Discovery Battles to Avoid After Heppner: Protecting Attorney-Client Privilege When Your Clients Use AI

U.S. v. Heppner reads broadly — but the first significant decision on the loss of attorney-client privilege and generative AI is perhaps narrower than it appears. How your client, and your practice, may be exposed — or protected.

You know the story: your client wants to avoid running up a bill, or has just had a difficult deposition. Tonight, on their own laptop, your client is going to try to be their own attorney. They are going to open their personal Claude or ChatGPT and try to make sense of what happened. They will type in their secrets, divulge their theories, speculate, and try to get free legal advice. They'll paste in a deposition transcript, ask whether their answers were good or bad, brainstorm what opposing counsel was driving at. Then, if they think they made progress, they'll share the output with you tomorrow, because they think it helps.

Three months ago, you might have read that paragraph and thought: good, an engaged client. After the recent case of United States v. Heppner, you should be reading it and thinking: this is a problem. They just created non-privileged information subject to discovery.

Maybe yes, maybe no. This is a piece about what Heppner actually held, why the holding is narrower than the headlines suggest, and three things you should do this week if you have not already.

What Heppner held

In February 2026, Judge Jed Rakoff of the Southern District of New York held that thirty-one documents of a criminal defendant's exchanges with Claude — the generative AI assistant developed by Anthropic — were not protected by attorney-client privilege. United States v. Heppner, No. 25 Cr. 503 (JSR), 2026 U.S. Dist. LEXIS 32697 (S.D.N.Y. Feb. 17, 2026). Seeming to establish broad new precedent, it was, in the court's words, "a question of first impression nationwide." And once published and distributed, Heppner is now a doctrinal starting point for any conversation about a client's use of generative AI in a legal case.

As background, the defendant, Bradley Heppner, used Claude after receiving a grand jury subpoena and concluding — correctly — that he was the target of a federal fraud investigation. He fed Claude information on his own, and information he had learned from his counsel. He asked the AI questions about his case and then prepared reports outlining defense strategy that he shared with his counsel. The extent to which those reports informed the defense strategy is unknown, but Heppner shared Claude's outputs with his attorney, who in turn used them to shape strategy "going forward."

As Heppner's counsel put it on the record, Heppner had used Claude "for the express purpose of talking to counsel." But it is clear that Heppner's counsel had already formed some of the case theory before Heppner entered it into Claude, because the court seemed to find that Heppner shared attorney theories with Claude.

When FBI agents seized Heppner's electronic devices, the AI documents went with them. Heppner asserted that the documents were protected by the attorney-client privilege, and that the government therefore could not use them. The government moved for a ruling that the documents were not privileged. Judge Rakoff agreed, finding that the documents lacked at least two — and probably all three — of the privilege's required elements.

First, the communications were not "between a client and his or her attorney." Because Claude is not an attorney, the court held, "that alone disposes of Heppner's claim of privilege." As a foundational matter, Claude is a large language model that disclaims giving legal advice. It is, of course, not a licensed attorney. But there are times when communications between a client and a non-attorney retain privilege, as discussed below. The court's conclusion that this alone disposes of the claim is, with respect, oversimplified and overbroad.

Second, the court ruled that the documents were neither intended to be nor in fact kept confidential. The court emphasized that Anthropic's privacy policy at the time provided that the company collected user inputs and outputs, used them to train its models, and reserved the right to disclose user data to "governmental regulatory authorities" or "in connection with claims, disputes[,] or litigation." Heppner, the court held, "could have had no reasonable expectation of confidentiality" in his communications with Claude. Whether Heppner had a subjective expectation of confidentiality was apparently irrelevant.

Third, the court held that Heppner did not use Claude "for the purpose of obtaining legal advice." This is a factual finding made without an evidentiary hearing, resting largely on Anthropic's own documentation that Claude does not and cannot give legal advice. Claude is an AI system, not a lawyer. Even though Heppner's subjective, express purpose was to facilitate communication with his lawyer, the court framed the question as whether he intended to obtain legal advice from Claude itself. It seems the court decided the question on Anthropic's representations about what Claude can do: Heppner could not have intended to get legal advice, the court reasoned, because Claude disclaimed providing legal advice when asked. That reasoning is largely definitional.

