Heppner Ruling Highlights Privilege Risks in Consumer AI for Legal Strategy

The Southern District of New York’s recent decision in United States v. Heppner makes plain a critical, immediate rule for defense counsel: when clients go to consumer-grade generative AI for legal strategy, those AI chats can be—and now have been—treated as non‑privileged and discoverable, even when the client later shares the output with counsel.

Background / Overview​

In February 2026, Judge Jed S. Rakoff issued a written memorandum following a bench ruling that thirty‑one documents created by defendant Bradley Heppner using Anthropic’s Claude were not protected by the attorney‑client privilege or the work product doctrine. The documents—AI-generated reports and strategy notes—were created after Heppner had been subpoenaed and notified that he was a government target. Federal agents seized electronic devices during a warrant search that contained the Claude transcripts and outputs.
The court’s reasoning rested on three central points: (1) communications with a generative AI platform are not communications with an attorney; (2) the consumer AI’s terms and privacy practices defeated any reasonable expectation of confidentiality; and (3) the work product doctrine did not apply because the materials were not prepared at the direction of counsel and did not reflect counsel’s mental impressions. The ruling rejects the proposition that a client’s later transmission of AI-generated material to their lawyer automatically retroactively cloaks it with privilege.
This decision is among the first clear, published trial‑court treatments of whether and when AI‑generated client work can be privileged. Its practical consequences for defense lawyers, corporate counsel, and compliance teams are immediate and far reaching.

---

What the ruling actually holds — the narrow legal mechanics​

Attorney‑client privilege: the human relationship requirement​

The attorney‑client privilege protects confidential communications between a client and a lawyer made for the purpose of obtaining or providing legal advice. Judge Rakoff emphasized that the privilege assumes a trusting human relationship with a licensed professional who is subject to discipline and fiduciary duties. A standalone AI platform—Claude in this case—is not a lawyer and cannot substitute for that relationship. Thus, prompts to and outputs from a consumer generative AI are not themselves privileged communications with counsel.

Expectation of confidentiality and third‑party disclosure​

A second, independent ground in the decision was that the consumer AI’s privacy practices removed any reasonable expectation of confidentiality. Many consumer AI platforms state in terms of service or privacy policies that user inputs may be used to train models, shared with third parties, or otherwise disclosed in connection with claims and regulatory matters. Where a platform’s terms place users on notice that their inputs may be shared, a court can find that the communication was not made in confidence and consequently is not covered by privilege.

Work product doctrine: direction, control, and the lawyer’s mental processes​

The work product doctrine protects materials prepared by or at the direction of counsel in anticipation of litigation because it shields an attorney’s mental impressions and strategy. The Heppner ruling rejected work product protection for client‑generated AI materials because they were not prepared by counsel or at counsel’s direction and did not reflect counsel’s mental impressions. The court explicitly declined to extend work product protection to independent client work done using consumer AI where counsel neither authorized nor directed that use.

---

Why this ruling matters right now​

• It establishes a practical, immediate rule: client use of consumer generative AI for legal research or strategy is highly risky from a confidentiality and privilege standpoint.
• It places affirmative obligations on counsel to manage client behavior: lawyers must now proactively counsel clients not to use consumer AI tools to prepare or refine privileged materials unless those tools and uses are carefully controlled and documented.
• It elevates vendor privacy language into litigation consequences: platform policies that permit model training or third‑party disclosure can undo any claim to confidentiality, even where the client thought they were "just drafting notes" for counsel.
• It raises thorny questions about defense‑side use of closed or enterprise AI tools, counsel’s own use of AI, and the contours of work product when AI is used under counsel’s direction—questions the court left open.

---

Practical implications for counsel — triage, client management, and malpractice risk​

This is not academic. The case shows how easily privilege can be lost—and how costly that loss can be in criminal and high‑stakes civil matters.

Immediate client management steps​

• Tell every client, at the outset of representation, to stop using consumer AI (ChatGPT, Claude, Perplexity, etc.) to research or draft legal strategy. Make this a written, documented part of the engagement intake and conflict check process.
• Explain why. Don’t rely on vague admonitions—explain that many consumer AI platforms reserve broad rights to use and disclose user inputs and that courts may treat such exchanges as non‑confidential third‑party communications.
• Obtain explicit client acknowledgement. Put the warning in writing and obtain a client signature or electronic acknowledgement in the engagement letter or an intake form. That reduces malpractice exposure and gives notice if a later dispute arises about client conduct.
• Ask clients to disclose prior AI use immediately. If a client has already used AI tools, counsel must know what was typed, where it was stored, and whether it was transmitted. Immediate disclosure enables a risk assessment and appropriate protective measures.

