This article was originally published in The Bottom Line, the newsletter of the Illinois State Bar Association's Standing Committee on Law Office Management & Economics.  May 2026.

Part I: The Ruling

On February 10, 2026, Judge Jed S. Rakoff of the United States District Court for the Southern District of New York ruled from the bench in United States v. Heppner, No. 25-cr-00503-JSR, that approximately thirty-one documents a criminal defendant generated using the consumer version of Anthropic's generative AI platform Claude were protected by neither the attorney-client privilege nor the work product doctrine.[1] Judge Rakoff issued a twelve-page written opinion on February 17 confirming and elaborating on the ruling.[2]

The defendant, Bradley Heppner, had been indicted on charges including securities and wire fraud.[3] During the execution of a search warrant at his home, FBI agents seized electronic devices containing the AI-generated documents.[4] The documents consisted of Heppner's prompts and Claude's responses. Heppner's counsel claimed the materials were privileged and work product. Heppner's counsel assrted (1) the chats contained information Heppner had learned from his counsel (2) Heppner created the chats “for the purpose of speaking with counsel to obtain legal advice,” and (3) the content had in fact been shared with counsel.[5]

Defense counsel's theory was straightforward: Heppner had received information from his attorneys about the government's investigation, synthesized that information using Claude to develop defense strategy reports, and then shared those reports with his lawyers in furtherance of the attorney-client relationship.[6] Critically, however, defense counsel conceded that Heppner created the documents entirely on his own initiative — not at counsel's direction.[7]

Judge Rakoff found no basis for attorney-client privilege on three independent grounds. First, the AI tool is not an attorney. Claude is not a licensed professional, owes no fiduciary duties to users, and is subject to no professional discipline. The written opinion states that all recognized privileges require "a trusting human relationship" with a licensed professional — a relationship that does not, and could not, exist between an AI user and a platform like Claude.[8] Claude itself explicitly disclaimed the ability to provide legal advice; when the government asked Claude whether it could give legal advice, it responded that it was "not a lawyer" and recommended that users consult a qualified attorney.[9]

Second, the communications were not confidential. Heppner voluntarily shared his prompts with a publicly accessible third-party commercial platform. Anthropic's privacy policy expressly advises users that it collects data on inputs and outputs, uses that data to train its models, and reserves the right to disclose it to third parties, including governmental regulatory authorities.[10] That language negated any reasonable expectation of confidentiality in Heppner's communications with Claude.[11]

Third, the court found that the AI chats were not made for the purpose of obtaining legal advice, although “[t]his issue perhaps presents a closer call.” Heppner had consulted the tool on his own, not at counsel's direction. Since counsel had not directed Heppner to use Claude, the court found the privilege could only apply if Heppner was actually seeking legal advice from Claude, which he was not doing.[12] Eventually sending the outputs to counsel did not matter, because such act could not convert non-privileged material into privileged material.[13]

The court considered the argument that AI inputs are analogous to using cloud-based word processing software, such as Google Docs, to draft correspondence to be shared with counsel. Judge Rakoff acknowledged the argument but concluded it cuts against the privilege claim, not in favor of it: “the use of such applications is not intrinsically privileged.”[14] This aspect of the ruling would have major implications for attorneys and clients who use cloud-based tools in connection with legal matters.

Heppner's work product claim fared no better. The work product doctrine protects materials prepared by or at the direction of counsel in anticipation of litigation.[15] Defense counsel conceded that counsel had not directed Heppner to use the AI tool.[16] Because the documents were neither prepared by counsel nor at counsel's direction, and because — by defense counsel's own acknowledgment — they did not reflect counsel's legal strategy at the time of creation, the work product doctrine did not apply.[17]

At oral argument, defense counsel relied heavily on Shih v. Petal Card, Inc., 565 F. Supp. 3d 557 (S.D.N.Y. 2021), for the proposition that work product protection can attach to materials prepared by a client in anticipation of litigation regardless of attorney direction.[18] Rakoff's written opinion does not merely distinguish Shih — it expressly disagrees with it, finding that Shih's holding undermines the policy animating the work product doctrine, which exists to protect the mental processes of attorneys, not the independent research of clients acting on their own.[19]

Judge Rakoff did note one path that might lead to a different result: had counsel directed Heppner to use Claude, the tool "might arguably be said to have functioned in a manner akin to a highly trained professional who may act as a lawyer's agent within the protection of the attorney-client privilege."[20] That reference — to the so-called Kovel doctrine, which can extend privilege to non-attorney agents retained by counsel whose assistance is necessary to the provision of legal advice — appears in the written opinion and is discussed further below.

