heppner Ruling: When Using AI Can Waive Attorney-Client Privilege

On February 17, 2026, U.S. District Judge Jed S. Rakoff of the Southern District of New York issued an opinion that will reshape how lawyers, clients, and businesses think about using AI tools in any legal context. In United States v. Heppner, Judge Rakoff ruled that the written exchanges between a criminal defendant and a publicly available AI platform were not protected by attorney-client privilege or the work product doctrine — ordering production of documents that the defendant had clearly intended to use as part of his legal defense.

The ruling addressed what Judge Rakoff described as “a question of first impression nationwide.” It is not the last word on AI and privilege. Courts will continue to develop this area of law, and the opinion expressly left open questions about enterprise AI tools, attorney-supervised AI use, and alternative analytical frameworks. But Heppner represents the first direct federal ruling on whether privilege protects AI-generated legal research and strategy documents, and its logic is clear: a public AI platform is a third party, disclosure to a third party destroys confidentiality, and without confidentiality there is no attorney-client privilege.

The Facts

Marcus Heppner was indicted on October 28, 2025, on charges of securities fraud. The case arose from events that predated the indictment; at some point before his arrest, Heppner became aware that he was the target of a federal grand jury investigation. After receiving a grand jury subpoena — a point at which the investigation’s focus on him was clear — Heppner conducted extensive AI-assisted legal research. Using the publicly available consumer version of Claude, an AI platform developed by Anthropic, he generated reports that outlined defense strategy, analyzed the elements of the securities fraud charges against him, and assessed potential legal arguments.

When Heppner was arrested, the FBI seized documents containing those AI-generated outputs. The government moved to compel production of those documents, arguing they were not privileged. Heppner opposed, arguing the communications were protected by attorney-client privilege and that the documents qualified as work product because they were prepared in anticipation of litigation.

After oral argument on February 10, 2026, Judge Rakoff granted the government’s motion and issued his written opinion explaining the ruling.

Why the Court Rejected Attorney-Client Privilege

Attorney-client privilege applies to confidential communications between a client and their attorney, made for the purpose of obtaining or providing legal advice. The court’s analysis of Heppner’s privilege claim moved through each required element in turn.

Not between attorney and client. The most fundamental problem with Heppner’s privilege claim was that his counterpart in the communications was not a lawyer. Claude is an AI platform, not an attorney. Judge Rakoff addressed this directly: “Because Claude is not an attorney, that alone disposes of Heppner’s claim of privilege.” This may seem obvious, but the point carries important implications. No matter how sophisticated an AI platform is, no matter how legally accurate its outputs, and no matter how closely those outputs resemble what a lawyer might produce, the platform is not a licensed attorney and cannot stand in the attorney-client relationship.

Heppner apparently anticipated this objection and raised the Kovel doctrine as a counter-argument. Under Kovel (named for United States v. Kovel, a 1961 Second Circuit decision), the attorney-client privilege can extend to third parties that act as necessary agents of counsel in the legal representation — the paradigmatic examples being accountants retained to assist counsel understand financial records or foreign-language translators retained to facilitate communication with a non-English-speaking client. Heppner argued that Claude functioned in an analogous role.

Judge Rakoff acknowledged the Kovel framework but rejected its application on the facts. The critical distinction under Kovel is that the third party must be operating at the direction of and in service of counsel. Here, Heppner had not engaged Claude at the direction of his attorney. He had used Claude entirely on his own, independent of any attorney. There was no attorney supervising the AI consultations, no attorney directing what questions to ask, and no attorney integrating the AI outputs into a structured legal representation. Heppner used Claude as a research tool, on his own initiative, before retaining counsel. That is not the Kovel relationship — it is a person consulting an AI tool instead of a lawyer.

