Does using AI waive legal privilege? What United States v. Heppner actually decided

Yes, on the facts of that case, but not because AI itself voids privilege. Judge Jed Rakoff's February 17, 2026 opinion in United States v. Heppner held that a criminal defendant's chats with Claude weren't protected by attorney-client privilege or the work product doctrine. The reason wasn't that he used AI. It's that he used it on his own, without his lawyer telling him to, and the platform's own terms let it retain and disclose what he typed. The ruling leaves a specific door open: AI used at counsel's direction, functioning as the lawyer's agent, might still be privileged. That distinction is the part almost every write-up of this case buries or skips entirely, and it's the part that actually changes what you tell a client.

What happened in Heppner

Bradley Heppner, former CEO of a public company, was indicted for securities and wire fraud on October 28, 2025. Before the indictment, once he knew from grand jury subpoenas that he was a target, he started feeding information into Claude on his own initiative. Not at his lawyer's suggestion. He used it to organize what he'd learned from his attorney and to draft materials outlining possible defense arguments, then shared those outputs with counsel, who factored them into strategy going forward.

When the FBI arrested him on November 4, 2025 and searched his home, they seized devices containing 31 documents of his exchanges with the AI. His defense team put those documents on a privilege log. The government moved to strip that protection on February 6, 2026. Judge Rakoff ruled from the bench on February 10 and issued his full written opinion a week later, in case number 25-cr-00503-JSR in the Southern District of New York. He called it "a question of first impression nationwide."

Why the court said no privilege applied

Rakoff's opinion walked through the three elements attorney-client privilege requires, and found Heppner's AI chats failed at least two of them, maybe all three.

First, the communications weren't between a client and an attorney. Claude isn't a lawyer, and the court treated that as close to dispositive on its own. Second, Heppner had no reasonable expectation of confidentiality. Anthropic's consumer terms, which the court quoted directly, state that the company collects both user inputs and Claude's outputs, uses that data to train the model, and reserves the right to disclose it to third parties including regulators and in connection with litigation. Third, Heppner didn't communicate with Claude for the purpose of obtaining legal advice from it. When the government asked Claude directly whether it could give legal advice, it said no. The court used that disclaimer against him: since Claude itself said it wasn't providing legal advice, Heppner couldn't have reasonably believed he was getting any.

Work product fared no better. Rakoff drew a line between materials that merely affect a lawyer's later thinking and materials that reflect the lawyer's own mental impressions at the time they were created. Heppner's chats did the first, not the second, because his lawyer never directed him to create them.

The distinction nobody else is writing about

Here's what most coverage of Heppner flattens into "AI use waives privilege, full stop." Rakoff didn't say that. He said this specific, self-directed use of a public consumer AI tool didn't meet the privilege test. He explicitly floated a different outcome: if Heppner's attorney had directed him to use Claude as part of building the case, the Kovel doctrine, the same rule that lets a lawyer route communications through a non-attorney expert like an interpreter or forensic accountant and keep privilege intact, might have applied.

That's the operative fact for your practice. The line isn't "AI in, privilege out." It's who directed the use, and whether the tool was acting as the lawyer's instrument or the client's own initiative. A client venting theories into ChatGPT on a Sunday night is legally different from a client using a tool you told them to use, in the way you told them to use it, to prepare for a call with you. Nobody covering this case so far has connected it back to Kovel as an actual playbook item, and it's sitting right in the opinion.

What this means for privilege logs and discovery going forward

Husch Blackwell's read of the opinion flags a practical detail worth taking seriously: the fact that Heppner's own defense team put the AI documents on a privilege log is what triggered the government's motion in the first place. If you don't disclose that a client used AI, opposing counsel may never know to ask. But once you do log it, or once discovery surfaces it, you're litigating this exact question. Expect deposition questions about AI use to become standard in commercial litigation and white-collar matters within the next year. Update your intake process now: ask new clients whether they've discussed their matter with any AI tool before you ask anything else, and revisit that question every time the matter escalates.

Enterprise tools change the analysis, but don't guarantee it

Rakoff's confidentiality finding hinged specifically on Anthropic's consumer-tier terms of service, the ones that apply to a free or Claude Pro account. Anthropic's commercial and enterprise API tiers exclude user data from training by default, and enterprise customers can negotiate zero data retention agreements. None of that was in front of the court in Heppner because Heppner was using a personal account. A firm running matters through an enterprise AI deployment with a signed data processing agreement and no training on inputs has a materially different confidentiality argument to make, though no court has tested that fact pattern yet either. Don't assume enterprise tier alone solves it. The purpose element, whether the AI use was directed by counsel and functioning to obtain legal advice, still has to be satisfied separately.

We've written before about the mechanics of what "do not train on my data" actually covers in our confidentiality checklist, and about how consumer opt-out settings interact with litigation holds in our piece on ChatGPT Free's training opt-out. Heppner is the sharpest confirmation yet that a privacy toggle and a legal privilege determination are two entirely different questions, and treating them as one is exactly how firms get exposed.

For the full framework on directing AI use so it stays defensible, get The Lawyer's AI Starter Kit, free. To see which tools actually offer contractual data protection out of the box, check the best AI tools for lawyers.

FAQ