When a party communicates with a publicly available AI platform in connection with a legal dispute, are the party’s communications protected by the attorney-client privilege or work product doctrine?
In one of the earliest decisions on this issue, Judge Jed S. Rakoff—an influential judge in the Southern District of New York—held that such communications were not protected. Although far from the final word on this issue, the decision offers practical lessons for clients seeking to preserve the confidentiality of their communications with their attorneys.
Facts
In 2025, Benjamin Heppner received a grand jury subpoena suggesting he had committed securities and other fraud. Shortly thereafter, he began using Claude, a generative AI platform, to prepare a defense strategy.
In late 2025, Heppner was arrested. In connection with the arrest, the FBI executed a search warrant at his home and seized, among other things, his electronic devices. His counsel later represented to the government that the seized materials included his communications with Claude regarding his defense strategy.
Heppner’s counsel asserted that the communications with Claude were protected by the attorney-client privilege and/or work product doctrine. The government disagreed and sought to review the communications.
Court’s decision
On February 17, 2026, Judge Rakoff issued a written decision indicating that neither the attorney-client privilege nor work product doctrine protected the communications.
Attorney-client privilege: As Judge Rakoff recounted, the attorney-client privilege protects communications (1) between a client and his or her attorney (2) that are intended to be, and in fact were, kept confidential (3) for the purpose of obtaining or providing legal advice.
Judge Rakoff concluded that none of those elements were satisfied. Element (1) wasn’t satisfied, Judge Rakoff reasoned, because the communications at issue were between Heppner and Claude—not an attorney. Nor did Heppner satisfy the confidentiality requirement in element (2) because Claude’s privacy policy provides that the system collects data on both users’ “inputs” and Claude’s “outputs,” that it uses such data to “train” Claude, and that Claude’s owner reserves the right to disclose such data to “third parties.” Finally, Judge Rakoff also concluded that element (3) hadn’t been satisfied, in part because Heppner didn’t communicate with Claude at the direction of counsel.
In an important footnote, Judge Rakoff also indicated that even if Heppner’s inputs to Claude incorporated privileged information between Heppner and his counsel, he “waived the privilege by sharing that information with Claude . . ., just as if he had shared it with any other third party.”
Work product: The work product doctrine—which is related but distinct from attorney-client privilege—provides qualified protection for materials prepared by or at the behest of counsel in anticipation of litigation or for trial.
Judge Rakoff concluded that the work product doctrine didn’t protect the materials. His opinion emphasized that the documents reflecting communications with Claude weren’t prepared at the behest of Heppner’s counsel. While the documents may have disclosed Heppner’s legal strategy, the documents didn’t disclose his counsel’s legal strategy. The work product doctrine therefore didn’t protect the documents.
Takeaways
It’s important to emphasize the limitations of this case. Although the ruling relies on traditional attorney-client privilege and work product principles, the decision is a fact-specific ruling by a single federal judge and doesn’t constitute binding precedent. As other judges grapple with these emerging issues, under different facts, there will be more guidance to come. (And, indeed, a judge in the Eastern District of Michigan has already issued a ruling contrary to certain aspects of the Heppner decision.)
As the courts continue to sort through these issues, however, businesses and other clients can take steps now to ensure that their communications are sufficiently protected. In particular, businesses should consider the following:
Involve attorneys: An obvious but important point is that there is no attorney-client privilege without an attorney. If you choose to consult an AI system regarding a legal issue, then you should at a minimum involve counsel at the earliest opportunity. The attorney can then provide guidance regarding protecting the confidentiality of any communications.
Scrutinize AI provider terms: Judge Rakoff’s decision also reflects that the specific terms and conditions and privacy policies of the AI system matter. If the AI system shares inputs and outputs with third parties, then any information shared with the system is arguably not privileged or otherwise protected, even if an attorney is involved. But if the AI system maintains the confidentiality of the inputs and outputs—as certain “enterprise” and other AI systems do—then the disclosure of information to the AI system is less likely to result in a waiver of protected rights.
Prepare policies: Different businesses will have different risks tolerances with respect to the use of AI tools. Whatever the risk tolerance, however, you should ensure that employees know which AI tools they are permitted to use for work purposes and under what circumstances. Indeed, for organizations, privilege may be only as strong as the least trained user. A single employee’s decision to paste legal advice or strategy into an unapproved tool can jeopardize the company’s protection over that material. You should ensure your employees know what is permitted and what is not.
David S. Levine and Ryan M. Hubbard are attorneys with Fox, Swibel, Levin & Carroll, LLP, and can be reached at dlevine@foxswibel.com and rhubbard@foxswibel.com.