A Federal Judge Ruled That AI Chats Are Not Privileged. The Footnotes Matter More.

A judge in the Southern District of New York held that a defendant's written exchanges with a publicly available AI platform were protected by neither attorney-client privilege nor the work product doctrine. It is one district court memorandum and it binds no other court. The reasoning, though, tells you exactly which facts would change the answer.

What did the court actually decide?

That a defendant's written exchanges with a generative AI platform were protected by neither attorney-client privilege nor the work product doctrine. The Government moved for that ruling and won.

The motion was granted from the bench on 10 February 2026, with the memorandum filed 17 February 2026 by Judge Jed S. Rakoff in United States v. Bradley Heppner, No. 25 Cr. 503 (JSR), in the Southern District of New York.

After a grand jury subpoena, Heppner used Claude on his own to draft reports outlining his defense strategy, and FBI agents seized about 31 such documents from his home (pages 3 and 10).

Note the precise question the court framed, because the scope matters more than the headline. At page 2 the memorandum says the ruling "appears to answer a question of first impression nationwide: whether, when a user communicates with a publicly available AI platform in connection with a pending criminal investigation, are the AI user's communications protected by attorney-client privilege or the work product doctrine?" And then: "For the reasons that follow, the answer is no."

Two qualifiers are doing real work there. "Publicly available" and "in connection with a pending criminal investigation." Neither is decorative.

Is this really the first ruling of its kind?

On the court's own account, yes. Footnote 1 states: "The Court is unaware of, and the parties have not identified, any case to date that has presented this issue." That is a court telling you there is no body of law here yet, which is a more useful signal than the holding itself.

It also means the usual comfort of pointing to a line of authority is unavailable to you in either direction. On 10 February 2026, the day Heppner was decided from the bench, a court went the other way on part of the question. In Warner v. Gilbarco, a magistrate judge in the Eastern District of Michigan held that a self-represented civil litigant's ChatGPT prompts and outputs were protected work product, reasoning that an AI tool is not an adversary, so using one does not waive the protection. Warner was civil, involved no lawyer and did not decide attorney-client privilege, so it narrows the lesson here rather than reversing it.

Warner narrows the lesson rather than reversing it.

Why did the court say the chats were not privileged?

The court gave three grounds, holding that the documents lack "at least two, if not all three, elements of the attorney-client privilege". The first is the short one, at page 5: "Because Claude is not an attorney, see ECF No. 23-6, that alone disposes of Heppner's claim of privilege."

Read "that alone". The court is flagging this ground as independently sufficient, which matters when you start evaluating fixes, because a fix that does not address this sentence does not reach the privilege question at all. The second ground is confidentiality and the third is whether the exchange was for the purpose of obtaining legal advice.

The second ground: you agreed it would not stay confidential

The alternative ground is confidentiality, and it comes from the terms the user accepted. At page 6 the court points to the privacy policy users consent to, which provides that Anthropic collects data on "inputs" and "outputs", uses it to "train" Claude, and reserves the right to disclose it to "third parties", including "governmental regulatory authorities".

Privilege requires an expectation of confidentiality. The court's point is that the user had agreed, in advance and in writing, to a document describing the opposite. This is the ground that should worry a firm most, because it does not depend on anything exotic. It depends on the terms of service nobody read.

Waiver is the reasoning that reaches past this case

Footnote 3 is the part with the longest reach, though note what it is: a footnote answering a point the defendant's counsel raised in passing at oral argument, not one of the court's three numbered grounds. It reads: "even if certain information that Heppner input into Claude was privileged, he waived the privilege by sharing that information with Claude and Anthropic, just as if he had shared it with any other third party."

That framing is the one to carry into your own risk assessment. The court is not treating the platform as a novel category. It is treating it as a third party, and third party disclosure is a waiver analysis lawyers already know how to run. If you can reason about forwarding a memo to an outside consultant, you can reason about this.

Does sending the AI output to your lawyer make it privileged?

No. In United States v. Heppner (S.D.N.Y. 2026), Judge Rakoff called it black-letter law that a non-privileged communication does not become privileged by being shared with counsel.

The sentence most of the coverage dropped

Page 7 contains the counterfactual, and it is the most practically useful line in the document: "Had counsel directed Heppner to use Claude, Claude might arguably be said to have functioned in a manner akin to a highly trained professional who may act as a lawyer's agent within the protection of the attorney-client privilege." The court cites Adlman, 68 F.3d 1495, 1498-99 (2d Cir. 1995), itself citing Kovel, 296 F.2d 918 (2d Cir. 1961).

This did not happen here because, at page 4, counsel conceded they "did not direct [Heppner] to run Claude searches." The client went and used a tool on his own.

So the opinion contains both the loss and the shape of the argument that was not available. Kovel is the familiar doctrine that a lawyer's non-lawyer agents, the classic example being an accountant retained by counsel, can sit inside the privilege. The court is saying a model used at counsel's direction might fit that frame.

Do not overread it. The word is "might", followed by "arguably". That is a judge declining to decide a question not in front of him, not a safe harbor.

The same passage then narrows it. Because Heppner acted on his own, what mattered was whether he meant to obtain legal advice from Claude, which disclaims giving it. Direction may be necessary; the memorandum never says it is enough.

