No Privilege in the Prompt: Why AI-Prepared Litigation Materials May Be Fair Game After Heppner

Imagine being a client who, upon learning he is the target of a securities fraud investigation by the government, turns to an AI platform (like ChatGPT, for example) to organize his thoughts, outline potential defenses, and prepare for conversations with his lawyer. He later shares the AI-generated reports with counsel. When federal agents execute a search warrant and seize the documents, the client assumes they are privileged. They are not.

In United States v. Heppner, No. 25 Cr. 503 (JSR) (S.D.N.Y. Feb. 17, 2026), United States District Judge Jed S. Rakoff confronted what the court described as a question of first impression nationwide: whether a user’s communications with a publicly available cloud-based AI platform, prepared in connection with a pending criminal investigation, are protected by the attorney-client privilege or the work product doctrine. Judge Rakoff answered that question with an unequivocal “no.”

The decision carries significant implications for litigation practitioners across all practice areas. It signals that the increasingly common practice of clients using cloud-based AI tools to process, analyze, or prepare materials related to their legal matters creates a serious vulnerability—one that no amount of sanitizing, by sharing with counsel after-the-fact, can cure.

A. Factual Background

Bradley Heppner, a corporate executive, was indicted on charges including securities fraud, wire fraud, making false statements to auditors, and falsifying corporate records in connection with his role at publicly traded GWG Holdings, Inc. The indictment alleged that Heppner defrauded GWG’s investors of more than $150 million.

After receiving a grand jury subpoena and learning he was a target of the investigation, Heppner—on his own initiative and without any direction from counsel—used the AI platform Claude, operated by the private company Anthropic, to prepare approximately thirty-one documents. According to Heppner’s counsel, these documents outlined defense strategy, analyzed the facts and law relevant to anticipated charges, and were prepared “in anticipation of a potential indictment.” Heppner subsequently shared these AI-generated materials with his Attorneys.

When the FBI executed a search warrant at Heppner’s home following his arrest, agents seized the documents along with other materials and electronic devices. Heppner’s counsel asserted privilege over what the court termed the “AI Documents,” and the parties entered a stipulation to segregate the materials pending resolution of the privilege claims. The Government then moved for a ruling that the AI Documents were protected by neither the attorney-client privilege nor the work product doctrine. The court agreed.

B. Attorney-Client Privilege

The court found the AI Documents failed on at least two, and likely all three, required elements of the attorney-client privilege:

…

First, there was no attorney-client communication. The court emphasized that the privilege protects communications between a client and his or her attorney. Claude is not an attorney, and Heppner “does not, and indeed could not, maintain that Claude is an attorney.” Citing In re OpenAI, Inc., Copyright Infringement Litigation, 802 F. Supp. 3d 688, 699 (S.D.N.Y. 2025), the court observed that recognized privileges require “a trusting human relationship” with a licensed professional who owes fiduciary duties. No such relationship exists, or could exist, between a user and an AI platform.

…

Second, there was no confidentiality. The court found that the AI Documents were not confidential—not merely because Heppner had communicated with a third-party AI platform, but because Anthropic’s written privacy policy expressly provides that it collects data on user inputs and outputs, uses that data to train its models, and reserves the right to disclose information to third parties, including governmental and regulatory authorities. Even absent a subpoena, the policy permits Anthropic to disclose personal data in connection with claims, disputes, or litigation. Heppner could have had no “reasonable expectation of confidentiality” in his communications with Claude.

…

Third, the prompting was held to not be for the purpose of obtaining legal advice. The court noted this was a closer question, given counsel’s assertion that Heppner used Claude “for the express purpose of talking to counsel.” But the court drew a critical distinction: Heppner acted on his own volition, not at counsel’s direction. Additionally, the court held that non-privileged communications do not “alchemically” become privileged merely because they are later shared with counsel. Citing Gould, Inc. v. Mitsui Mining & Smelting Co., Ltd., 825 F.2d 676, 679–80 (2d Cir. 1987), the court concluded that because the AI Documents “would not be privileged if they remained in [Heppner’s] hands, they did not acquire protection merely because they were transferred to counsel.”

C. Work Product Doctrine

The court likewise rejected work product protection. Even assuming, arguendo, that the AI Documents were prepared “in anticipation of litigation,” they were not “prepared by or at the behest of counsel,” nor did they “reflect defense counsel’s strategy.” Heppner’s own counsel conceded that the documents were prepared by Heppner on his own volition and that, while they might “affect” counsel’s strategy going forward, they did not “reflect” counsel’s strategy at the time Heppner created them.

