Is ChatGPT or Claude Privileged? What United States v. Heppner Means for Every Lawyer (2026)

On February 10, 2026, a federal judge in Manhattan ruled — for the first time in the United States — that documents a criminal defendant created by typing prompts into a consumer AI chatbot were neither privileged nor protected work product, and could be turned over to prosecutors. The case is United States v. Heppner, No. 25-cr-00503-JSR, decided by U.S. District Judge Jed S. Rakoff of the Southern District of New York, with a written opinion issued February 17, 2026. For every lawyer who has ever pasted case facts into ChatGPT or Claude, this ruling is a wake-up call — and a roadmap.

Here is the reassuring part, stated plainly before we get into the law: the court did not hold that lawyers cannot use AI. It held that this defendant, using AI this way, forfeited protection. Change the facts — attorney direction, the right tool configuration, no raw client data — and the analysis changes too. This article walks through exactly what happened, why the court ruled the way it did, and the concrete steps that keep your AI work inside the privilege.

What Happened in United States v. Heppner

The underlying case is a white-collar prosecution. Heppner was charged with securities fraud and wire fraud. The indictment came down on October 28, 2025; he was arrested on November 4, 2025, the same day a search warrant was executed. The privilege fight that made the case famous came later: on February 6, 2026, the government filed a motion challenging Heppner's claim of privilege over a set of AI-generated documents. Judge Rakoff granted that motion in an oral ruling from the bench on February 10, 2026, and followed with a written opinion on February 17, 2026.

What were the documents? Acting on his own, without the direction of his attorney, Heppner had submitted prompts to a consumer (non-enterprise) version of Claude, Anthropic's AI assistant, to "organize and synthesize information" relevant to his defense. Those prompts included details he had learned during discussions with his lawyer. Over the course of this work he generated 31 documents intended, in his words, to "consolidate his thoughts and facilitate future communications with counsel." He then shared those documents with his attorneys.

When the government sought the documents, the defense asserted that they were protected by the attorney-client privilege and the work product doctrine. The court disagreed on both counts. Because no court had squarely addressed whether AI-generated materials of this kind are privileged, Judge Rakoff described the issue as a "question of first impression nationwide."

The pivotal fact in Heppner is not that AI was involved. It is that the defendant used the AI unilaterally — without his lawyer directing the work — on a consumer platform whose terms permitted data collection and disclosure. Those two facts, more than the technology itself, drove the outcome.

Why the Court Ruled the AI Documents Were Not Privileged

The attorney-client privilege protects confidential communications between a client and a lawyer made for the purpose of obtaining legal advice. Judge Rakoff found that the AI-generated documents failed that test on three independent grounds. Any one of them would have been enough; all three were present here.

1. There Was No Attorney-Client Relationship — Because the AI Is Not a Lawyer

The privilege protects communications with an attorney. The AI, the court reasoned, "was not a lawyer and could not establish an attorney-client relationship." Privilege requires "a trusting human relationship" with "a licensed professional." A chatbot, however capable, is neither human nor licensed. When Heppner typed his thoughts into the tool, he was not communicating with his lawyer — he was communicating with a software product owned by a third party. That communication simply does not fit the legal definition the privilege is built around.

2. There Was No Reasonable Expectation of Confidentiality — The Privacy Policy Said So

Privilege also requires that the communication be confidential. The court looked at the platform's privacy policy and found that it defeated any reasonable expectation of confidentiality. According to the opinion, the policy disclosed that the platform "collects users' inputs and outputs, uses that data to train its model," and "reserves the right to disclose such data to multiple categories of third parties, including the government."

In plain terms: you cannot expect a conversation to stay secret when the service you are using tells you, in its own terms, that it may read your inputs, train on them, and hand them to the government. Confidentiality is the bedrock of the privilege, and the terms of service knocked that bedrock out.

3. There Was No Purpose of Obtaining Legal Advice

Finally, the privilege protects communications made to obtain legal advice. But the tool's terms "expressly disclaimed that it is not a lawyer and cannot provide formal legal advice." The court noted that when the tool was asked directly, it confirmed it could not give legal advice. You cannot seek legal advice from something that tells you, repeatedly, that it does not give legal advice. So the third element of the privilege failed too.

There is one more principle worth pulling out, because it is the trap that catches most people: documents that are "not privileged at the time they are made do not acquire protection merely because they were transferred to counsel." Heppner shared his 31 documents with his lawyers, but handing an unprivileged document to your attorney does not retroactively wrap it in privilege. The protection has to exist at the moment of creation. It did not.

What About the Work Product Doctrine?

The defense had a backup argument. Even if the documents were not privileged, they might still be protected as work product — materials prepared in anticipation of litigation. The court rejected this too, and the reasoning is important for understanding how to do it right.

The court found the materials were "prepared by the defendant on his own volition," not at the direction of his attorney. That is the crux. The work product doctrine exists to protect a lawyer's strategic thinking and mental impressions from disclosure to an adversary. While Heppner's documents "may have influenced counsel's thinking going forward," they did not "embody or memorialize counsel's strategic analysis when they were generated." In other words: they captured the client's thoughts, generated unilaterally, before any lawyer had shaped them into strategy. That is not work product.

Read the privilege ruling and the work product ruling together and a single theme jumps out: attorney direction is the dividing line. The court expressly observed that attorney-directed use "may have" produced a different result. That is the door the ruling leaves open — and it is exactly the door this article is about.

Is This the End of Using AI in Legal Practice? No.