Work product failed on a separate ground

Even assuming the documents were prepared in anticipation of litigation, they were not prepared by or at the behest of counsel and did not reflect counsel's strategy (pages 9 and 10). Counsel conceded they affected counsel's strategy going forward but did not reflect it when Heppner wrote them.

The court declined to follow Shih v. Petal Card, 565 F. Supp. 3d 557 (S.D.N.Y. 2021), where a magistrate judge in the same district held work product is not limited to material prepared by or at the direction of a lawyer. Warner and Morgan v. V2X (D. Colo., 30 March 2026), both civil cases with self-represented parties, came out the other way on work product.

How much does this ruling bind?

Very little, formally. It is one memorandum from one district judge. It binds no other court, it is not appellate authority, and another district could reach the opposite conclusion next month on the same facts without creating a conflict anyone has to resolve.

Treat it as the best available reasoning on an open question rather than as settled law. For most firms that distinction changes the tone of the client conversation but not the actions, because the cheap precautions are worth taking whether or not the next court agrees.

This is information, not legal advice.

Does an enterprise agreement change the analysis?

Nobody knows, and the structure of the opinion suggests it would only get you halfway at best.

Terms that bar training on your data and bar third party disclosure would speak directly to the confidentiality ground at page 6. They would say nothing about page 5, where the court held that the tool not being an attorney "alone disposes" of the privilege claim.

On the logic of the opinion, the only route that touches the first ground is the Kovel path: counsel directing the use, so the tool is arguably counsel's agent. That argument has not been tested anywhere. Anyone selling you an enterprise tier as a privilege solution is selling you something the opinion does not support.

The reasoning tells you exactly which facts would change the answer.

Can a protective order limit which AI tools see confidential material?

Yes. In Morgan v. V2X (D. Colo., 30 March 2026), an amended protective order lets confidential material go only to an AI provider contractually barred from storing or using inputs to train or improve its model, and from disclosing them to third parties except where essential to the service.

The order, from Magistrate Judge Maritza Dominguez Braswell in a pro se employment case, also requires a contractual right to delete that material on request, and written records of the terms. The judge accepted that, for now, this rules out most, if not all, mainstream free or low-cost tools for confidential material, and left other AI use alone.

On work product it reached a different result for a different reason: in a civil case, Rule 26(b)(3) protects a party's own litigation preparation, with no lawyer required, and waiver typically takes disclosure to an adversary or circumstances that make that substantially more likely, so AI interactions do not automatically compromise it. Heppner was distinguished, not rejected: it was criminal, and its defendant acted apart from his lawyer, a gap no self-represented party has. Neither case decides a represented client using AI alone in a civil matter.

Heppner was ruled on from the bench on 10 February 2026, the same day as Warner.

The tool's identity was not protected here: the plaintiff had not shown naming it would reveal his strategy, so he was ordered to name any AI platform he used with designated confidential material. The court left open that a tool's name could reveal strategy elsewhere.

Opposing counsel can ask which AI touched designated material, so whoever approves AI vendors, often an AI steering committee, should hold a contract you can produce. If an agent you own calls a hosted model, that provider still receives the inputs, so get its no-training, no-disclosure and deletion terms in writing.

What should a firm change this week?

Four decisions, none of which needs a policy project, a committee or a vendor: tell people in writing that public AI chats are discoverable, separate research from drafting with client facts, have counsel direct any use that touches privileged work, and read your actual terms of service.

• Tell people, in writing, that chats with public AI tools are discoverable and are being treated as third party disclosure. One paragraph, circulated, dated.
• Separate the two use cases. Research with no client facts is a different risk than drafting with client facts in the prompt, and only the second one needs a gate.
• Where a model genuinely is part of privileged work, have counsel direct the engagement explicitly and in writing, with a human review step on anything that leaves the firm. On page 7 that is the only fact pattern with an argument attached, and it costs nothing to create the record now.
• Read your actual terms of service for training and disclosure, including the consumer tiers people signed up for personally, because that is the document the court read.

The first decision should reach clients too. Heppner was a client acting alone, which a staff-only AI policy does not reach, so tell clients in writing at intake that what they type into a public AI tool about the matter may be discoverable and may waive privilege.

If people at your firm already use personal AI accounts on client work, find that use first. Our guide to shadow AI in law firms covers discovery, a policy people follow and a sanctioned replacement. For the step after that, a shared prompt standard with a screen for confidential inputs and a citation check, see prompt engineering for lawyers.

Where Gaper fits

Gaper is the AI-native implementation partner that deploys supervised AI agents you own.

Gaper builds and deploys custom AI agents for law firms inside your own cloud, so the inputs and outputs stay in infrastructure you control and the data path is something you can describe to a court rather than infer from a vendor's policy. We are an implementation partner, so the agents and their configuration belong to you, not to a platform whose terms can change. General enquiries go to hello@gaper.io.

What this means for your firm

Assume for now that anything typed into a public AI tool is discoverable, and say so to your people this week rather than after a preservation notice arrives. The deployment shape is what moves the risk: a tool your firm controls, used at counsel's direction, is the only fact pattern in this opinion with an argument behind it. Read the paragraph on page 7 yourself before you let anyone tell you the question is closed in either direction.

Book a free AI assessment

Thirty minutes, no commitment. We map one workflow, make the build or buy call, and scope the smallest thing worth shipping.