However, opening a different avenue, the court noted that it might have been a different story had Heppner used Claude at the direction of his counsel. Then, the court suggested, Claude might have functioned as a lawyer's highly trained agent, covered by the privilege under United States v. Kovel, 296 F.2d 918 (2d Cir. 1961).

The headline reading of the decision: AI exchanges are not privileged.

True in part, and perhaps too true in many cases. But that is also only part of the story.

What Heppner doesn't mean

In a thoughtful Harvard Law Review commentary published a month after the decision, Elizabeth X. Guo argued that the Heppner opinion's reasoning, taken to its logical end, would categorically exclude generative AI from the privilege — and that such exclusion would be both inconsistent with how courts treat other ubiquitous technologies and unsustainable as a doctrinal matter. Guo, United States v. Heppner, Harv. L. Rev. Blog (Mar. 23, 2026). Her observations are worth taking seriously.

On the first element — communication between client and attorney — Guo notes that courts already routinely apply privilege to client communications mediated through tools. The Heppner court treats tools as somehow different from AI. Courts have maintained privilege when information is processed through tools like Gmail, Google Slides, Slack, and iCloud, all of which involve third parties with both technical and contractual access to user data. See, e.g., United States v. Nunez, 2013 WL 4407069 (S.D.N.Y. Aug. 16, 2013) (Gmail); Stirratt v. Uber Techs., 2024 WL 1723710 (N.D. Cal. Apr. 19, 2024) (Google Slides); United States v. Alexander, 2025 WL 3154981 (S.D.N.Y. Oct. 17, 2025) (iCloud). On the same day as Judge Rakoff's oral ruling, a district court in Michigan held that generative AI tools are "tools, not persons" — closer to a notebook than to a human third party. The Heppner court's contrary assumption is contestable.

That said, one distinction cuts the other way. Unlike a tool that merely transmits or stores what a client writes, generative AI can augment and challenge that input before returning it — and a court may treat that as relevant to whether AI is a mere tool or something more. The point should not be overstated; the user still decides what to accept or reject. But it is an open question, and not one Heppner resolves.

On the second element — confidentiality — much of this is technical, and turns on the terms of service of the AI provider the client used. To remain confidential, the provider should not use the input for any other purpose, including training the model. The Heppner court seemed to assume that consumer-tier inputs could be used to train the model. Guo points out that Anthropic excludes its commercial-tier customers' inputs from training by default, that consumer-tier users can opt out of data collection, and that enterprise-tier customers can negotiate zero-data-retention agreements with Anthropic. Heppner turned on a privacy policy that applied to a consumer user. It does not necessarily reach inputs governed by a different, more protective contractual regime.

The "reasonable expectation of confidentiality" inquiry, Guo argues, should be subjective — it should turn on what a user reasonably expected, not on what an AI company's standard consumer terms happen to permit. That is a legitimate argument, but it may not persuade a court. Privilege is generally waived when a client discloses privileged material outside the attorney-client relationship — to a friend, to a neighbor, or in public. A court could readily treat a client's use of consumer AI, under terms that permit the provider to retain and disclose what the client enters, as a disclosure of exactly that kind.

The third element — purpose — is where Guo makes her most important contribution. Courts have long protected a client's self-prepared notes when those notes are taken to facilitate communication with counsel. See United States v. DeFonte, 441 F.3d 92 (2d Cir. 2006); United States ex rel. Patzer v. Sikorsky Aircraft Corp., 575 F. Supp. 3d 1032 (E.D. Wis. 2021); United States v. ChevronTexaco Corp., 241 F. Supp. 2d 1065 (N.D. Cal. 2002); Bernbach v. Timex Corp., 174 F.R.D. 9 (D. Conn. 1997); Clark v. Buffalo Wire Works Co., 190 F.R.D. 93 (W.D.N.Y. 1999). The question is not whether the client intended to get advice from her notes. It is whether she intended to use the notes to facilitate getting advice from her lawyer. By that lens, Heppner's use of Claude looks much more like protected notetaking than like waived privilege.