It is easy to read a headline about Heppner and conclude that AI and the attorney-client privilege are fundamentally incompatible. That is the wrong lesson. Heppner is not a holding that "AI waives privilege." It is a holding that a specific pattern of use waives privilege: a client, acting alone, without counsel's direction, on a consumer tool whose terms permit data collection and third-party disclosure, with no expectation of confidentiality and no genuine purpose of obtaining legal advice.

Almost every one of those facts is something a careful lawyer controls. You decide whether the AI is used at your direction. You decide which tool, and on what data terms. You decide whether raw client identifiers ever touch a prompt. The court itself signaled that attorney-directed use "may have" changed the outcome — an explicit invitation to do it correctly.

It is worth noting that the ruling is not without its critics. Commentators writing in venues such as Lawfare and the Harvard Law Review have questioned whether a platform's privacy policy should be treated as dispositive on the confidentiality question, and have argued against a rigid legal distinction between "consumer" and "enterprise" AI when reasonable safeguards are in place. They point to the framework in ABA Formal Opinion 477R, which already addresses confidential information transmitted over the internet and the cloud, requiring lawyers to take reasonable steps and exercise due diligence over vendors rather than apply categorical bans. Separately, ABA Formal Opinion 512 requires lawyers to advise clients about the security risks of AI use. These are live debates — present them as commentary and professional guidance, not as the holding of the court. The holding is narrow; the best practices below are how you stay on the right side of it.

How to Use AI Without Waiving Privilege: A Practical Checklist

This is the part that matters for your practice. Drawing on the reasoning in Heppner and on guidance from firms that advise on legal technology (including published analysis from Gibson Dunn), here is how to keep AI-assisted work inside the privilege and the work product doctrine. Treat it as a checklist, not a buffet — the protection is strongest when these steps stack.

1. Use AI only at the attorney's direction. This is the single most important factor. The Heppner court repeatedly emphasized that the defendant acted unilaterally, and expressly noted that attorney-directed use "may have" produced a different result. When the lawyer directs the AI work — defining the task, framing the questions, and shaping the output into strategy — the materials are far more likely to qualify as privileged communications or work product. Do not let clients freelance with AI on their own case and hand you the results.
2. Choose an enterprise or closed-environment deployment for sensitive matters. The privacy policy sank Heppner. For confidential work, use enterprise AI deployments or closed environments governed by zero-data-retention and no-training agreements. These are exactly the terms a consumer chatbot lacks. The difference between "we may train on your data and disclose it to the government" and "we retain nothing and never train on your inputs" is the difference between a reasonable expectation of confidentiality and none at all.
3. Read the service agreement — data access, retention, and secondary use. Before adopting any AI tool for client work, review the vendor's terms specifically on three points: who can access your inputs, how long they are retained, and whether they can be used for any secondary purpose (including model training). If the answers are not acceptable, the tool is not acceptable for confidential matters.
4. Turn on every opt-out and no-training setting available. Many platforms offer settings that disable training on your inputs or limit data retention. Enable them. Document that you enabled them. This is the concrete, demonstrable due diligence that ABA Formal Opinion 477R contemplates.
5. Never paste raw, client-identifying data into a public AI tool. Anonymize and abstract before you prompt. Strip names, account numbers, dates, addresses, and any other identifiers. If your prompt can be read by a stranger without revealing who the client is or what the matter concerns, you have dramatically reduced your exposure — even if the worst happens and the conversation is later disclosed.
6. Document that the AI was used at counsel's direction and reflects counsel's mental impressions. Work product protects the lawyer's strategic analysis. So make the record show that the AI output was generated at your direction and embodies your strategic thinking — not a client's solo brainstorming. Contemporaneous documentation of who directed the work and why is part of what separates protected work product from unprotected client notes.

Notice that none of these steps require you to abandon AI. They require you to use it like a professional handling confidential information — the same way you already handle email, cloud storage, and outside vendors. For the broader picture of how to choose tools that support this discipline, see our guide to the best AI tools for lawyers in 2026.

Consumer vs Enterprise AI Tools: The Distinction the Court Drew

The heart of the Heppner confidentiality analysis was the consumer tool's privacy policy. So it is worth being precise about what separates a consumer AI product from an enterprise one — and why the distinction is contested.

A fair caveat: as the critics noted above, some commentators argue there should be no rigid legal line between consumer and enterprise AI when reasonable safeguards exist — that the real question is whether the lawyer took reasonable steps, not which product label the tool carries. That debate will play out in future cases and bar opinions. But until it does, the practical lesson from Heppner is unambiguous: the tool you choose, and the data terms attached to it, materially affect whether your work stays confidential. When in doubt, treat consumer chatbots as you would a postcard, and reserve sensitive matters for properly configured environments. Your obligations here also intersect with your broader duties — see our overview of AI legal ethics and bar association guidelines.

Conclusion: Discipline, Not Abstinence

United States v. Heppner is the first nationwide ruling to confront whether AI-generated documents are privileged, and its answer was no — on the specific facts before the court. But the facts are the whole point. A client used a consumer tool, alone, without his lawyer's direction, on terms that permitted data collection and government disclosure, with no real expectation of confidentiality and no genuine pursuit of legal advice. Strip away those facts and the ruling does not condemn AI in legal practice. It condemns careless AI use.

The disciplined alternative is straightforward: direct the work yourself, choose tools with the right data terms, turn on no-training settings, document attorney direction, and never let raw client identifiers touch a prompt. Do that, and you capture the genuine productivity of AI while keeping your work where it belongs — inside the privilege. The lawyers who get sanctioned and the lawyers who get an edge will, increasingly, be separated by exactly these habits. (For the related risk of AI-fabricated citations, see our analysis of AI hallucinations in legal work and how to avoid sanctions.)