Forensic and e‑discovery posture when AI use is suspected​

• Preserve devices and cloud logs. Treat AI outputs as potentially discoverable ESI and preserve relevant device images, cloud exports, and account histories.
• Obtain privilege protocol orders when possible to manage government review of seized materials.
• Be prepared to defend assertion of privilege—or, alternatively, to negotiate protective orders—for narrow categories of material created at counsel’s direction.

Malpractice and duty of competence​

• Lawyers have an ethical duty to advise clients about confidentiality risks and to competently supervise technology used in legal work.
• Failing to warn a client—and thereby allowing them to destroy privilege—creates malpractice exposure if the loss of privilege results in significant legal harm.
• Counsel must adopt and maintain clear AI use policies and documentation to satisfy ethical oversight expectations.

---

When might AI‑assisted work remain privileged?​

The Heppner decision is careful and limited in some respects; it does not close every possible route to privilege for AI‑assisted materials. Key distinctions matter and will be litigated in future cases.

1) Use of AI at counsel’s direction and under counsel’s supervision​

If an attorney tells a client to use a specific AI tool for a specific task as part of counsel’s strategy—and the attorney controls the process, the inputs, and the storage—courts may be more receptive to a work product or privilege claim. The difference is agency and control: materials produced by or under the direction of counsel can squarely fit within the work product doctrine.

2) Enterprise or closed systems with contractual confidentiality​

A consumer, cloud‑hosted AI that trains on user inputs and reserves broad rights to disclose is very different from an enterprise AI deployment that offers contractual commitments, data separation, and non‑training agreements. Tools that:

• provide explicit vendor commitments not to use matter data to train models,
• offer enterprise logging, encryption, and access controls,
• allow organizations to keep data on private servers or in a private tenant,

may provide a stronger factual basis for asserting privilege—especially if counsel documents the decision to use the tool, the vendor’s contractual protections, and the internal controls used to maintain confidentiality.
Two caveats remain: (a) even if an enterprise vendor promises not to train on client data, many vendors still reserve the right to respond to lawful process (subpoenas, warrants); and (b) if the lawyer fails to follow documented controls, privilege may be lost.

3) Counsel’s own use of AI to create drafts and analysis​

The court in Heppner did not fully resolve whether documents created by counsel using AI—without client involvement—are protected. If counsel alone uses a secure, enterprise AI tool to draft memoranda reflecting counsel’s mental impressions, the work product doctrine is more likely to apply. But this too depends on vendor practices, notice given in vendor agreements, and whether the vendor’s terms undercut the confidentiality essential to the privilege.

---

Technology realities counsel must understand​

• Consumer models typically train on user inputs. Many free or consumer AI services use inputs and outputs to improve models. Their terms often give broad rights to retain and use data. That training use and retention is the single biggest factual hook for courts finding no reasonable expectation of confidentiality.
• Enterprise products sometimes allow “opt‑outs,” but check the defaults. Products like Microsoft Copilot may process customer content differently depending on whether the customer has affirmatively opted out of training. Relying on default settings without affirmative contractual and operational steps is dangerous.
• Vendors will comply with lawful process. Even with contractual assurances, vendors generally reserve the right to disclose data when required by law. A vendor’s promise not to train on data does not prevent production in response to a valid subpoena or search warrant.
• Data provenance matters. Where the AI conversation lives—on a client’s device, in a cloud vendor’s logs, in cached backups—matters for preservation and for assessing waiver. Stale copies in backups and sync services can be a discoverability trap.

---

Recommended counsel checklist: concrete steps to protect privilege and client confidentiality​