The point is not that Judge Rakoff got Heppner wrong. It is an important decision that warrants careful consideration. The larger point is that there is more to the story, and it needs to be addressed. AI is not going away; it is becoming ever more pervasive. Across the country, clients are very likely entering confidential communications into consumer AI and second-guessing the advice they have received — material that may later surface in discovery.

The point is this: the caselaw is developing, and the Heppner decision rests on facts or assumptions that can be anticipated, argued, mediated, or designed around. Heppner does not address every issue. The defendant there used a consumer product, under consumer terms, without his lawyer's direction, in a way that produced material from which he intended to seek legal advice. Change those facts — a different tier of service, a different contractual regime, a different role for the lawyer, a different framing of purpose — and the analysis changes. But the underlying risk remains, and there is no simple fix. It would be a mistake to assume the problem will resolve itself without a new approach.

This is not an academic concern. Opposing counsel wants your client's AI exchanges; they offer a detailed roadmap of the case. Counsel may seek to introduce them at trial and to cross-examine your client on them. And under many readings of Heppner, a judge may well find them not privileged, and therefore discoverable. Privileges are construed narrowly, and the burden of establishing privilege rests with the party asserting it.

Which way the doctrine moves will depend, in large part, on what attorneys do with AI now.

Three things every attorney should do this week

One. Stop your clients from using consumer-tier AI for any client matter. Consumer Claude, ChatGPT, and Gemini all permit — by default or by their terms of service — some combination of model training, data retention, and disclosure to third parties. Even if you have personally opted out, your client probably has not. And that opt-out is fragile: privacy policies change, sometimes more than once a year, and your record of what was in effect on a given date can be hard to reconstruct. For your own work, use commercial-tier or enterprise-tier products. Anthropic, OpenAI, and Google all offer business products in which inputs are excluded from training by default; enterprise tiers can be negotiated for zero data retention and a signed Data Processing Agreement. The price difference is modest. The privilege difference is not.

Two. Update your engagement letters — and tell clients why. Every new engagement letter should address AI use explicitly: at a minimum, a clause directing the client not to enter case information into consumer AI tools. But a restriction the client does not understand is one the client will not follow. Explain the reason — that an exchange they assume is private may end up in opposing counsel's hands — and tell them what to do instead: bring their questions, their notes, and their theories to you. And do not limit this to new matters. A short notice to current clients costs little, and closes the most immediate gap.

Three. Until a privilege-preserving alternative exists, steer clients back to traditional notetaking. As the notetaking cases above make clear, courts have long protected a client's own notes when those notes are prepared to facilitate communication with counsel — and that protection is the safe harbor Heppner leaves intact. Tell clients that the place to work through their questions, their account of events, and their reactions to a deposition is a private notebook, or a document they keep to themselves and bring to you. The discipline is simple: the client's thinking should reach their lawyer, and no one else.

What's coming

Heppner is the first widely publicized decision on generative AI and attorney-client privilege. It will not be the last. The doctrine will evolve case by case, the way doctrines do — pressed by opposing counsel, exposed by clients' inadvertent disclosures, and then built out through the accumulation of arguments and facts, appeals taken, and the slow construction of distinctions. What attorneys do now will determine whether AI becomes a multiplier of the privilege or a quiet eroder of it. But prepare for several years of conflicting decisions.

The good news is that a path to client use of AI that preserves privilege is technically and doctrinally available. We are working on it.

The bad news is that it is not the path of least resistance. The default behavior — clients using consumer AI to think through their cases, attorneys using consumer AI to draft and brainstorm — is the path Heppner describes. And that path leads where Heppner led: the loss of privilege after the fact, once the discussion is already inside the AI and in opposing counsel's hands.