/Passle/6862a7c82f493872278415a8/SearchServiceImages/2026-02-19-16-27-26-913-699739ee5e7746f10b79cfd6.jpg)
In a significant decision rendered this week, Judge Jed S. Rakoff of the Southern District of New York held that written exchanges between a criminal defendant and a generative AI platform were protected by neither attorney-client privilege nor the work product doctrine. United States v. Heppner, 25 Cr. 503 (JSR) (S.D.N.Y. Feb. 17, 2026).
The ruling is one of the first federal decisions squarely addressing privilege in the context of generative AI — and it carries immediate implications for defense counsel and corporate and industrial clients navigating litigation risk in an AI-saturated world. The source of the Heppner decision (the often-influential Southern District of New York) further underscores its significance.
The Core Ruling: AI Is a “Third Party”
Judge Rakoff described the question as one “of first impression nationwide”: whether communications with a publicly available AI platform in connection with a pending criminal investigation are protected by attorney-client privilege or work product doctrine (Order at 2).
The court’s answer was direct: “the answer is no” (Order at 2).
The defendant had used Anthropic’s Claude to generate written analyses outlining potential defense strategies after receiving a grand jury subpoena and after discussions with the government made clear he was a target (Order at 3). Claude is a “Large Language Model,” similar to ChatGPT and Google Gemini.
The defendant later shared those AI-generated documents with counsel. The government sought a ruling that the materials were not privileged.
The court began by reciting the traditional elements of attorney-client privilege: communications between client and attorney, intended to be confidential, and made for the purpose of obtaining legal advice (Order at 4). The AI documents failed on multiple grounds.
1. AI platforms are not attorneys.
The court emphasized that the AI documents were “not communications between Heppner and his counsel” and that “Claude is not an attorney” (Order at 5). Because discussions of legal issues with non-attorneys are not privileged, that fact alone was dispositive (Order at 5).
Privilege depends on a “trusting human relationship” with a licensed professional owing fiduciary duties – and no such relationship exists with an AI platform (Order at 6).
2. No reasonable expectation of confidentiality.
The court also found that the defendant lacked any reasonable expectation of confidentiality in his interactions with Claude. The court relied on Claude’s privacy policy, noting it permits collection of user inputs and outputs, use of data to train models, and disclosure to third parties, including governmental authorities (Order at 6).
Critically, the court held that forwarding the AI outputs to counsel does not retroactively cloak them in privilege. Because the communications were not privileged “at the time they took place,” they did not become privileged merely because they were later shared with an attorney (Order at 8).
3. Any privilege was waived.
The defendant’s final argument was that much of the information he inputted into Claude constituted information he had received from his counsel, thus making it privileged and confidential. The court disagreed, holding that even if privilege had attached to the information at one point, the defendant waived the privilege by inputting the information into Claude, “just as if he had shared it with any other third party.” (Order at 8, footnote 3). The court rejected the defendant’s proposed analogy that inputting privileged information into an AI model was the equivalent of saving or transmitting it via other cloud-based platforms (e.g., an e-mail server or a file-sharing service) – while other digital platforms may offer an expectation of privacy, Claude does not. (Order at 5-8).
4. Work product doctrine does not attach to interactions with AI platforms.
The court then turned to work product doctrine, which protects materials prepared “by or at the behest of counsel in anticipation of litigation” (Order at 9).
Even assuming the AI documents were created in anticipation of litigation, they still failed the doctrine’s core requirement – they were not prepared “by or at the behest of counsel” (Order at 9). Rather, they were prepared by the defendant “on his own volition,” and they did not reflect counsel’s strategy at the time they were created (Order at 10). The court’s ruling adheres to the general rule that the work product doctrine exists to protect lawyers’ mental processes.
The Conclusion: AI Is Subject to Traditional Privilege Rules
Judge Rakoff closed with a measured but clear statement: AI may represent a “new frontier,” but that “does not mean that its use is not subject to longstanding legal principles” governing attorney-client privilege and work product doctrine (Order at 12). Because the defendant’s use of Claude did not satisfy those principles, the materials were discoverable (Order at 12).
Lingering Questions
The Heppner court did not address several followup questions, which will inevitably be litigated in future cases, such as:
- Would the result have been different if the defendant had used a “closed” AI platform (i.e., one guaranteeing confidentiality) versus an “open” platform such as Claude?
- What is the scope of the defendant’s waiver of privilege – i.e., does inputting privileged information into a third-party AI platform effect a broader subject-matter waiver, potentially exposing related communications between client and counsel on the same topic?
- Even if discoverable, are such conversations admissible under relevance principles, particularly where the exchanges reflect exploratory brainstorming rather than concrete information?
- Are a litigant’s conversations with an AI platform a “statement of a party” and potentially a “statement against interest” under the hearsay rules? What about the responses of the AI platform?
- Would the result be different if a litigant interacts with an AI platform provided by counsel or at the direction of counsel?
What This Means for Corporate Litigants and Their Counsel
Companies increasingly use AI to analyze crisis response, draft public statements, or evaluate regulatory exposure after a catastrophe. Heppner makes clear:
- AI-generated internal strategy documents may be discoverable.
- Consumer-grade AI platforms create confidentiality risk.
- If AI is used in litigation contexts, counsel should consider directing and controlling its use, and alleged contractual protections should be evaluated carefully.
For corporate actors navigating high-stakes public events — environmental incidents, product recalls, regulatory investigations — Heppner is a wake-up call: AI is not a privileged advisor.
For defense lawyers, Heppner makes clear that the universe of discoverable information is continuing to expand. Lawyers should consider advising their clients on the risk of inadvertently creating discoverable information (or waiving privilege over otherwise privileged information) by interacting with AI platforms.
Lawyers should also consider Heppner when evaluating the cost and risk involved in defending a piece of litigation. They should consider engaging in early conversations with their clients about what AI-related paper trails exist, to avoid costly surprises once litigation reaches advanced stages.
For further questions regarding the Heppner decision and related AI and privilege issues, contact Liskow attorney Michael Mims and visit our Environmental and Toxic Tort practice pages.
[E]ven if certain information that Heppner input into Claude was privileged, he waived the privilege by sharing that information with Claude and Anthropic, just as if he had shared it with any other third party.