One additional consequence of the ruling, addressed in footnote 3 of the written opinion, deserves particular attention: the waiver problem extends beyond the AI documents themselves. Heppner had fed into Claude information he learned from his own attorneys — communications that were themselves privileged. Rakoff held that by sharing that privileged information with Claude and Anthropic, Heppner waived the privilege over those underlying attorney-client communications as well.[21] The damage, in other words, is not limited to the client inputs and AI-generated outputs. The originally privileged advice from counsel may itself be fair game.

Part II: Analysis

The Ruling Is Unsurprising — But Its Implications Are Not

The holding in Heppner may not surprise most practitioners. Viewed through the lens of traditional privilege doctrine, the case presents a fairly clean application of settled principles to a new technological context. The court noted that its ruling appears to answer a question of first impression nationwide: whether communications with a publicly available AI platform in connection with a pending criminal investigation are protected by attorney-client privilege or work product.[22]

What is significant about Heppner is not the legal conclusion. It is the factual scenario that produced it — one that is almost certainly going to repeat itself, in courtrooms across the country, with rapidly increasing frequency.

Clients Are Already Having This Problem

Here is the more pressing concern for practitioners: clients are not waiting for their lawyers to direct them to AI. They are going to AI first — often before they even pick up the phone to call an attorney.

Think about how a person in legal trouble actually behaves today. They receive a demand letter, a termination notice, or a visit from federal agents. Before calling a lawyer, many of them will open a browser and start typing. And increasingly, they are not just searching — they are chatting. They are describing their situation in detail, asking whether they have legal exposure, exploring what defenses might be available, asking what the worst-case outcome looks like. The AI responds thoughtfully and in plain English. It feels like talking to an advisor. It feels private. It is not.

The Heppner case did not involve a client who was naive about legal proceedings. Heppner was represented by counsel at a major firm, had received a grand jury subpoena, and knew he was the target of a federal investigation.[23] He used Claude anyway — presumably because it was convenient, available, and felt like a useful tool for organizing his thoughts. If a represented defendant in a high-stakes federal prosecution can fall into this trap, practitioners should have no illusions about what unrepresented clients or clients in the early stages of seeking representation will do.

The Lawyer's Obligation: Advise Early and Explicitly

The clearest takeaway from Heppner for Illinois practitioners is an affirmative counseling point. Clients should be told — early, clearly, and in writing — that their AI conversations about their legal matters are not privileged and may be discoverable. (For that matter, the input of case information into any cloud-based service or website.) This is not a disclosure clients will intuit on their own. The conversational interface of modern AI tools creates a dangerous illusion of privacy. Every prompt is a potentially discoverable document, and an “admission by a party opponent” at that.

And as the written opinion makes clear, the risk runs deeper than the AI conversation itself. A client who tells Claude what their attorney said has potentially waived privilege over those underlying attorney-client communications.[24] The AI document is one problem. The original privileged advice may be another.

Practitioners should consider:

• Updating engagement letters to include explicit cloud service use warnings. Clients should be advised that inputting facts learned from counsel, or legal strategy, into any cloud software or AI tool may constitute a waiver of the attorney-client privilege — not just over the AI-generated materials, but potentially over the underlying communications from counsel themselves.
• Making AI use part of initial client counseling. The conversation about what not to do should ideally happen at the outset of the representation, not after the client has already generated thirty documents on Claude.
• Advising clients to disable AI notetakers during confidential conference calls — an increasingly relevant concern as AI-powered meeting assistants become standard features in video conferencing platforms. The problem extends beyond deliberate AI use: tools passively embedded in browsers, email clients, and productivity software may be capturing and transmitting client communications without either the attorney or client realizing it. Clients should be counseled to audit the AI features active on their devices, not just the AI tools they intentionally open.
• Anticipating AI-related discovery demands. Litigators should expect "AI prompts and outputs" to become a routine category in discovery requests going forward. The government's success in Heppner will encourage opposing counsel to seek AI-generated materials as a matter of course. This cuts both ways: practitioners should be prepared both to respond to such requests and to propound them where relevant.

Heppner also has implications beyond the criminal context. The court's reasoning applies equally to civil litigation, workplace investigations, regulatory inquiries, and internal business analysis. Any time a person uses an AI tool to analyze legal issues, evaluate liability, or prepare for litigation, they may be creating a discoverable record. The Heppner problem is not a criminal law problem. It is a problem for every practice area.

The Way Forward: Potential Solutions

The situation is not without hope. The Heppner court's Kovel dicta, now set forth in the written opinion, and the broader commentary the case has generated point toward several emerging approaches:

Counsel-directed use. Judge Rakoff's written opinion specifically observes that the outcome might have differed had counsel directed Heppner to use the AI tool.[25] Under the Kovel doctrine, non-attorney agents — accountants, translators, financial analysts — can operate within the privilege when retained by counsel and their assistance is necessary to the provision of legal advice. The argument is that an AI tool, directed by counsel and integrated into the legal workflow, could function in the same capacity. This is an untested theory, but the written opinion at least leaves the door open. Practitioners who want to harness AI tools in client matters may have a stronger privilege argument if they specifically direct the client's use of the tool, control the engagement, and structure the outputs to inform counsel's advice.

