Revisiting Heppner: IP Practitioner Takeaways from the 'No AI Privilege' Opinion
For a couple years, many members involved in the legal profession have operated under a hazy assumption regarding generative AI: as long as the output is used for legal work, surely the input is privileged. That haze has now cleared, revealing a harsh landscape for the unprepared practitioner. The SDNY ruled that the AI communications are not necessarily privileged or work product.
In United States v. Heppner, Judge Jed S. Rakoff of the Southern District of New York issued a memorandum opinion that will likely serve as the foundational text for AI privilege disputes.
By ruling that a criminal defendant’s communications with Anthropic’s “Claude” were protected by neither attorney-client privilege nor the work product doctrine, the court has put practitioners on notice.
The opinion is not just a ruling on facts; it is a roadmap of what not to do. For litigators and corporate counsel, here are the essential takeaways from the Heppner decision.
1. The “Behest” Requirement is Non-Negotiable
The most significant finding for practitioners regarding the work product doctrine lies in the concept of “direction.” The defendant, Heppner, lost his work product claim largely because he acted independently.
The court emphasized that the documents “were prepared by the defendant on his own volition” (p. 10). Crucially, the court cited defense counsel’s own admission that they “did not direct [Heppner] to run Claude searches” (p. 10). Because of this lack of direction, the materials could not be said to be “prepared by or at the behest of counsel” (p. 9).
The Takeaway: To preserve a work product claim over AI-generated material, the attorney must be the architect of the interaction. Passive receipt of AI outputs generated by a client is insufficient. Practitioners should consider explicitly memorializing instructions to clients or consultants (and updating it if/when things change).
If AI is to be used, the engagement letter or a specific directive should state: “Client is directed to use [Specific Enterprise Tool] to organize these specific facts to assist Counsel in rendering legal advice.” Without that explicit “behest,” the court views the AI output as a mere client diary entry—fully discoverable.
2. The Terms of Service constitute a “Third-Party Waiver”
Practitioners often focus on the content of the communication, but Judge Rakoff focused on the contract governing the tool. The court dismantled the privilege claim by reading the platform’s Privacy Policy.
The court noted that the policy allowed the vendor to “collects data on both users’ ‘inputs’ and Claude’s ‘outputs’” and to use that data to “’train’ Claude” (p. 6). Most damningly, the policy reserved the right to “disclose personal data to third parties” (p. 6).
Based on these standard terms, the court held:
“Heppner could have had no ‘reasonable expectation of confidentiality in his communications’ with Claude” (p. 7).
The Takeaway: Standard, public-facing AI tools (the free or “pro” versions of ChatGPT, Claude, Gemini, etc.) are effectively crowded elevators. Practitioners must audit the tools their firms and clients use. If the Terms of Service (ToS) allow for model training or third-party review, privilege is likely waived the moment the “Enter” key is pressed. Practitioners must migrate to “Enterprise” or “API” tiers where data retention is contractually zero. As the court noted, privilege requires a reasonable expectation of privacy; a ToS that permits data mining destroys that expectation.
3. The “Alchemy” of Privilege
A dangerous misconception among clients (and some lawyers) is that sending a document to a lawyer retroactively shields it. Heppner forcefully rejects this.
The defendant argued that because he shared the AI outputs with his counsel to discuss strategy, they became privileged. Judge Rakoff called this a legal impossibility:
“[I]t is black-letter law that non-privileged communications are not somehow alchemically changed into privileged ones upon being shared with counsel” (p. 8).
The Takeaway: Practitioners must educate clients immediately: do not “prep” for our meeting by chatting with a bot. If a client creates a timeline of events using a public AI tool and then emails it to counsel, the email is privileged, but the underlying chat session logged on the AI server is not. That session remains a discoverable record of the client’s raw, unfiltered thoughts and admissions—a potential goldmine for opposing counsel.
4. No “Functional Equivalent” Protection for AI
Litigators often extend privilege to non-attorneys (accountants, interpreters) who are necessary to facilitate the attorney-client representation, known as the Kovel doctrine. Heppner draws a bright line: AI does not qualify.
The court reasoned that recognized privileges require “a trusting human relationship,” specifically with a professional who “owes fiduciary duties and is subject to discipline” (p. 6). The opinion bluntly states:
“Heppner does not, and indeed could not, maintain that Claude is an attorney” (p. 5).
The Takeaway: Do not rely on Kovel or “agency” theories to protect AI interactions unless the tool is a completely closed loop under the attorney’s direct control. You cannot deputize a public algorithm as a member of the legal team. If you need an AI analysis to be privileged, it must be generated by the legal team using secure tools, not by the client using public ones.
5. Distinction from the Shih Analysis
Defense counsel attempted to rely on Shih v. Petal Card, Inc., a prior S.D.N.Y. decision that extended work product protection to communications prepared without counsel’s specific direction. Judge Rakoff “respectfully disagree[d]” with Shih (p. 11).
He reaffirmed a stricter standard: the doctrine protects the lawyer’s mental processes, not the client’s independent anxieties or preparations.
“Because the AI Documents were not prepared at the behest of counsel and did not disclose counsel’s strategy, they do not merit protection as work product” (p. 12).
The Takeaway: Reliance on permissive, magistrate-level decisions regarding new technology is risky. Heppner signals a return to basics: the Work Product Doctrine is a narrow exception. Practitioners should assume that courts will apply these “longstanding legal principles” (p. 12) strictly, rather than expanding them to accommodate new tech behaviors.
Conclusion: The New Standard of Care
The Heppner memorandum concludes with a warning: “AI’s novelty does not mean that its use is not subject to longstanding legal principles” (p. 12).
For practitioners, this opinion apparently establishes a new standard of care for competence in the AI age:
Direct the Work: Never let a client use AI for legal tasks “on their own volition” if you want to claim privilege.
Read the TOS: If the tool “trains” on data, it is a privilege sieve.
Control the Tool: Privilege survives best when the lawyer holds the keys to the software.
The days of treating AI as a “magic box” (if there ever was) are over. It is now just another third party—and one that remembers everything.
Disclaimer: This is provided for informational purposes only and does not constitute legal or financial advice. To the extent there are any opinions in this article, they are the author’s alone and do not represent the beliefs of his firm or clients. The strategies expressed are purely speculation based on publicly available information. The information expressed is subject to change at any time and should be checked for completeness, accuracy and current applicability. For advice, consult a suitably licensed attorney and/or patent professional.