The court acknowledged and respectfully disagreed with Shih v. Petal Card, Inc., 565 F. Supp. 3d 557 (S.D.N.Y. 2021), in which a magistrate judge in the same district had applied the work product doctrine more broadly to materials prepared by a party regardless of whether counsel directed the work. Judge Rakoff found that this broader reading undermines the doctrine’s animating policy, which the Second Circuit has repeatedly emphasized is “to preserve a zone of privacy in which a lawyer can prepare and develop legal theories and strategy ‘with an eye toward litigation.’”

Heppner is not binding authority outside the Southern District of New York. But its reasoning draws on well-established privilege and work product principles from the Second Circuit and the Supreme Court, and it represents the first known judicial treatment of AI-generated litigation materials. Practitioners, and clients the same, should expect courts in other jurisdictions to grapple with these same questions—and should not assume they will reach different conclusions. The following practical considerations warrant immediate attention.

A. Rethinking Client Intake and Initial Consultations

The modern client often arrives at an initial consultation having already researched their legal situation extensively online—and increasingly, through AI platforms. After Heppner, intake procedures should affirmatively address this reality. Attorneys should ask clients directly, at the outset of the engagement, whether they have used any AI tools to analyze, summarize, or prepare materials related to their legal matter. If so, counsel must understand the scope of that use and advise the client that those materials may not be privileged.

More importantly, counsel should instruct clients to cease using AI platforms for any purpose related to the legal matter going forward. The instinct many clients now have—to use AI to “prepare” for a meeting with their lawyer—is precisely the conduct that exposed Heppner’s defense strategy to the Government.

B. Discovery Practice: Navigating a New Category of Discoverable Material

Heppner opens a new front in discovery practice. Litigators should now consider whether opposing parties or witnesses have used AI platforms to analyze, prepare, or rehearse testimony related to the litigation. Discovery requests can—and should—be crafted to capture AI-generated materials, including requests for production targeting communications with AI platforms such as ChatGPT, Claude, Gemini, Copilot, or any similar AI tool relating to the subject matter of the litigation.

Interrogatories can ask parties to identify any AI platforms used in connection with the litigation, the dates of use, and the subject matter of the communications. Deposition questioning should explore whether a witness used AI tools to prepare for testimony or to analyze documents produced in the case.

On the defensive side, litigators must prepare for the same requests directed at their own clients. Proactive conversations with clients about their AI usage—before discovery requests are served—will be essential to avoiding surprise and managing privilege disputes.

C. The Narrow Opening: Attorney-Directed AI Use

The court left one potentially significant door ajar, in what appears to be additional benefit to retaining an attorney in an AI-prevalent world. In its analysis, Judge Rakoff observed that “[h]ad counsel directed Heppner to use Claude, Claude might arguably be said to have functioned in a manner akin to a highly trained professional who may act as a lawyer’s agent within the protection of the attorney-client privilege,” citing the Kovel doctrine. See United States v. Adlman, 68 F.3d 1495, 1498–99 (2d Cir. 1995) (citing United States v. Kovel, 296 F.2d 918 (2d Cir. 1961)).

This suggests that where an attorney specifically directs a client to use an AI tool as part of the attorney’s own work process—much as an attorney might direct a client to work with an accountant or forensic consultant—a stronger argument for privilege may exist. Practitioners who wish to incorporate AI into their legal workflows should ensure that any client use of AI is clearly documented as having been directed by counsel, for a specific legal purpose, and as part of counsel’s own analytical process. Even then, the confidentiality problem posed by third-party platform privacy policies remains unresolved. For example, how does this case apply to pro se litigants who essentially operate as their own attorney? Or even, would confidentiality apply in an instance where a litigant instead opts to use an offline or locally hosted AI service, instead of a cloud-based AI service with a broad privacy policy?

The AI revolution has reached the courthouse in many more ways than the one stated above. Clients are already using these tools—often without telling their attorneys, and almost certainly without understanding the privilege consequences. United States v. Heppner makes clear that longstanding legal doctrines apply with full force to this new technology: AI platforms are not attorneys, their communications are not confidential, and documents prepared independently by clients using AI, both inputs and outputs, do not become privileged simply because they are later shared with counsel.

For litigators, the takeaway is immediate and practical. The conversation about AI cannot wait until a privilege dispute arises. It must happen at intake, be memorialized, and be revisited throughout the life of a case. The clients who need this guidance most are often the most sophisticated—the executives, business owners, and professionals who are already using AI daily and who will naturally turn to it when legal trouble arises.