Enterprise-grade AI with contractual confidentiality protections. The Heppner court's confidentiality analysis turned heavily on Anthropic's consumer privacy policy.[26] Consumer AI platforms retain data, train on inputs, and reserve broad disclosure rights. Enterprise-tier deployments operate differently: they typically include contractual prohibitions on data retention for training purposes, offer zero-retention policies, disclaim ownership of user data, and do not share user data with third parties. Whether courts will treat enterprise AI use differently from consumer AI use remains an open question after Heppner, but the court's reasoning suggests that a platform with genuine confidentiality protections — governed by an enterprise agreement rather than a consumer terms of service — presents a materially different case. Practitioners should understand the difference and advise clients accordingly.

One important caveat, however: even under a zero-retention enterprise agreement, data still passes through the vendor's servers during processing. Whether that transient exposure constitutes "disclosure" sufficient to defeat a confidentiality argument is genuinely unresolved. Expect it to be among the next questions litigated in this space.

Self-hosted models. The most architecturally complete solution — and the one that most cleanly eliminates the third-party disclosure argument — is running an AI model on firm-owned or firm-controlled hardware, entirely within the firm's own environment. If the data never leaves the firm's infrastructure, there is no third-party vendor with independent rights over the prompts or outputs, and the privilege analysis looks considerably more favorable. Open-source models suitable for local deployment currently lag behind commercial platforms for complex legal reasoning tasks, but the gap is narrowing. For firms handling particularly sensitive matters, the tradeoff may be worth considering.

Law firm-integrated AI tools. Some law firms are beginning to deploy proprietary or licensed AI systems specifically designed for privileged legal work, operating within the firm's own infrastructure and subject to attorney-client confidentiality. If the AI tool is deployed by counsel, access is restricted to the attorney-client relationship, and the tool does not transmit data to third parties, the privilege analysis looks considerably more favorable. This is an area to watch as both technology and doctrine continue to develop.

Conclusion

Judge Rakoff closed his written opinion by observing that "AI's novelty does not mean that its use is not subject to longstanding legal principles."[27] The AI tools available today are powerful, accessible, and feel intuitive in a way that can obscure the legal consequences of their use.

For Illinois practitioners, the lesson is this: assume your clients are already talking to AI about their legal problems — and that some of them have already told the AI what you told them. The prudent practitioner will have warned them of what that means.

Endnotes

[1] Transcript of Pretrial Conference at 6, United States v. Heppner, No. 25-cr-00503-JSR (S.D.N.Y. Feb. 10, 2026), https://incamera.ai/S.D.N.Y._1_25-cr-00503-02-10-2026.pdf accessed March 20, 2026 [hereinafter "Transcript"].

[2] Memorandum at 1, United States v. Heppner, No. 25-cr-00503-JSR (S.D.N.Y. Feb. 17, 2026), https://storage.courtlistener.com/recap/gov.uscourts.nysd.652137/gov.uscourts.nysd.652137.27.0.pdf accessed March 20, 2026 [hereinafter "Opinion"].

[3] Opinion at 2.

[4] Opinion at 3.

[5] Opinion at 3–4.

[6] Transcript at 3–4.

[7] Opinion at 3.

[8] Opinion at 5–6.

[9] Opinion at 7–8.

[10] Opinion at 6.

[11] Opinion at 6–7.

[12] Opinion at 7-8.

[13] Opinion at 8.

[14] Opinion at 5–6.

[15] Opinion at 8-9.

[16] Transcript at 5; Opinion at 3.

[17] Opinion at 10-12.

[18] Transcript at 4; Opinion at 10-11.

[19] Opinion at 10–11.

[20] Opinion at 7.

[21] Opinion at 8 n.3.

[22] Opinion at 2. This article does not attempt to critique the court's opinion. There are certainly legitimate arguments that the court got it wrong. Nonetheless, whether practitioners agree with it or not, the Heppner court's reasoning is likely to be adopted by other courts. This article focuses on the implications for practitioners. 

[23] Transcript at 4.

[24] Opinion at 8 n.3.

[25] Opinion at 7.

[26] Opinion at 6.

[27] Opinion at 12.

About the Author

William M. Tasch is the Managing Partner and co-founder of CTM Legal Group, a general practice law firm in Chicago. He serves as Secretary of the ISBA Law Office Management and Economics Committee and as co-chair of the AI Subcommittee of the ISBA Delivery of Legal Services Committee. He can be reached at [email protected].