Groundbreaking AI Privilege Opinion Offers Roadmap for Counsel

United States v. Heppner is the first case in the country where a federal judge has weighed in on the intersection of AI and privilege.

The holding itself won’t surprise anyone who thinks carefully about privilege doctrine. But the court’s dicta about what could be protected under different facts is where things get interesting for practitioners.

Why Heppner Lost

Bradley Heppner’s conversations with Anthropic’s AI tool Claude in 2025 focused on his status as a target of a federal securities fraud investigation. His chats discussed financial transactions under government scrutiny and the legal strategies he might need to deploy if indicted.

A federal grand jury in the US District Court for the Southern District of New York had charged Heppner with securities fraud, wire fraud, conspiracy, making false statements to auditors, and falsifying records, a scheme the government alleges caused $300 million in losses to investors. Days later, FBI agents descended on his Dallas home in early November 2025 with both a search warrant and an arrest warrant.

After the FBI raid, Heppner’s counsel negotiated a stipulation allowing them to review seized materials, giving Heppner an opportunity to assert privilege. His attorneys withheld 31 documents logged as “artificial-intelligence generated analysis” for the “purpose of obtaining legal advice.” Heppner claimed both attorney-client privilege and work product protection.

The government, undeterred, filed a motion to release the AI records, arguing they were neither attorney communications nor confidential, and couldn’t have been made at counsel’s direction because Heppner hadn’t yet retained a defense lawyer when the chats occurred. In a 12-page opinion, Judge Jed Rakoff agreed.

The holding itself is unremarkable. Heppner’s AI chats are no more privileged than a Google search. It doesn’t matter how sensitive the subject matter was or that he later handed the results to counsel. Providing search results or AI outputs to a lawyer after the fact doesn’t retroactively cloak those communications in privilege or work product protection.

The Court’s Invitation

What’s notable is what the court said next. Under different circumstances, he wrote, Claude “might arguably be said to have functioned in a manner akin to a highly trained professional who may act as a lawyer’s agent within the protection of the attorney-client privilege.”

That language should ring a bell for most litigators and hopefully all criminal defense attorneys: It’s the Kovel doctrine. To refresh, Kovel extends attorney-client privilege to non-attorney agents (accountants, financial analysts, interpreters, industry specialists, etc.) when:

• The agent is employed by the attorney
• The communication is made in confidence
• The agent’s role is to help the attorney understand complex subject matter well enough to give legal advice.

In Kovel, the accountant translated a client’s financial records into a format the lawyer used to provide legal advice to the client.

Judge Rakoff’s opinion suggests that an AI tool could perform the same sort of highly specialized professional services (processing complex datasets, synthesizing regulatory changes over time, organizing documents for attorney review, etc.), as long as counsel actively directs the process and the communications remain confidential.

That’s a meaningful signal for practitioners.

Heppner’s Open Door

Heppner represents the introductory lines of what will likely be an epic tale about the intersection of AI and legal privilege. The court raises serious questions practitioners must start thinking through now, including:

Direction. The Kovel doctrine requires the agent to operate at the attorney’s direction. What does that look like with AI in practice? Does it require a formal engagement letter? A documented workflow? Queries attributed to the attorney rather than the client? The more documented and operationally genuine the attorney’s role is, the stronger the argument, but the contours remain unclear.

Confidentiality. The Kovel doctrine also requires communications be made “in confidence.” This is where public AI platforms present real problems for attorneys and clients. Most consumer-facing AI tools operate under terms of service that explicitly disclaim confidentiality and retain broad data rights. Whether enterprise or closed-system interfaces fare better is an open and important question. A closed-system AI tool used by a law firm or attorney feels more confidential, but there are no clear answers yet.

Platform design. Does it matter whether the AI tool tells users it can’t provide legal advice? Does it matter that Claude, like most public AI platforms, is an open system rather than a closed enterprise deployment? Courts haven’t weighed in on how these design features map onto Kovel’s confidentiality requirement.

Work product. If an attorney directs an AI platform to analyze documents or synthesize a regulatory framework in anticipation of litigation, arguments exist that the output reflects the attorney’s mental impressions, conclusions, and legal theories, but who wants to be the first to test that argument?

Looking Ahead

The lesson from Heppner is clear: AI use without attorney involvement on commercial platforms with broad data retention practices likely creates a discoverable record. That’s true no matter how sensitive the subject matter or how closely the AI output resembles legal analysis.

For attorneys incorporating AI into their practice, the opinion in Heppner provides a roadmap for potentially protecting privilege, but one that requires intentional, measured construction. Bare assertions that an AI output was prepared “for counsel’s use” will not carry the day. What will matter is whether the attorney’s direction was genuine, documented, and meaningful. Post-hoc labels to client research will not cut it.

The Heppner decision is narrow in its holding and broad in its implications. Courts will keep returning to these questions as AI becomes further embedded in legal practice.

For now, the takeaway is this: the Kovel framework may be the best available tool protecting privilege over attorney-directed AI work, but the attorney must be directing every step.

The case is United States v. Heppner, 2026 BL 52143, S.D.N.Y., 25 Cr. 503 (JSR), 2/17/26.

This article does not necessarily reflect the opinion of Bloomberg Industry Group, Inc., the publisher of Bloomberg Law, Bloomberg Tax, and Bloomberg Government, or its owners.

Author Information

Justin Lugar, a former assistant US attorney, is of counsel with Woods Rogers in Roanoke Va. focusing on federal investigations, white-collar criminal matters, and False Claims Act cases.

Write for Us: Author Guidelines