Importantly, Judge Rakoff noted what might have produced a different result: “Had counsel directed Heppner to use Claude, Claude might arguably be said to have functioned in a manner akin to a highly trained professional who may act as a lawyer’s agent within the protection of the attorney-client privilege.” This statement is significant. It suggests that attorney-supervised AI use — where counsel directs a client to use an AI tool as part of the legal representation — may preserve a Kovel-based privilege argument. The ruling is specifically about unsupervised, independent AI use, not about AI tools deployed as instruments of attorney-directed legal work.

No reasonable expectation of confidentiality. Even if the first element could be resolved in Heppner’s favor, the communications failed the confidentiality requirement of attorney-client privilege. Confidentiality requires that the communication was intended to be, and was in fact, kept confidential. The court examined Anthropic’s publicly available privacy policy for the free, consumer version of Claude and found it fatal to the confidentiality claim.

The policy provided that Anthropic collects user inputs and Claude’s outputs, uses that data to train its models, and reserves the right to disclose user data to a host of third parties, including governmental regulatory authorities. In other words, when Heppner typed his defense strategy questions into Claude, the terms of service he had agreed to gave Anthropic the right to read, retain, use, and disclose that content. The court found that this defeated any reasonable expectation of confidentiality: a person who voluntarily shares information with a party under terms that explicitly permit further disclosure to third parties cannot claim that the original communication was confidential.

This is the disclosure-to-third-party analysis that privilege doctrine has always applied to non-AI contexts. If a client tells their lawyer something in a room with a stranger present, there is no privilege — the presence of the stranger destroys confidentiality. The Heppner ruling applies the same logic to AI platforms: the privacy terms of the platform function as notice that the “room” is not private. Anyone who uses a public AI platform with knowledge of (or constructive notice of) terms that permit data use and disclosure cannot claim that their inputs were confidential.

Not for purpose of obtaining legal advice. The court also found that the communications failed the purpose element of the privilege. Attorney-client privilege protects communications made for the purpose of obtaining or providing legal advice. Here, the AI communications were not initiated to obtain legal advice — they were initiated by Heppner, on his own, without the involvement of counsel. Whether Heppner hoped to learn things that would help him mount a legal defense does not transform the communications into legal consultations.

Why the Court Rejected Work Product Protection

Work product doctrine, codified in Federal Rule of Civil Procedure 26(b)(3), protects documents and tangible things prepared in anticipation of litigation by or at the direction of a party’s representative, including attorneys. Unlike attorney-client privilege, work product protection does not require an attorney to be the communication’s author — a party’s own documents prepared in anticipation of litigation can qualify.

Heppner argued that the AI-generated defense strategy documents qualified as work product because they were clearly prepared after the grand jury subpoena, in anticipation of the litigation that followed.

The court rejected this argument on two grounds. First, the documents were not prepared by or at the direction of counsel. They were prepared by Heppner himself, without attorney involvement. Work product protection, when invoked for documents prepared by a party rather than by counsel, requires a closer connection to attorney-directed litigation preparation than Heppner’s unsupervised AI consultations established.

Second, the court found that the documents did not reflect the mental impressions, conclusions, opinions, or legal theories of an attorney — the “opinion work product” that receives the strongest protection under the doctrine. They reflected the outputs of an AI system responding to Heppner’s prompts. Whatever legal analysis Claude produced, it was not the work product of a lawyer preparing for litigation on Heppner’s behalf.

Again, the court’s reasoning leaves open a path for different facts. Work product protection for AI-generated documents might apply where: (a) an attorney directed the AI research as part of litigation preparation; (b) the attorney used AI outputs as raw material that the attorney then synthesized into legal analysis; or (c) the AI tool functioned as a document review or research assistant integrated into the attorney’s litigation workflow. None of those circumstances were present in Heppner.

The Diverging Circuit: Warner v. Gilbarco

It is important to note that Heppner is not the only recent federal decision on AI and privilege. On February 10, 2026 — the same week as oral argument in Heppner — the Eastern District of Michigan decided Warner v. Gilbarco, Inc., reaching a different result. In that case, the court denied a motion to compel production of documents that a self-represented litigant had prepared using a public AI chatbot, finding that work product protection applied.

