ICYMI: SDNY Rules AI Communications Are Not Privileged or Work Product
Dance like no one is watching, prompt like it will be read in open court.
A federal court has decisively rejected the assumption that AI chatbot sessions create a confidential sanctuary. For litigators and IP practitioners, this resolves a looming question: are client discussions of legal strategy with AI protected from discovery?
In United States v. Heppner, No. 25 Cr. 503 (JSR) (S.D.N.Y. Feb. 17, 2026), Judge Jed S. Rakoff of the Southern District of New York ruled that a criminal defendant’s interactions with the AI platform “Claude” were protected by neither attorney-client privilege nor the work product doctrine.
The decision, while not necessarily precedential, serves as a significant warning to the legal community regarding the confidentiality risks inherent in public generative AI tools.
Background of the Dispute
The controversy arose within a criminal securities fraud prosecution. The government charged Bradley Heppner, an executive at GWG Holdings, Inc., with multiple counts of fraud and falsifying corporate records (Memorandum, p. 2). Following Heppner’s indictment and arrest in November 2025, the FBI executed a search warrant at his residence, seizing various electronic devices.
During the review of the seized materials, defense counsel asserted privilege over approximately thirty-one documents. These documents were not traditional emails to lawyers or handwritten notes; rather, they memorialized communications Heppner had with “Claude,” the generative AI platform operated by Anthropic (p. 3).
According to the defense, Heppner engaged with Claude after receiving a grand jury subpoena and understanding he was a target of the investigation. Heppner allegedly used the AI to prepare reports outlining his defense strategy and anticipating arguments regarding the facts and law (p. 3).
The defense argued these inputs incorporated information conveyed by counsel and were created for the express purpose of obtaining legal advice (pp. 3-4).
The government moved for a ruling that these “AI Documents” were not privileged. Judge Rakoff granted the motion from the bench during a pretrial conference and subsequently issued a written Memorandum explaining the court’s reasoning.
The Court’s Analysis: Unpacking the Privilege Claims
The court addressed two distinct legal theories: attorney-client privilege and the work product doctrine. The analysis for both turned on the nature of the relationship—or lack thereof—between a human user and an AI algorithm.
Attorney-Client Privilege: The Missing Elements
The court dismantled the claim of attorney-client privilege by applying the standard three-part test: the privilege requires a communication between a client and attorney, intended to be confidential, for the purpose of legal advice. Judge Rakoff found the AI Documents failed on all three fronts.
First, and perhaps most obviously, the court noted that “Claude is not an attorney” (p. 5). While this seems elementary, the court rejected the “functional equivalent” argument often used for non-attorney experts (such as accountants) who assist lawyers. The court observed that recognized privileges require “a trusting human relationship,” specifically with a professional bound by fiduciary duties and ethical rules. An AI platform satisfies none of these criteria.
Second, the court found that the communications were not confidential. This determination is particularly relevant for corporate counsel managing data security. Judge Rakoff pointed directly to Anthropic’s privacy policy, which users must accept. The policy stated that the company collects data on inputs and outputs to “train” the model and reserves the right to disclose data to third parties, including regulatory authorities (p. 6).
Because Heppner voluntarily disclosed his thoughts to a third-party platform that retains data in the ordinary course of business, he waived any expectation of confidentiality. As the court noted:
“Heppner could have had no ‘reasonable expectation of confidentiality in his communications’ with Claude. And the AI Documents are not like confidential notes that a client prepares with the intent of sharing them with an attorney because Heppner first shared the equivalent of his notes with a third-party, Claude” (p. 7).
Third, the court rejected the argument that Heppner used Claude to obtain legal advice. The opinion highlights that Claude itself creates a disclaimer stating, “I’m not a lawyer and can’t provide formal legal advice” (p. 8). Furthermore, the court emphasized that Heppner acted on his own volition. Had counsel directed Heppner to run specific searches on an AI tool to assist in legal representation, the analysis might have differed. However, because Heppner acted independently, his intent to eventually share the output with counsel did not retroactively privilege the initial interaction with the AI (p. 7).
The Work Product Doctrine: No “Zone of Privacy” for AI
The defense presented a more nuanced argument regarding the work product doctrine, which generally protects materials prepared in anticipation of litigation. Heppner argued that because he created these documents to aid his defense strategy after receiving a subpoena, they should be shielded.
Judge Rakoff disagreed, clarifying that the core purpose of the work product doctrine is to protect the attorney’s mental processes, not the client’s independent activities. The court relied on Second Circuit precedent establishing that the doctrine typically does not protect materials in a client’s possession unless they reflect the lawyer’s thinking or were prepared at the lawyer’s request.
The opinion explicitly states:
“The AI Documents do not merit protection under the work product doctrine because... they were nevertheless not ‘prepared by or at the behest of counsel,’... nor did they reflect defense counsel’s strategy” (p. 9).
The defense attempted to rely on Shih v. Petal Card, Inc., a 2021 decision from a Magistrate Judge in the same district, which had extended work product protection to communications between a plaintiff and her husband (who was also a lawyer) even without a formal direction of counsel. Judge Rakoff respectfully disagreed with Shih, reinforcing a stricter interpretation of the doctrine. He reasoned that extending protection to materials generated by a client on their own—without the direction of counsel—does not serve the doctrine’s goal of preserving a zone of privacy for the attorney (p. 11).
