Skip to content
Zrico
Menu

For law firms

Are AI Chats Privileged? What Heppner Held

What United States v. Heppner held about a client's AI chats, privilege and work product, what is still open, and practical steps for firms and clients.

Updated 7 min read

On February 17, 2026, Judge Jed S. Rakoff of the Southern District of New York filed a 12-page memorandum in United States v. Heppner, No. 25 Cr. 503 (JSR). It explains a ruling he made from the bench on February 10: a criminal defendant’s written exchanges with a generative AI platform were not protected from the government by attorney-client privilege or by the work product doctrine. The court called it a question of first impression nationwide. This guide is based on the opinion itself, filed as ECF No. 27.

What happened

Bradley Heppner was indicted in October 2025 on securities fraud, wire fraud and related charges. When FBI agents arrested him in November 2025, they searched his home and seized documents and devices. His lawyers later told the government that about 31 of the seized documents recorded his conversations with Claude, the AI platform run by Anthropic.

According to defense counsel, those conversations took place in 2025, after Heppner had received a grand jury subpoena and knew he was a target. On his own, he used Claude to prepare reports outlining defense strategy and what he might argue on the facts and the law. Counsel said he had entered information learned from his lawyers, created the documents in order to talk with counsel, and later shared them with counsel. Counsel also conceded that they did not direct him to run the Claude searches.

What the court held on privilege

The court applied the usual three-part test: a communication between client and attorney, intended to be and actually kept confidential, for the purpose of getting legal advice. It found the AI documents failed at least two of the three elements, and likely all three.

No attorney. Claude is not a lawyer, and the court said that alone disposed of the privilege claim. It rejected the argument that AI prompts are just like using cloud word processing software, noting that such software is not privileged either. Recognized privileges rest on a trusting human relationship with a licensed professional who owes fiduciary duties and is subject to discipline.

Not confidential. This is where the tool’s terms came in. The court pointed to the Anthropic privacy policy in effect as of February 19, 2025, which users accept. As the court read it, the policy said Anthropic collects users’ inputs and Claude’s outputs, uses that data to train Claude, and may disclose it to third parties, including governmental regulatory authorities and in connection with claims, disputes or litigation, even without a subpoena. On those terms, the court held Heppner could have had no reasonable expectation of confidentiality. The documents were also unlike private notes a client prepares for a lawyer, because he first shared the equivalent of his notes with a third party.

Not for legal advice from Claude. The court called this element a closer call. Because Heppner acted on his own, what mattered was whether he sought legal advice from Claude, not whether he later gave the output to his lawyers. Claude itself disclaims giving legal advice.

Sending the documents to counsel afterward did not help. Documents that are not privileged in a client’s hands do not become privileged because they are handed to a lawyer.

A footnote goes further. Even if some of what Heppner typed in was privileged, such as information from his lawyers, the court said he waived privilege over it by sharing it with Claude and Anthropic, as he would by sharing it with any other third party.

What the court held on work product

Work product protects materials prepared by or at the behest of counsel in anticipation of litigation. Even assuming the documents were prepared in anticipation of litigation, the court held they were not protected. They were not prepared at counsel’s direction, and they did not reflect counsel’s strategy when they were created. Counsel conceded the documents later affected strategy but did not reflect it. The court also expressly disagreed with Shih v. Petal Card, a 2021 decision from the same district that did not require attorney direction.

What is still unsettled

It is one trial court ruling. Heppner does not bind other courts. We did not find an appellate decision on the question as of this update.

Other courts have protected AI work product. Crowell & Moring’s tracker reports two civil decisions involving self-represented litigants. In Warner v. Gilbarco (E.D. Mich., February 10, 2026), the court held a pro se plaintiff’s ChatGPT materials were protected work product and that using ChatGPT did not waive protection. In Morgan v. V2X (D. Colo., March 30, 2026), the court held that a pro se party’s AI-assisted litigation work can be protected under Federal Rule of Civil Procedure 26(b)(3). We have not read those two opinions ourselves, so treat this as reported.

Counsel-directed use. The court said that had counsel directed Heppner to use Claude, Claude “might arguably” be treated like an agent working for the lawyer, citing the Kovel line of cases. That is a comment, not a holding.

Different terms. The confidentiality analysis relied partly on a consumer privacy policy that allowed training and broad disclosure. The court did not decide how it would treat a tool with different terms. Stronger terms may bear on confidentiality, but they do not supply a lawyer, and the court’s first reason did not depend on the terms at all.

Lawyers’ own use. The case was about a client acting alone. It did not address a lawyer using AI to prepare a case.

Steps for firms

  1. Warn clients early, in writing. Tell clients not to put facts about their matter, or your advice, into consumer AI tools such as personal ChatGPT, Claude or Gemini accounts. Explain that those chats can be seized or demanded and may not be protected.
  2. Ask clients to check with you first. If AI work on the matter would help, you decide on it, direct it and document that direction.
  3. Add engagement letter language. For example: “Please do not enter information about this matter, or our communications with you, into any public or consumer artificial intelligence tool. A federal court has held that such use was not protected by the attorney-client privilege or the work product doctrine, and it may waive protection over what you share. Talk to us first if you want to use such a tool.” Adapt it to your jurisdiction.
  4. Use firm-controlled tools for firm work. Use tools the firm administers under business terms, read those terms, and record what they say about training, retention and disclosure. This supports your confidentiality duties under ABA Formal Opinion 512 and your state’s rules. It does not by itself make anything privileged.
  5. Ask about AI in discovery. Before you serve a privilege log, ask your client what AI chats exist. Consider asking the other side about theirs.
  6. Watch for new rulings. Revisit your client guidance when an appellate court addresses the question.

Steps for clients

  • Do not use an AI chatbot to work through your legal problem, build a timeline or summarize your lawyer’s advice unless your lawyer has asked you to and told you which tool to use.
  • Do not paste emails or memos from your lawyer into an AI tool.
  • Assume anything you type into a consumer AI service could be read by others, including the government or the other side.
  • If you have already done this, tell your lawyer. Do not delete anything before you talk to them.

How Zrico fits

Zrico gives each firm its own private workspace, with its own application and databases, so firm AI work happens in a tool the firm controls rather than in personal accounts. Claude is the default and is processed only in the US. GPT and Gemini are off unless the firm owner turns them on, and their processing is not limited to the US. No AI provider (Anthropic, OpenAI or Google) trains on prompts, files or answers. Sign-in is invite-only with two-factor authentication, required for admins, and the firm has a usage and audit report and retention settings. Microsoft 365 sign-in and client-name masking are coming soon. Zrico has no SOC 2, ISO or HIPAA certification and does not make a firm compliant. Using Zrico, or any other tool, does not decide whether privilege or work product applies; that depends on the facts and the court. Every output must be reviewed by a lawyer.

Sources

General information, not legal advice. Check the current rules in your jurisdiction.

Give your firm a private place to use AI.

$39 per seat per month after a 30-day free trial, 5-seat minimum. Your workspace is ready minutes after you sign up.

Your card is charged when the trial ends. Cancel any time before then and you pay nothing.

Start 30-day free trial