The divergence between Heppner and Warner v. Gilbarco illustrates that this area of law is not yet settled. The cases differ in significant ways — criminal versus civil context, the specific tool used, the specific facts of how the documents were prepared, and the procedural posture. Lawyers and legal scholars are analyzing the split closely, and it will likely take appellate decisions or a definitive circuit-level ruling to establish stable doctrine.

What Heppner establishes clearly, at least in the Second Circuit, is that independent use of a public AI platform’s consumer tier does not create a reasonable expectation of confidentiality sufficient to support attorney-client privilege. That principle is grounded in basic confidentiality analysis and is likely to be applied consistently by courts that follow Judge Rakoff’s reasoning.

What This Means for Businesses and Their Legal Counsel

The Heppner ruling has immediate implications for any business, executive, or individual who uses AI tools in connection with legal matters.

Do not use public AI tools to develop legal strategy. The most direct lesson of Heppner is that using a public AI platform — one with consumer-grade privacy terms that permit data use, training, and third-party disclosure — to analyze legal exposure, develop legal arguments, or prepare for litigation is legally risky. Those communications are not privileged, and they may be produced in litigation or regulatory proceedings. The legal analysis you develop through a public AI tool is an unprotected document that opposing counsel can obtain.

The platform’s privacy terms determine the confidentiality analysis. Courts applying Heppner’s logic will look at whether the AI platform’s terms of service create or destroy a reasonable expectation of confidentiality. Consumer AI platforms generally permit Anthropic, OpenAI, Google, or other providers to use inputs for training and to share data with third parties. Enterprise AI tools with different contractual terms — zero-retention commitments, prohibitions on training, defined data segregation — present a different confidentiality analysis. The distinction between enterprise and consumer AI tools is a legal issue, not just a procurement preference.

Attorney direction matters. Judge Rakoff explicitly left open the possibility that AI tools used at an attorney’s direction, as part of a structured legal representation, may present a different Kovel analysis. Businesses and individuals who want to use AI tools in connection with legal matters should do so through counsel — not independently. When AI research is assigned, directed, and supervised by an attorney, the product of that research has a better claim to privilege protection than research generated independently by the client.

Work product protection requires attorney involvement. The same principle applies to work product. AI outputs that qualify as attorney work product must be generated in connection with attorney-directed litigation preparation, not by clients acting independently.

Open Questions the Ruling Did Not Resolve

Judge Rakoff was explicit that Heppner did not decide several important questions.

The ruling applies specifically to the consumer-grade, free version of Claude with Anthropic’s public privacy terms. The court expressly noted that enterprise AI tools — ones with contractual commitments that prohibit data training, restrict disclosure, and establish confidentiality obligations — might support a different reasonable expectation of confidentiality. That question remains open for a future court to address.

The ruling also did not decide whether AI tools that are integral to attorney-supervised legal work — tools used by lawyers in law firm workflows, for example, or AI research tools used by attorneys to prepare memos directed to clients — qualify for privilege or work product protection. The specific facts of Heppner involved a client acting alone, without counsel. The attorney-directed use case is legally distinct.

Finally, the ruling does not address AI tools that function as internal knowledge management tools or document review assistants, rather than as standalone research platforms. The legal analysis of those tools will depend heavily on their specific terms of service and the context of their use.

The Heppner ruling is a landmark in the emerging law of AI and legal privilege, but it is an early landmark. Courts will continue to develop doctrine as AI use in legal contexts expands. For now, the governing principle is clear: public AI platforms are third parties, and voluntarily sharing legal strategy with a third party under terms that permit further disclosure destroys confidentiality and privilege. Whether that principle is modified for enterprise AI tools, attorney-supervised AI use, or AI-integrated legal workflows is the question courts will be answering in the years ahead.

This post is for general informational purposes only and does not constitute legal advice. Reading this post does not create an attorney-client relationship. If you have questions about your specific situation, consult a qualified attorney.