In a decision likely to influence how courts evaluate privilege claims involving generative AI, the U.S. District Court for the Southern District of New York recently held that a criminal defendant’s communications with a publicly available AI platform (i.e. ChatGPT, Claude, Gemini, and others) were not protected by either the attorney-client privilege or the work product doctrine. United States v. Heppner, No. 25-cr-00503-JSR, Doc. 27 (S.D.N.Y. Feb. 17, 2026). The court’s opinion addressed the novel question of whether communications with a generative AI platform in connection with a pending criminal matter are privileged — holding unequivocally that they are not protected by either the attorney-client privilege or the work product doctrine and were thereby discoverable through the legal process.

The Underlying Case

Following his indictment on securities and wire fraud charges and a grand jury subpoena, Bradley Heppner, without guidance or direction from his attorneys, asked the generative AI platform “Claude,” to outline potential defense strategies and anticipated arguments – generating approximately 31 written exchanges with the platform. At the time of his inquiries to Claude, Heppner knew he was a target of the investigation. Heppner’s legal counsel later attempted to assert privilege over the AI-generated materials, arguing that the documents were created for the purpose of speaking with counsel to obtain legal advice, and the documents were subsequently shared with his legal counsel. Heppner’s attorney, however, conceded that he did not direct Heppner to use Claude. In response, the government argued that the AI inquiries were not protected by either attorney-client privilege or the work product doctrine, and the Court ultimately agreed.

What is the Attorney-Client Privilege

It is a generally-accepted legal principle that confidential communications between an attorney and a client made for the purpose of obtaining or providing legal advice are privileged, and therefore do not need to be disclosed as part of a legal proceeding. This privilege, however, is usually narrowly construed. In Heppner, the court concluded that the AI outputs failed on multiple levels to meet the requirements of the Attorney-Client Privilege:

  1. No Communication with an Attorney. At the most fundamental level, the AI outputs were communications between Heppner and Claude and not between Heppner and his counsel. Claude, a generative AI platform, is not a lawyer and doesn’t function or purport to be one. The Court emphasized that, absent an attorney-client relationship, discussions of legal issues between non-lawyers are not privileged. The Court also rejected Heppner’s arguments that Claude should be treated like other internet-based tools (such as cloud word processors leveraged by legal counsel), which can, if used properly, maintain attorney-client privilege. Ultimately, the Court found that privilege depends on a “trusting human relationship” with a licensed professional owing fiduciary duties, not merely on the use of certain software.
  2.  No Reasonable Expectation of Confidentiality. Relying on the written privacy policy of Claude’s developer (Anthropic), which states that the company collects user inputs and outputs, may use that data to train the system, and reserves the right to disclose information to third parties, including governmental authorities, even absent a subpoena — the Court held that Heppner could not have had a reasonable expectation of confidentiality in his exchanges with Claude. The opinion also cited recent case law observing that users of publicly accessible AI platforms generally lack substantial privacy interests in such communications.
  3. Not Made for the Purpose of Obtaining Legal Advice. Finally, the Court concluded that Heppner was not communicating with Claude “for the purpose of obtaining legal advice” within the meaning of privilege doctrine. Although Heppner’s legal counsel argued that Heppner used Claude in preparation for their conversations, the Court found that Heppner had acted on his own initiative and not at his legal counsel’s direction. The platform itself expressly disclaims providing legal advice and expressly advises to consult a qualified attorney, when prompted to provide such advice. Critically, the Court emphasized that non-privileged communications do not become privileged merely because they are later shared with counsel.

Work Product Doctrine

The Court next addressed whether the AI outputs were protected as attorney work product. Under governing precedent, work product protection applies to materials prepared by or at the direction of counsel in anticipation of litigation. The doctrine exists to protect lawyers’ mental processes and strategic development. The Court’s ruling on the AI output was again clear; AI outputs do not qualify under the Work Product Doctrine.

Although Heppner’s inquiries to Claude may have been prepared in anticipation of litigation, they were not prepared “by or at the behest of counsel.” Heppner’s counsel confirmed that he did not direct Heppner to conduct Claude searches, and the outputs did not reflect counsel’s strategy at the time they were created. While a prior Federal court decision has suggested that, on occasion, the work product protection may extend more broadly to materials generated by non-lawyers, the Court in Heppner held that extending such protection in this case would undermine the Doctrine’s purpose of preserving a zone of privacy for lawyers’ mental impressions. Because Heppner acted independently when creating the AI outputs and because they did not disclose legal counsel’s strategy, they were not afforded protection under the Work Product Doctrine.

Key Takeaways

The Court’s decision in Heppner provides several practical lessons:

  1. Communications with Public AI Platforms Are High Risk. Courts may treat exchanges with publicly available generative AI tools as communications with third parties, particularly where provider policies permit data retention, training use, or discretionary disclosure.
  2. Direction of Counsel Matters. Materials generated independently by a client, even if intended to aid in future discussions with counsel, may fall outside both privilege and work product protection unless they are prepared at counsel’s direction.
  3. Later Sharing Does Not Cure Defects. Non-privileged communications do not “acquire” privilege simply because they are later shared with legal counsel.
  4. Vendor Terms Are Legally Significant. Privacy policies and terms of service may play a decisive role in determining whether a reasonable expectation of confidentiality exists.

Conclusion

In Heppner, the Court framed generative AI as a “new frontier” but emphasized that established privilege principles still govern; AI’s novelty, per the Court’s ruling, does not expand the scope of attorney-client privilege or work product protection. Organizations and individuals should carefully evaluate how generative AI tools are used in connection with litigation, investigations, or anticipated disputes, and ensure that privilege-sensitive activities occur under counsel’s supervision and within controlled environments.

If you have questions about the Court’s decision in Heppner or how this ruling may affect your organization’s AI governance, litigation strategy, or internal protocols, please feel free to reach out to any member of Winthrop’s Business & Commercial Litigation team.

February 24, 2026