Compliance · 14 min read · April 16, 2026
Target Audience: Litigation partners, criminal defense attorneys, associates, and paralegals at small-to-mid-size litigation firms
In February 2026, a federal judge in New York answered a question that no court in the country had ever answered before.
Can a client's communications with a publicly available AI platform be shielded from government disclosure by attorney-client privilege or the work product doctrine?
The answer was no.
The case is United States v. Heppner, No. 25-cr-00503-JSR (S.D.N.Y.), and every litigation attorney in America should read it.
What Happened
Bradley Heppner was indicted on October 28, 2025, on charges of securities fraud, wire fraud, conspiracy, making false statements to auditors, and falsification of records — arising from an alleged scheme to defraud investors in connection with a financial services company he founded and controlled as CEO.
After receiving a grand jury subpoena and retaining counsel, Heppner used a publicly available, consumer version of Anthropic's Claude to independently research legal issues related to the government's investigation. He created approximately 31 documents that, according to the court, "outlined defense strategy" and "outlined what he might argue with respect to the facts and the law."
Critically:
- He did this on his own initiative, without direction from his attorneys.
- Some of the information he input into Claude he had learned from his counsel.
- He later shared the AI-generated documents with his attorneys.
- He used the free, consumer version of Claude — not an enterprise or attorney-managed platform.
When FBI agents executed a search warrant at Heppner's residence, they seized electronic devices containing the 31 AI-generated documents and the underlying interaction logs showing his prompts.
His defense counsel — from Quinn Emanuel — listed all 31 documents on a privilege log, asserting attorney-client privilege and work product protection.
On February 6, 2026, the Government moved for a ruling that the documents were not protected. At oral argument on February 10, Judge Jed S. Rakoff ruled from the bench, granting the Government's motion in full. On February 17, Judge Rakoff issued a written opinion explaining his reasoning.
The Court's Analysis
Judge Rakoff characterized the question as one of "first impression nationwide" — no federal court had previously addressed whether communications with a publicly available AI platform during a pending criminal investigation are protected by privilege or work product. His analysis tracked each doctrine separately.
Attorney-Client Privilege
Attorney-client privilege protects communications (1) between a client and his or her attorney (2) that are intended to be, and in fact were, kept confidential (3) for the purpose of obtaining or providing legal advice.
The court held that at least two of the three elements were not met.
First: The communications were not with an attorney. "Because Claude is not an attorney," Judge Rakoff wrote, "that alone disposes of Heppner's claim of privilege." Heppner was consulting the tool entirely on his own — not at counsel's direction.
Second: There was no reasonable expectation of confidentiality. Heppner used the consumer version of Claude, whose terms of service permitted Anthropic to use prompts and outputs for model training and to disclose user data to third parties, including government regulators. The court found that using this specific tool was, in effect, a disclosure to a third party — Anthropic — under terms that affirmatively undermined any claim of confidentiality.
Third: The communications were not for the purpose of obtaining legal advice. Heppner did not use Claude at his attorneys' direction. The court also noted that when the Government asked Claude to provide legal advice, Claude responded that it could not — a position Claude's public-facing terms explicitly reflect.
The court also addressed and rejected the defense's Kovel doctrine argument. Under United States v. Kovel, 296 F.2d 918 (2d Cir. 1961), privilege can extend to third-party intermediaries — such as accountants, translators, or experts — when their involvement is necessary for effective legal representation. Judge Rakoff found the doctrine inapplicable for two reasons: the AI was not "necessary" for counsel to understand the client's communications, and Heppner had engaged the AI entirely on his own initiative rather than at counsel's direction.
The court further ruled that the subsequent sharing of the AI documents with counsel could not retroactively confer privilege. Well-settled law holds that sending non-privileged documents to an attorney does not make them privileged.
Work Product Doctrine
The work product doctrine provides qualified protection for materials prepared by or at the behest of counsel in anticipation of litigation or for trial.
The court assumed, without deciding, that the documents were prepared in anticipation of litigation. That wasn't enough.
The documents failed on the "by or at the behest of counsel" element. Heppner generated the AI materials independently and not at counsel's direction. The documents did not reflect defense counsel's legal strategy or mental impressions. For that reason, they did not merit work product protection.
What the Court Left Open
Judge Rakoff's opinion was careful to note what it was not deciding.
"It could have been a different story if counsel had directed Heppner to use Claude."
The court acknowledged that if counsel had directed Heppner to use Claude, the AI tool might have functioned as a lawyer's "highly trained agent," potentially covered by attorney-client privilege under the Kovel doctrine. The ruling does not close the door on privilege protection for AI-assisted work — it identifies the specific circumstances that defeated it here.
