What a Federal Judge’s Ruling Means for Anyone Using AI for Legal Help
Millions of people now type their legal worries into AI chatbots. They ask about leases, divorces, employment disputes and, increasingly, criminal investigations. Many assume those conversations are as private as a talk with their lawyer. A federal judge in Manhattan has just made clear that, at least in one important setting, they are not.
On February 17, 2026, Judge Jed S. Rakoff of the U.S. District Court for the Southern District of New York issued a written opinion explaining why a criminal defendant, Bradley Heppner, could not shield documents he created using the consumer version of Anthropic’s AI model, Claude. Judge Rakoff had ruled from the bench on February 10. His written opinion now sets out the reasoning, and it is one of the first detailed judicial treatments of whether AI-assisted legal research is protected by the attorney-client privilege or the work product doctrine.
The short answer in this case was “no” on both counts. The longer answer matters to anyone, lawyer or not, who uses AI to think through a legal problem.
What Happened in the Heppner Case
Heppner, facing federal charges, used Claude to research factual and legal issues in his case. He fed the AI information his own lawyers had shared with him. He intended to give the resulting AI-generated documents to his defense team, and he did. When the government sought those materials, Heppner argued they were privileged.
What makes the ruling notable is how much the court accepted. Judge Rakoff took as given that Heppner:
- was communicating with Claude about his case in anticipation of litigation;
- incorporated information from his counsel into those communications;
- intended to share the AI-generated documents with his lawyers; and
- actually shared them.
Even on those favorable facts, the court rejected both privilege claims. That tells readers the problem was not sloppy facts. It was the structure of the relationship between a person and a consumer AI tool.
Why the Attorney-Client Privilege Failed
The attorney-client privilege protects confidential communications between a client and a lawyer made to obtain legal advice. Judge Rakoff found that Heppner’s AI conversations failed this test in three separate ways.
First, Claude is not a lawyer. The privilege exists to protect a relationship. The court observed that all recognized privileges require “a trusting human relationship” with “a licensed professional who owes fiduciary duties and is subject to discipline.” An AI platform owes no fiduciary duties and answers to no bar association. In the court’s view, no such relationship can exist between a user and an AI tool. Claude itself, the court noted, expressly disclaims that it provides legal advice.
Second, there was no reasonable expectation of confidentiality. Even if the content of Heppner’s chats could otherwise qualify, the court held that he gave up confidentiality by using the consumer version of Claude. That version may train on user data. Its privacy policy states that Anthropic may disclose data to “third parties,” including “governmental regulatory authorities,” and may do so “in connection with claims, disputes, or litigation,” even without a subpoena. Because that policy “clearly puts Claude’s users on notice,” the court concluded Heppner “could have had no ‘reasonable expectation of confidentiality in his communications’” with the tool.
This point disposed of a natural objection. A client’s private notes, written to share with a lawyer, are often protected. But the court reasoned that Heppner was different because he “first shared the equivalent of his notes with a third-party, Claude.” Writing your notes inside someone else’s system, under terms that permit disclosure, is not the same as writing them on your own legal pad.
Third, Heppner acted on his own. Heppner argued that his whole purpose was to prepare for conversations with his lawyers. The court found that insufficient because he used Claude “of his own volition,” not at counsel’s direction. A client’s independent research, however well-intentioned, is not automatically a communication with counsel.
Two Paths the Court Left Open
Enterprise AItools. The ruling turned heavily on the consumer version’s terms. Enterprise AI tools, the versions businesses and law firms license, typically work differently. They generally do not train on user inputs. Their contracts usually promise that customer data will not be shared with third parties absent extraordinary circumstances.
Those differences go directly to the “reasonable expectation of confidentiality” that sank Heppner’s claim. A court could well reach a different result for a user working inside an enterprise tool. Notably, Judge Rakoff cited Judge Sidney Stein’s decision in In re OpenAI Inc., Copyright Infringement Litigation for the proposition that AI users lack an expectation of privacy. That case, too, involved consumer rather than enterprise tools. Neither decision addresses the enterprise setting head-on.
AI used at a lawyer’s direction. The court also pointed to a second path: the Kovel doctrine. Named for a 1961 federal appeals court decision, Kovel extends the privilege to non-lawyers, such as accountants or consultants, whom an attorney engages to help provide legal advice. The idea is that some experts are needed to translate complex information so a lawyer can advise the client.
Judge Rakoff suggested this could apply to AI. Had Heppner’s lawyers directed him to use Claude, and had confidentiality been preserved, “Claude might arguably be said to have functioned in a manner akin to a highly trained professional who may act as a lawyer’s agent within the protection
of the attorney-client privilege.” That is a hedged statement, not a holding. But it is a meaningful signal from a prominent judge that AI used under counsel’s supervision may be treated differently from AI used on a client’s own initiative.
Why Work Product Protection Failed, Too
Heppner’s fallback was the work product doctrine, which shields materials prepared in anticipation of litigation from discovery by the other side. It is often broader than the attorney-client privilege, and it does not always require a communication with a lawyer. Judge Rakoff rejected this claim as well.
Even assuming the documents were prepared in anticipation of litigation, he found they were not “prepared by or at the behest of counsel” and did not “reflect defense counsel’s strategy.”
In doing so, the court declined to follow Shih v. Petal Card, Inc., a magistrate judge’s decision that had extended work product protection to materials a client prepared without a lawyer’s direction. Judge Rakoff reasoned that such an expansion “undermines the policy animating the work product doctrine,” which is to “protect lawyers’ mental processes.” In his view, the doctrine protects the lawyer’s thinking, not a client’s independent homework.
That leaves trial-level decisions pointing in different directions. Until an appellate court weighs in, litigants may see different results depending on which judge hears the dispute.
What You Should Do Now
The Heppner opinion is a trial court ruling, and other judges may see things differently. But it comes from one of the most widely read federal judges in the country, and it will be cited. Until the law settles, clients and lawyers should assume the more cautious view.
- Don’t treat a consumer chatbot like your lawyer. If you are involved in a dispute or investigation, assume anything you type into a free or consumer AI tool could be obtained by the other side. Talk to your lawyer first.
- Use enterprise AI tools for privileged work, whenever possible. Choose tools whose terms bar training on your inputs and restrict disclosure to third parties. Read those terms and keep a copy.
- If a lawyer wants a client to use AI, the lawyer should direct it and document it. The direction should be real and recorded. Where appropriate, state the context in the prompt itself, for example: “I am doing this research at the direction of counsel for litigation.”
AI can make legal research faster and cheaper. But the protections that keep a client’s secrets safe were built around human relationships and confidential channels. Until courts say otherwise, the safest assumption is simple: what you tell a consumer chatbot, you may be telling the world.
Steven J. Shanker, Esq. is General Counsel to the Livery Roundtable, Inc. and the New York
Independent Livery Driver Benefit Fund.