• Engagement intake
• Add a mandatory AI usage clause to engagement letters that:
• prohibits clients from using consumer AI tools for matter‑related work unless counsel approves,
• requires clients to disclose any prior AI use,
• authorizes counsel to take steps to preserve ESI.
• Provide a one‑page, plain English client advisory on AI risks and require acknowledgement.
• Technology and vendor selection
• If counsel will use AI, select enterprise or on‑prem solutions with contractual non‑training commitments, data separation, and SOC/ISO certifications.
• Negotiate contractual language that:
• expressly disclaims training on matter data,
• limits use to agreed purposes,
• requires notice and process before any disclosure to third parties,
• provides logging and access to audit trails.
• Operational controls
• Create a firm‑level AI governance policy covering permitted tools, approval processes, data classification, and retention.
• Use data loss prevention (DLP), sensitivity labels, and rights management controls to prevent uploading privileged content to consumer AI.
• Train staff and clients: short, recurring training on what not to upload to consumer AI.
• Forensics and e‑discovery readiness
• Maintain relationships with digital forensics vendors who understand AI artifacts (chat exports, account logs, model‑side IDs).
• When devices are seized, obtain a privilege protocol or seek a neutral third‑party review process where feasible.
• Preserve access and logs for enterprise AI tenants.
• Litigation posture
• When AI usage is suspected, move quickly to assess exposure, seek protective orders, and, where appropriate, negotiate the scope of any compelled review and production.
• If privilege is asserted over AI outputs, be ready to show: (a) the AI was used under counsel’s direction; (b) vendor promises and settings preserved confidentiality; and (c) internal controls prevented third‑party disclosure.

---

Open legal questions and likely appellate issues​

Heppner is consequential but not final law for all jurisdictions. Several issues will likely be litigated next:

• Whether privilege can attach where counsel actively directs the use of third‑party AI and documents the process.
• The extent to which enterprise/closed AI platforms with contractual non‑training provisions should be treated differently from consumer AI.
• Whether courts will recognize a broader expectation of digital confidentiality as technology evolves—or whether they will treat AI like any third‑party vendor subject to traditional waiver analysis.
• Whether an attorney’s own AI‑generated work (created with vendor tools) receives full work product protection when the vendor’s terms might undercut confidentiality.

Appellate courts will be asked to define whether the human relationship at the heart of privilege can be satisfied when attorneys rely on sophisticated software as non‑attorney assistants—or whether privilege remains strictly tied to human counsel and legally recognized non‑lawyer agents.

---

How to talk to clients without sounding alarmist​

Advising clients to avoid helpful tools is never easy. Clients will reasonably ask: “Isn’t AI faster and cheaper? Why can’t I use it to collect my thoughts?” Counsels’ messaging must be clear, precise, and practical:

• Stress that the risk is not that AI is always insecure, but that consumer AI providers often reserve rights to use and disclose the content.
• Explain that privilege is a legal protection that depends on how and with whom communications are made—not on the client’s subjective intent.
• Offer alternatives: counsel‑approved enterprise tools, secure on‑prem workflows, or having the attorney perform the AI‑assisted research within a controlled environment.

Frame the policy as a protective measure that preserves options in case the matter becomes adversarial.

---

Risks to corporate counsel and firms​

• Governance and compliance exposures: In-house teams must update legal holds, data retention, and information governance policies to explicitly address AI chats.
• Conflicts and cross‑border data flows: Vendor contracts that permit data transfers to jurisdictions with weaker privacy protections magnify the risk that communications will be accessed by third parties.
• Professional responsibility: Bar authorities will look closely at whether lawyers have taken reasonable steps to supervise technology and to inform clients. Failure to do so could trigger ethics complaints in addition to malpractice claims.

---

A final practical guide for the next 90 days​

• Update engagement letters and intake materials to include AI language and client acknowledgements.
• Run a triage: identify active matters where clients have likely used consumer AI and perform immediate ESI preservation.
• Select and test enterprise AI vendors only after legal and procurement review; insist on non‑training clauses and audit rights.
• Train lawyers and staff—one hour of mandatory training on AI confidentiality risks for all practitioners within 30 days.
• Work with IT/security to implement DLP and sensitivity labeling to prevent privileged materials from being uploaded to consumer AI services.
• When devices are seized, move quickly to seek a privilege protocol and to limit the government’s exposure to privileged materials.

---

Conclusion​

United States v. Heppner is a wake‑up call: the convenience of consumer generative AI cannot be allowed to quietly erode legal privilege and work product protections. The Heppner ruling does not outlaw the use of AI in legal practice, but it redraws the guardrails. Counsel must now act deliberately—implementing policies, documenting decisions, selecting the right technology partners, and communicating clearly with clients—if they are to keep confidential legal strategy confidential.
In short: do not assume that an AI chat is private; assume instead that every upload is potentially discoverable unless affirmative, documented steps establish attorney direction, technical segregation, and contractual confidentiality. The next wave of litigation will test the boundaries of privilege in an AI age. For now, a prudent defense lawyer counsel’s first task is simple and unavoidable: instruct clients to stop using consumer AI for matter‑specific legal work until counsel approves a safe, documented workflow.

---

Source: Bloomberg Law News Client’s AI Chats Aren’t Privileged. What’s the Rule for Counsel?