Brian Lanciault, a partner, and Ben Sandlin, a senior managing associate, with Thompson Hine LLP, contributed to the paper.

In United States v. Heppner,^[1] Judge Jed Rakoff of the United States District Court for the Southern District of New York held that a criminal defendant’s use of generative artificial intelligence (“AI”) can waive attorney-client privilege and work-product protections because the AI tool is not an attorney and use of the AI tool constituted a third-party disclosure. The decision is significant for all practitioners who use or advise clients on the use of generative AI in legal matters because the court applied traditional privilege and work-product principles to evaluate the AI-generated outputs.

On October 28, 2025, a grand jury returned an indictment charging Heppner with securities fraud, wire fraud, conspiracy to commit securities fraud and wire fraud, making false statements to auditors, and falsifying corporate records. The charges arose from Heppner’s alleged misconduct as an executive of several corporate entities, including a publicly traded company, GWG Holdings, Inc. Heppner was arrested on November 4, 2025.

In connection with Heppner’s arrest, agents with the Federal Bureau of Investigation (“FBI”) executed a search warrant at his home and seized several electronic devices. Heppner’s counsel advised the FBI that the devices contained dozens of documents containing communications Heppner had with Anthropic’s generative AI platform, Claude (the “Claude Reports”). Heppner had generated the Claude Reports on his own initiative after receiving a grand jury subpoena and learning he was a target of the investigation.

The government asked the court for a ruling that the Claude Reports were not privileged attorney-client communications or attorney work product and thus were not protected from the government’s inspection. In response, Heppner maintained that his exchanges with Claude were protected from disclosure on three bases: (1) he inputted information he learned from counsel, such as potential defense strategy; (2) he created the Claude Reports to communicate with counsel and acquire legal advice; and (3) he subsequently shared the Claude Reports with counsel. Heppner’s counsel conceded, however, that counsel did not direct Heppner to communicate with Claude or generate the Claude Reports.

The attorney-client privilege protects from disclosure any communications between a client and the client’s attorney that are intended to be, and in fact are, kept confidential, for the purpose of obtaining or providing legal advice.^[2] At the same time, the court noted that the attorney-client privilege is construed narrowly because “it operates as an exception to the rule that ‘all relevant proof is essential’ for a complete record” and confidence in the administration of justice.^[3]

Judge Rakoff rejected Heppner’s privilege argument because, simply put, Claude is not a lawyer, a “trusting human,” or a “licensed professional who owes fiduciary duties and is subject to discipline.”^[4] Instead, Claude is a third-party AI platform where no such attorney-client relationship exists. Accordingly, the court determined that “[i]n the absence of an attorney-client relationship, the discussion of legal issues between two non-attorneys is not protected by attorney-client privilege.”

In considering whether Heppner’s exchanges with Claude were confidential, Judge Rakoff pointed to Anthropic’s written privacy policy, which expressly notifies users that Claude collects their inputs and trains Claude on that data; the policy also gives Anthropic the right to disclose a user’s data to third parties, such as government authorities. As such, Heppner was on notice that his exchanges on the platform were not confidential. The court also noted that AI users “do not have substantial privacy interests” in their voluntarily disclosed conversations with a publicly accessible AI platform.

Judge Rakoff also concluded that Heppner did not communicate with Claude for the purpose of obtaining legal advice. While Heppner’s counsel argued that Heppner used Claude for the “purpose of talking to counsel,” counsel also conceded that counsel did not direct Heppner to use Claude. The court noted that “[h]ad counsel directed Heppner to use Claude, Claude might arguably be said to have functioned in a manner akin to a highly trained professional who may act as a lawyer’s agent within the protection of the attorney-client privilege.”^[5] But, because Heppner consulted Claude on his own initiative, the question for the court was whether Heppner intended to obtain legal advice “from Claude,” not whether he later shared Claude’s outputs with counsel.^[6] The court answered this question in the negative, observing that “Claude disclaims providing legal advice” and  when Claude is asked to provide legal advice, Claude responds that it is “not a lawyer and can’t provide legal formal legal advice,” instead directing the user to “consult with a qualified attorney.”^[7]

The court also rejected Heppner’s contention that the work-product doctrine protected the Claude Reports. The work-product doctrine “provides qualified protection for materials prepared by or at the behest of counsel in anticipation of litigation or trial.”^[8] Here, even though the court assumed the Claude Reports were prepared in anticipation of litigation, the court found that Heppner’s creation of the Claude Reports without acting at the direction of counsel was again dispositive. The court further noted that the Claude Reports did not reflect defense counsel’s strategy, nor were they used to “affect” that strategy.

The court also considered Heppner’s assertion that Federal Rule of Criminal Procedure 16(b)(2)(A) could shield the Claude Reports. Rule 16(b)(2)(A) permits a criminal defendant to withhold from discovery “reports, memoranda, or other documents made by the defendant, or the defendant’s attorney or agent, during the case’s investigation or defense.” The court rejected this argument because the Rule applies to a defendant’s reciprocal pretrial disclosure and discovery obligations. Here, agents seized Heppner’s devices pursuant to a search warrant.

The Heppner court applied longstanding privilege and work-product principles to the novel context of generative AI. As the court observed, “[g]enerative artificial intelligence presents a new frontier in the ongoing dialogue between technology and the law,” but “AI’s novelty does not mean that its use is not subject to longstanding legal principles.”

Importantly, the decision did not hold that use of generative AI waives privilege or work-product protections per se. The court did, however, leave open several significant questions, including whether an attorney’s own use of generative AI to prepare work product would be protected, whether that analysis would change if the AI tool was non-public (as opposed to the publicly available Claude platform), how a different AI provider’s privacy policy might affect the confidentiality analysis, and whether a client using generative AI at counsel’s direction could assert privilege or work-product protection over the outputs.

Notably, Judge Rakoff’s ruling in Heppner stands in contrast to another ruling issued earlier this year in a civil matter in the United States District Court for the Eastern District of Michigan. There, the district court concluded that a pro se party’s use of ChatGPT did not waive work-product protection because “ChatGPT (and other generative AI programs) are tools, not persons” to whom the third-party waiver exception to the work product doctrine traditionally applies.^[9]

As the use of AI platforms expands, further litigation will continue to define the boundaries between protected and unprotected uses of generative AI. Practitioners should be mindful of both the offensive and defensive implications of this decision. Generative AI reports and logs may contain significant discoverable information about an opposing party’s legal strategy. For this reason, clients risk losing important privilege and work-product protections by inputting sensitive information into generative AI tools, particularly non-enterprise publicly available tools, and when doing so unguided by the careful advice and instruction of counsel, as Heppner well-illustrates. Prosecutors can and will seek and obtain generative AI logs and outputs, in the same manner they have long utilized other types of electronic data, such as internet search histories, social media data, and the like. Heppner underscores the need for practitioners to exercise caution when using or advising clients on the use of generative AI.

[1] 25 Cr. 503 (S.D.N.Y. Feb 17. 2026).

[2] United States v. Mejia, 655 F.3d 126, 132 (2d Cir. 2011).

[3] Heppner, 25 Cr. 503, slip op. at 5.

[4] Id. at 5-6.

[5] Id. at 7.

[6] Id. at 7.

[7] Id. at 8.

[8] In re Grand Jury Subpoenas Dated March 19, 2002 and August 2, 2002, 318 F.3d 379, 383 (2d Cir. 2003).

[9] Warner v. Cilbarco, Inc., et al., Case No. 2:24-cv-12333, slip op. 11-12 (E.D. Mich. Feb. 10, 2026).