A federal judge said a client's Claude chats were not privileged. Two other courts protected AI work. Here is where the line sits for lawyers and clients now.
Not automatically, and sometimes not at all. In February 2026, Judge Jed Rakoff of the Southern District of New York ruled that 31 documents a criminal defendant created with a consumer AI tool were protected by neither the attorney-client privilege nor the work product doctrine. Two other federal courts, one ruling the same day and one six weeks later, reached friendlier results for pro se litigants. The questions people keep typing into search boxes, including “Heppner AI privilege,” come down to how those three cases fit together.
What Did the Court Decide in United States v. Heppner?
Bradley Heppner, facing securities fraud charges, used the consumer version of Anthropic’s Claude to analyze his situation before his arrest. He fed it information from his lawyers, generated documents on his own, and later shared them with his defense team. The government asked for a ruling that those documents were fair game, and Judge Rakoff agreed from the bench on February 10 and in a written memorandum filed February 17.
The court gave three reasons on privilege. Claude is not a lawyer, so there was no attorney-client communication. The exchanges were not confidential, because Anthropic’s consumer privacy policy allowed it to use and disclose inputs. And sending the documents to counsel afterward could not make them privileged retroactively. Work product failed too, because Heppner acted “on his own volition,” not at counsel’s direction. The memo itself describes the issue as “a question of first impression nationwide.” Debevoise’s summary and the Harvard Law Review blog walk through the reasoning in more detail.
Did Other Courts Agree?
Not entirely. On the same day as the bench ruling, a magistrate judge in the Eastern District of Michigan decided Warner v. Gilbarco and refused to order a pro se plaintiff to hand over her ChatGPT materials. He treated them as work product and wrote that “ChatGPT (and other generative AI programs) are tools, not persons.” Six weeks later, in Morgan v. V2X in the District of Colorado, another magistrate judge held that using a consumer AI tool does not automatically waive work product protection, while still ordering the plaintiff to name the tool he used.
An ABA Law Technology Today analysis puts the split plainly. Heppner folded privilege and work product into one analysis and found both lost. Warner and Morgan separated them, treating disclosure to an AI provider as different from disclosure to an adversary. Morgan also added protective order language that bars uploading confidential material to an AI platform unless the provider is contractually barred from training on inputs, restricted on third party disclosure, and allows deletion on request. Crowell & Moring keeps a running tracker of these rulings.
Why It Matters for Firms and Legal Departments
Three opinions, two of them from magistrate judges, do not settle the law. But they do tell you which facts courts are looking at. Was a lawyer directing the AI use? Was the tool a consumer product or an enterprise product with contractual confidentiality? Does the provider train on inputs, and can the user delete data? Is the provider likely to put the material in an adversary’s hands?
Lucian Pera’s September 2026 ethics column in ABA Law Practice magazine makes the practical comparison. Lawyers do not worry that a Westlaw or Lexis search will be subpoenaed, he writes, because those vendors’ terms obligate them to keep submissions confidential. “Not so with most general-purpose AI tools,” he adds, “and certainly not with free consumer-aimed tools.” He also notes that clients face the same risks when they paste their lawyer’s advice into a public chatbot.
For legal tech buyers, that turns contract terms into a selection criterion. Confidentiality obligations, training restrictions, retention and deletion rights are now part of how a court may judge whether privilege survived. Our earlier guide on legal AI and client confidentiality covers the questions to put to vendors.
What to Watch
Watch for an appellate court to take up the question, and for more protective orders with AI clauses like the one in Morgan. Watch, too, for firms adding client warnings about AI use to engagement letters. Commentators have already suggested that step.
Partly Real. The risk is real when a client uses a consumer tool on their own. The idea that any AI use waives privilege is not what the courts have said so far.
Common Questions
Are AI chats protected by attorney-client privilege?
In Heppner, no. The court held a consumer AI tool is not a lawyer and the chats were not confidential under the provider’s policy. Other courts have treated AI work by pro se litigants as protected work product.
Does sharing AI output with my lawyer make it privileged?
Not according to Heppner. The court said pre-existing documents do not become privileged just because they are later sent to counsel.
Does it matter which AI tool is used?
The courts looked closely at the provider’s terms, including whether it can train on or disclose inputs. Enterprise terms with confidentiality obligations put a user in a stronger position than consumer terms.
Is this settled law?
No. The three opinions disagree on key points, and no appellate court has ruled on the question yet.
In this story
See every round in the Funding Tracker