United States v. Heppner: The Ruling
1On February 10, 2026, Judge Jed S. Rakoff of the U.S. District Court for the Southern District of New York ruled from the bench that 31 documents a criminal defendant generated using Anthropic's Claude (the consumer version) were not protected by attorney-client privilege or the work product doctrine. Judge Rakoff issued a written opinion on February 17, 2026 explaining the decision.
2The court characterized the question as a "nationwide matter of first impression": whether communications with a publicly available AI platform during a pending criminal investigation are protected by privilege or work product. The answer was no on every ground the defense raised.
Background Facts
3Bradley Heppner, former executive of GWG Holdings, Inc., was indicted October 28, 2025 on charges of securities fraud, wire fraud, conspiracy to commit wire and securities fraud, giving false statements to auditors, and falsifying corporate records. The government alleged he looted more than $150 million from the company.
4After receiving a grand jury subpoena and engaging defense counsel from Quinn Emanuel, Heppner used the consumer version of Anthropic's Claude to prepare reports outlining his defense strategy and potential legal arguments. He did this of his own volition. His attorneys did not direct him to use Claude. He later shared the documents with his counsel.
5When FBI agents executed a search warrant at his residence following his arrest on November 4, 2025, they seized electronic devices containing the 31 AI-generated documents. Defense counsel identified the documents and asserted privilege. The government moved for a ruling that no privilege attached.
6The parties entered a Privilege Protocol Stipulation keeping the documents segregated pending resolution. On February 6, 2026, the government moved for a determination. Judge Rakoff heard argument on February 10 and ruled from the bench. The written opinion followed on February 17.
The Three Grounds
7Judge Rakoff held that Heppner's privilege claim failed on at least two of the three required elements of attorney-client privilege. Any one failure was sufficient to defeat the claim.
8Claude is not a licensed attorney. Heppner did not, and could not, maintain that Claude is an attorney. The court held that all recognized privileges require a trusting human relationship with a licensed professional who owes fiduciary duties and is subject to discipline. That relationship cannot exist with an AI platform. The communications were between Heppner and a software system, not between a client and counsel.
9This is the finding with the broadest implications beyond the Heppner facts. Anthropic's privacy policy expressly notifies users that it collects data on user inputs and Claude outputs to train its models, and reserves the right to disclose that data to third parties, including governmental regulatory authorities. Judge Rakoff held there was simply no reasonable expectation of confidentiality. The tool, in the court's words, "contains a provision that any information inputted is not confidential."
10The court noted this is not unique to Claude. OpenAI's privacy policy contains comparable provisions. A $20-per-month subscription, multiple post-ruling analyses noted, does not change the underlying terms. Only enterprise-tier agreements with contractual data handling terms offer different protections, and even those have been subject to scrutiny in subsequent proceedings.
11Heppner communicated with Claude of his own volition. His counsel did not direct him to run the searches. The AI tool itself explicitly disclaims the ability to provide formal legal advice or make legal recommendations. The government specifically highlighted Claude's terms in this regard. The court held the communications were not made for the purpose of obtaining legal advice from a licensed professional.
12The work product doctrine protects materials prepared by counsel, or at counsel's direction, in anticipation of litigation. Defense counsel conceded that Heppner created the documents of his own volition and that the legal team did not direct him to run the AI searches. Without attorney direction, the core purpose of the doctrine (protecting the mental processes and strategy of attorneys) was absent. The documents did not reflect the mental processes of his attorneys at the time of creation.
13The court expressly disagreed with a prior SDNY magistrate judge decision that had extended work product protection to materials generated by non-lawyers without attorney direction. Judge Rakoff held that the core purpose of the doctrine is to protect lawyers' mental processes, and that protection did not extend here.
The Open Question the Court Left
14Judge Rakoff noted that had counsel directed Heppner to use Claude, the analysis might differ. Claude might then have functioned "in a manner akin to a highly trained professional who may act as a lawyer's agent within the protection of the attorney-client privilege" under the Kovel doctrine. That question was not before the court and was not decided.
15The Kovel doctrine extends privilege to communications with nonlawyer agents whose assistance is necessary to facilitate the attorney-client relationship, provided the agent operates under counsel's direction and confidentiality is maintained. Whether an AI tool used at counsel's direction, inside a private system with contractual data handling terms, could qualify as a Kovel agent is a question courts have not yet addressed.
Limitations and Counterarguments
16Heppner's reasoning is narrower than headlines suggest. The ruling does not hold that AI use automatically destroys privilege. It holds that a non-lawyer using a public consumer platform, without attorney direction, and without any reasonable expectation of confidentiality under the platform's own terms, fails the foundational requirements for privilege. Remove any one of those facts and the analysis changes.
17Judge Rakoff himself noted that the result might differ if counsel had directed the AI use. In that circumstance, the platform could arguably function as an agent of counsel under the Kovel doctrine, which extends privilege to communications with nonlawyer agents whose assistance is necessary to the attorney-client relationship. That question remains unresolved.
18One week before Heppner, the Eastern District of Michigan reached a different result in Warner v. Gilbarco, No. 2:24-cv-12333 (E.D. Mich. Feb. 10, 2026). There, AI-generated materials prepared in litigation were protected as work product because they were produced at counsel's direction. Warner and Heppner are consistent: the distinguishing factor in both cases is attorney direction and supervision, not AI use itself.
19Legal scholars have raised a broader structural objection. The privilege analysis in Heppner applies traditional third-party disclosure doctrine to a technology that did not exist when that doctrine was developed. A platform that disclaims confidentiality in its terms of service is treated the same as a friend to whom you disclosed the communication in casual conversation. Critics argue this conflates legal fiction with practical reality: users do not experience AI platforms as public disclosures, and the law has not yet developed a framework that accounts for the difference between disclosure to a human third party and submission to a computational system.
20The counterargument from AI skeptics and those opposed to unregulated AI in legal practice converges on the same point from a different direction: if AI platforms cannot preserve privilege, that is a feature, not a flaw. The inability to cloak AI-assisted work in privilege creates a transparency obligation that may be appropriate given the documented risks of AI hallucination, bias, and unverified output in legal proceedings. The question of whether AI use should be privileged is, on this view, a policy question courts have not yet addressed as such.
21None of these counterarguments disturbs the holding. Heppner is decided on its facts. The question going forward is how far its reasoning extends, and whether enterprise AI tools with contractual confidentiality protections, operated at counsel's direction inside a client's own infrastructure, will be treated differently. That question is now before every litigator who has adopted AI in practice.