Client’s AI Chats Aren’t Privileged. What’s the Rule for Counsel?

Greater dangers than hallucinations lurk when white-collar criminal clients turn to artificial intelligence for legal advice rather than their lawyers. In such cases, clients may believe they can use AI to assist in their defense, and that their efforts are protected from disclosure to the prosecution based on the attorney-client and work product privileges.

A Feb. 17 decision by Southern District of New York Judge Jed Rakoff makes exquisitely clear that ain’t necessarily so.

In United States v. Heppner, Bradley Heppner was charged with defrauding, among others, the publicly traded GWG Holdings, Inc. He allegedly made false representations, causing GWG to enter into undisclosed self-serving transactions with two entities that Heppner himself controlled.

The government seized Heppner’s computers and 31 documents memorializing “communications” between Heppner and Claude, a generative AI platform. These documents were created after Heppner was subpoenaed and informed by counsel that he was a government target.

The exchanges were critical because they contained reports outlining defense strategy with potential legal and factual arguments in defense of possible government charges. Effectively, Heppner prepared these reports with assistance by Claude, in anticipation of an indictment.

During oral argument, Heppner’s counsel said the reports weren’t prepared by him—nor with his blessing, encouragement, or approval. In fact, counsel said he was unaware that Heppner was creating these documents by “communicating” with an AI platform.

In what appears to be a case of first impression, Rakoff outlined the rather narrow parameters of the two doctrines and found that neither the attorney-client privilege nor the work product doctrine applied, so the strategic documents were open to disclosure.

Assuming Rakoff’s decision is upheld, its practical implications are immediate.

Counsel must discuss with clients at the outset of representation the client must refrain from conducting AI research independently, even if the client believes such research is critical. This could be a client management challenge as the client may view this advice as uninformed, controlling, or even financially motivated despite the attempt to protect privilege. Foregoing that conversation presents a serious risk for an aggressive client who wants personal involvement in the defense.

Rakoff found that the transmission from client to lawyer of information from a generative AI platform won’t revive a waived privilege. The court didn’t specifically address whether the privileges would apply if Heppner’s counsel created the documents using AI, if counsel had asked Heppner to do so, or if the client had used a secure enterprise AI platform. Those questions will certainly arise in future cases, and, until resolved, confidentiality remains dangerously at risk.

Traditionally, privilege attaches to communications between attorney and client to obtain or provide legal advice intended to be kept confidential. A privileged communication must be just that: a communication between individuals. Claude is not an individual.

Furthermore, Claude’s privacy policies expressly warn that the encounter isn’t private. This much is clear: When open versions of AI platforms like ChatGPT or Claude are used, the exchanges are never confidential.

So what if an attorney, without the aid of a client, places strategic ideas into an open-source AI program? Will courts find that the program’s privacy policies and terms of use override attorney-client and work product protections? Does a closed system cause a different result?

What if Heppner or his lawyer had employed a closed generative AI system, like Microsoft’s Copilot? For Heppner, those exchanges still don’t qualify as attorney-client communications. For his lawyer, the answer is not so clear because we know that Co-Pilot will indeed train on his data (as open AI systems do), unless the lawyer affirmatively “opts out.”

Thus, by affirmatively opting out, counsel may preserve privilege within a closed system like CoPilot. Bear in mind, however, that Microsoft’s Privacy Policy nonetheless reserves the right to share stored data “when required by law or to respond to legal process.” Thus, Microsoft still will honor subpoenas and yield to search warrants for what the lawyer might have thought was work product.

Additional case law will determine whether courts continue to apply traditional privilege analyses or whether they ultimately recognize, as with cell phone technology, that the sphere of privacy should expand as technology advances so that lawyers can use technology without jeopardizing privilege.

A lesson from Heppner is that it’s one thing for a client to blow the two privileges himself, but it’s quite another for the lawyer to do so by unknowingly employing AI carelessly. In so doing, counsel may lose both the criminal case and a malpractice suit brought by the client.

The case is United States v. Heppner, 2026 BL 52143, S.D.N.Y., 25 Cr. 503 (JSR), 2/17/26.

This article does not necessarily reflect the opinion of Bloomberg Industry Group, Inc., the publisher of Bloomberg Law, Bloomberg Tax, and Bloomberg Government, or its owners.

Author Information

Joel Cohen, a former state and federal prosecutor, practices white-collar criminal defense law and is an adjunct professor at Fordham and Cardozo Law Schools.

Douglas Nadjari is a partner at Ruskin Moscou Faltischek and a former prosecutor in the Brooklyn District Attorney’s office.

Write for Us: Author Guidelines