Because Heppner’s counsel admitted they “did not direct [Heppner] to run Claude searches,” the resulting documents were merely the defendant’s own statements to a third party, leaving them fully discoverable (p. 10).
Key Takeaways and Practical Implications
The Heppner decision provides the first clear judicial guidance on the intersection of generative AI and privilege. While this is a district court opinion, Judge Rakoff is a highly influential jurist, and other courts will likely look to this reasoning. For IP practitioners and business leaders, the decision necessitates immediate adjustments to data handling and litigation strategy.
1. The Terms of Service Are Dispositive
The court’s reliance on Anthropic’s privacy policy underscores a critical technical reality: “public” AI is not private. If a platform’s terms allow for data collection, human review, or training on user inputs, there is no reasonable expectation of confidentiality. In patent litigation, where trade secrets and sensitive technical data are paramount, attorneys must assume that any information entered into a public AI tool (like standard versions of ChatGPT, Claude, or Gemini) creates a permanent, discoverable record that constitutes a third-party waiver.
2. Direction of Counsel is the Dividing Line
The court left open a narrow potential avenue for protection. The opinion repeatedly emphasized that counsel “did not direct” the defendant to use the AI. This suggests that if an attorney directs a client (or an expert) to use a specific, secure AI tool as an agent of the lawyer to generate legal analysis, a work product argument might survive. However, this remains hypothetical. The safest course is for attorneys to perform AI-assisted work themselves or strictly supervise it using enterprise-grade tools with confidentiality agreements that preclude model training.
3. The “Software Argument” Failed
Heppner attempted to argue that using Claude is analogous to using a cloud-based word processor—a tool merely used to record thoughts. The court rejected this comparison. Unlike a passive text editor, generative AI involves an interaction with a distinct entity that processes, retains, and “learns” from the data under its own governance policies. Practitioners should not treat LLMs as passive software; the law treats them as third-party recipients of information.
4. Criminal vs. Civil Discovery
While Heppner is a criminal case, the principles regarding privilege waiver are directly applicable to civil patent disputes. In fact, the risk may be higher in civil litigation where the scope of discovery regarding relevance is broad. Inventors engaging with AI to brainstorm patent claims or refine technical descriptions prior to filing could inadvertently waive privilege or create prior art issues if those conversations are deemed public disclosures to a third party.
How Things Might Have Gone Differently
Judge Rakoff’s opinion invites a counterfactual analysis: could a defendant ever successfully claim privilege over AI interactions? The court’s reasoning suggests two potential pathways, though both remain fraught with risk.
First, the “agency” argument might have traction if the attorney explicitly directs the client to use the AI. The court heavily weighed the fact that Heppner acted on his “own volition” and that counsel “did not direct” the usage (p. 10). If an attorney were to instruct a client to “input this specific dataset into this specific tool to generate a summary for my review,” the argument that the AI is functioning as a sheer instrumentality of the lawyer’s strategy becomes stronger. However, this likely only cures the “work product” defect, not the confidentiality waiver inherent in the platform’s terms of service.
Second, the choice of platform matters. The court focused on Anthropic’s standard privacy policy, which allows for data training and third-party review (p. 6). Had the defendant used an enterprise-grade instance of an LLM with a contractual guarantee of zero data retention and no model training—effectively a “walled garden”—the “expectation of confidentiality” prong might have been satisfied. In that scenario, the AI looks less like a third-party confidant and more like a sophisticated, private calculator.
Other Open Questions
The decision also leaves open the status of specialized “Legal AI” tools. If a law firm provides a client with access to a proprietary legal AI assistant to help organize facts for the case, does that constitute a privileged environment?
While Heppner rules out privilege for public chatbots, it arguably distinguishes them from tools where the “trusting human relationship” (p. 6) is replaced by a trusting contractual relationship between the firm, the client, and the software provider.
Until those specific facts are litigated, however, the Heppner rule serves as the baseline: AI inputs are presumed public.
Conclusion
The Heppner decision reinforces that while technology evolves rapidly, fundamental legal principles remain stubborn. As Judge Rakoff concluded, “AI’s novelty does not mean that its use is not subject to longstanding legal principles” (p. 12).
For the IP community, the message is unambiguous: treat public AI chatbots as you would a stranger in a crowded coffee shop. Anything said to them is likely not confidential, and if that conversation is recorded, it will be available to opposing counsel.
Until specific “legal-grade” AI tools with robust non-disclosure architectures become the standard—and are tested in court—the presumption must be that no privilege attaches to the prompt and chat log.
Disclaimer: This is provided for informational purposes only and does not constitute legal or financial advice. To the extent there are any opinions in this article, they are the author’s alone and do not represent the beliefs of his firm or clients. The strategies expressed are purely speculation based on publicly available information. The information expressed is subject to change at any time and should be checked for completeness, accuracy and current applicability. For advice, consult a suitably licensed attorney and/or patent professional.