When Chatbots Meet Confidentiality: Attorney-Client Privilege Risks in the Age of AI
In USA v. Heppner, Docket. No. 25-cr-00503 in the Southern District of New York, Judge Rakoff granted a government motion for a ruling that certain exchanges the defendant had with the commercial AI tool Claude were not protected by attorney client or work product privilege. This decision offers a roadmap for how courts may treat communications with generative AI when clients use those tools to analyze or discuss legal issues and then share the results with their attorneys.
Background
In connection with the defendant’s arrest for charges including securities fraud and wire fraud, the government executed a search warrant and seized documents and electronic devices from the defendant’s home. The defendant’s counsel argued that some of these devices contained privileged communications. Defense counsel told the government that the defendant ran queries after learning he was the target of an investigation, including possible defense strategies, through an AI tool (Anthropic’s Claude). The resulting prompts and answers (the “AI Documents”) resided on devices seized under the warrant, and the defendant had shared those AI Documents with his attorneys.
The government agreed to separate these documents and not review them pending a resolution of the issue, and subsequently moved for a ruling that the documents are neither protected by attorney-client privilege nor work product privilege.
The Court’s Decision
In a ruling granted from the bench on February 10, 2026 and set forth in a written decision on February 17, 2026, Judge Rakoff agreed with the government’s arguments that the AI Documents were not privileged.
Courts won’t extend privilege to AI tools that lack confidentiality and attorney involvement.
As the court’s ruling noted, attorney-client privilege is intended to protect communications from disclosure when they are (1) between a client and an attorney, (2) intended to be and kept confidential, and (3) for the purposes of obtaining legal advice. Work-product protection prevents disclosure of documents that are prepared by or at the request of an attorney in anticipation of litigation or trial.
The decision found that the AI Documents were not protected by attorney-client privilege for the following reasons:
The AI tool is not an attorney, and any communications between the defendant and the AI tool are not communications between an attorney and a client.
The communications in the AI documents are not confidential. Claude’s written privacy policy puts users on notice that users’ inputs, and Claude’s outputs, may be used to train Claude. Anthropic, the company that operates Claude, reserves the right to disclose this data to third parties.
The Court found that the defendant did not communicate with Claude to obtain legal advice. Although the Court described this as a “closer call,” the decision notes that the defendant created the material on his own without his attorney’s direction, and that sending non-privileged documents to the attorney did not make them privileged.
The Court also found that the documents were not protected work product because they were not prepared by or at the request of the defendant’s attorney. Although defense counsel argued that the defendant included in his AI prompts information learned from his attorneys and created the AI Documents for the express purpose of speaking with his attorneys and obtaining legal advice, the defendant acted on his own, not at the direction of his attorneys, when creating the AI Documents.
However, the decision also noted that this motion was made in the context of documents seized under a search warrant, and did not discuss how the arguments would apply in the context of pre-trial discovery.
AI platforms don’t satisfy the traditional privilege requirements.
Practical implications
Don’t treat a public AI platform like an extension of your legal team. If you want to use AI to help with legal issues, speak to your attorney about whether they have a collaborative AI workspace that can be shared between the attorney and client so that privileged documents can remain privileged.
Consider implementing an AI use policy for confidential business information as well as legal information, and conduct training for employees. If your company uses a proprietary AI tool, have a policy in place and remind employees that company documents and information should remain within the internal AI tools, and not be shared or entered in public AI tools.
Disclaimers and data-use terms matter. If you use a platform with a disclaimer that inputs are used to collect data for training, and data can be subject to disclosure, that is a sign that you should not expect courts to treat this information as confidential or privileged.
Sharing documents with your lawyer after they are created by AI does not make them privileged after the fact.
If you plan to use AI to assist with discovery in a legal dispute, consult with your attorney first, even if you will be using an internal company platform. A consistent approach can help your overall legal strategy.