Clicking “Ask AI” Can Nix Privilege, Court Warns

In United States v. Heppner, United States District Judge Jed S. Rakoff of the Southern District of New York issued a landmark opinion regarding the application of the attorney-client privilege and work product doctrine to a litigant’s use of artificial intelligence (AI) to craft legal strategy. Judge Rakoff ruled that documents reflecting a criminal defendant’s conversations with a publicly-available AI platform were not protected by the attorney-client privilege and did not constitute attorney work product. The Court came to this conclusion even though the defendant had a lawyer representing him at the time the AI discussions took place.

Heppner provides important guidance on how foundational legal principles may be applied to ground-breaking AI technology—and how clients can harness its power while maintaining the protections of the attorney-client relationship.

Summary of Judge Rakoff’s Opinion        

In United States v. Heppner, No. 25-cr-00503-JSR (S.D.N.Y. Oct. 28, 2025), Bradley Heppner was charged with securities and wire fraud, among other financial crimes, for defrauding investors in connection with self-serving transactions for two privately-held companies that Heppner controlled. After receiving a grand jury subpoena, and after becoming aware that he was the target of a government investigation, Heppner used the public version of Anthropic’s Claude AI (“Claude”) to prepare his criminal defense strategy. This led to the generation of 31 documents containing Heppner’s prompts and Claude’s responses constituting “reports that outlined defense strategy, that outlined what he might argue with respect to the facts and the law that we anticipated that the government might be charging.” Heppner engaged in these discussions with Claude “without any suggestion from counsel that he do so.”

While executing a search warrant at Heppner’s home at the time of his arrest, the government found these Claude conversations on Heppner’s electronic devices. The government moved for a ruling that these conversations were not protected under the attorney-client privilege or work product doctrine. Heppner’s lawyer opposed the government’s request arguing that the information Heppner used in his prompts was (1) learned from counsel, (2) created for the purpose of speaking to his attorney and obtaining legal advice, and (3) subsequently shared with counsel.

On February 10, 2026, Judge Rakoff orally ruled that Heppner’s conversations with Claude were not protected by the attorney-client privilege or the work product doctrine. In a written opinion issued on February 17, 2026, Judge Rakoff framed the issue as: “whether, when a user communicates with a publicly available AI platform in connection with a pending criminal investigation, are the AI user’s communications protected by attorney client privilege or the work product doctrine?”.

The Court answered that question “no” for three main reasons:

• Claude is not a lawyer (or even a human), and therefore could not have established an attorney-client relationship with Heppner;
• Heppner’s conversations with Claude were not confidential, including because Anthropic’s privacy policy staties that user “inputs” and Claude’s “outputs” will be used to “train” the software and may be disclosed to third-parties; and
• Heppner could not have been using Claude for the purpose of obtaining legal advice because he did not do so “at the suggestion or direction of counsel.”

The Court held that the work product doctrine did not apply either. Even though Heppner used Claude to develop a defense strategy “in anticipation of litigation,” these conversations were not “prepared by or at the behest of counsel.” Heppner was thus not acting as his lawyer’s agent when having these discussions with Claude, and they did not reflect his attorney’s mental processes or strategy.

Protecting Client Communications with AI Platforms

While AI technology is new, the principles that underlie the Heppner decision are not. Communicating legal strategy to a third party will destroy privilege, even if that “third party” is AI software. And later sharing that strategy with an attorney does not make the underlying communications privileged or protected in the first instance.

But this does not mean clients should forsake the use of AI all together. Rather, lawyers and clients who want to use AI to inquire about legal questions or discuss case strategy should first ensure that they are using a non-public, or closed-circuit, version of the AI software. This will help ensure that the communications retain their confidential nature. Moreover, clients should utilize AI for legal functions in conjunction with, and at the direction of, counsel. Before engaging in legal conversations with an AI platform, clients should talk to their attorneys about the issues they wish to explore and how those issues will fit into the lawyer’s overall case strategy.

Taking these precautionary steps will help allow clients to benefit from powerful AI tools without compromising the protections afforded by the attorney-client privilege or work product protection.

United States v. Heppner, No. 25-cr-00503-JSR (S.D.N.Y. Oct. 28, 2025), at 2-3.

Id. at 3.

Id.

Id.

Id.

Id. at 4.

Id. at 3-4.

Id. at 2.

Id. at 5.

Id. at 6.

Id. at 7.

Id. at 9 (internal citations omitted).

Id. at 10.