The court also noted, in the privilege analysis, that the outcome turned significantly on Heppner's use of a consumer-grade, non-enterprise AI tool whose privacy policy explicitly disclaimed confidentiality. The opinion distinguishes between the consumer version of Claude and enterprise-grade platforms with contractual prohibitions on data training, restricted access to data, and strict privacy policies.
The Contrast Case: Warner v. Gilbarco
One week before the Heppner ruling, a federal magistrate judge in the Eastern District of Michigan reached the opposite outcome — on different facts, applying the same doctrinal framework.
In Warner v. Gilbarco, Inc., decided February 10, 2026, a pro se plaintiff in an employment discrimination action used a generative AI tool to prepare litigation-related materials. The defendants moved to compel production of all AI-generated documents and argued the plaintiff had waived work product protection by disclosing materials to the AI tool.
The court denied the motion. It held that AI tools are "tools, not persons" and that disclosing materials to an AI tool is not disclosure to an adversary. Because the plaintiff's use of AI was tied to her own litigation-related thought processes — the very thing the work product doctrine protects — the protection held.
Together, Heppner and Gilbarco illustrate the same principle: courts are applying traditional privilege doctrine to AI tools, neither expanding nor contracting existing protections. The outcome turns on the facts, not on the technology.
What This Means for Litigation Attorneys
The Heppner ruling is not a technology ruling. As Proskauer noted, "putting the novelty of the AI context aside, Judge Rakoff grounded his analysis in traditional privilege principles." But it has concrete, practical implications for how litigation teams should structure their AI use.
1. Counsel direction matters — a lot.
The single most consequential fact in Heppner was that Heppner acted independently, without counsel's direction or supervision. Judge Rakoff explicitly identified this as the dividing line. AI outputs generated at counsel's direction, as part of a supervised attorney-client relationship, stand on meaningfully different footing than AI outputs generated by a client on their own initiative.
The practical implication: if you want AI-assisted client work to carry privilege or work product protection, that work should happen under your direction and within the scope of the representation — not as a freelance exercise by the client.
2. Consumer AI tools carry real confidentiality risk.
The consumer version of Claude — the free, publicly available platform — has a privacy policy that permits Anthropic to use inputs for model training and to disclose user data to regulators. That privacy policy is not compatible with a reasonable expectation of confidentiality for privileged communications.
Enterprise or attorney-managed AI platforms with contractual data confidentiality protections, prohibitions on training use, and restricted access operate differently. The court's analysis suggests those contractual distinctions matter.
3. Privilege does not attach retroactively.
Clients who use AI tools independently and then share the outputs with counsel should not expect that sharing to confer privilege. It doesn't. Well-settled law establishes that non-privileged communications do not become privileged simply because they are later given to an attorney.
4. Inputting privileged information into consumer AI may waive the privilege.
The court indicated that even information that was privileged when originally communicated between lawyer and client may lose its protected status if the client subsequently inputs it into a consumer AI platform with a non-confidential privacy policy. The disclosure to the AI provider constitutes a potential waiver of the privilege that originally attached.
5. Privilege logs for AI-assisted work require precision.
Debevoise has advised that privilege log entries for AI-assisted work should clearly indicate that the AI tool was used at counsel's direction, that outputs reflect attorney mental impressions, and that the work was created under circumstances supporting a reasonable expectation of confidentiality. Boilerplate logging is not enough.
The Bigger Picture
Heppner is the first federal decision to squarely address these questions. It will not be the last. Courts in the U.K. have independently reached similar conclusions — with at least one tribunal expressing the view that uploading confidential client material to a public AI platform could amount to placing it in the public domain, thereby breaching confidentiality and waiving privilege.
The trajectory of this case law is clear: AI tools are being evaluated under the same doctrinal frameworks that have always governed privilege and work product. The technology is new. The legal principles are not. And those principles have always required that privileged communications be made in confidence, under legal direction, and between attorney and client.
The lesson is not that AI has no place in litigation practice. It plainly does. The lesson is that unsupervised, consumer-grade AI use — by clients acting independently — carries risks that neither the client nor counsel may appreciate until it is too late.
How ChronoLaw Is Different
ChronoLaw is an attorney-managed AI platform designed for litigation teams. It is not a consumer tool for clients to use on their own initiative.
Every ChronoLaw analysis is generated under the direction of the attorney or paralegal operating the platform. Every output is tied to source documents, with inline citations linked to the underlying record. The work product is the attorney's — produced by a tool the attorney controls, within the scope of a representation the attorney manages.
ChronoLaw also operates as an enterprise platform. It does not use client documents to train AI models. Client data stays within the engagement.
The distinction Heppner draws — between supervised, attorney-directed AI use and unsupervised, client-initiated AI use — is exactly the line ChronoLaw is designed to stay on the right side of.
Want to see how ChronoLaw handles your case documents? Schedule a demo to walk through the platform with our team.