Published 2026-02-15 by TechNet New England
On February 10, 2026, Judge Jed Rakoff of the U.S. District Court for the Southern District of New York issued a landmark ruling that should make every business owner and professional take notice: documents you create using consumer AI tools like ChatGPT or Claude are not protected by attorney-client privilege, even if you send them to your lawyer.
What Happened
In United States v. Heppner, defendant Brian Heppner faced federal securities fraud charges. Heppner used Claude, Anthropic's AI assistant, to analyze his legal situation, running hypothetical scenarios and drafting documents about his case. He asked the AI questions like "what are the elements of securities fraud" and "how might a prosecutor argue this case."
When federal agents seized his electronic devices, they found these AI-generated documents. Heppner's lawyers argued the documents were protected by attorney-client privilege and the work product doctrine. Judge Rakoff disagreed completely.
The Court's Reasoning
Judge Rakoff quickly dismissed any claim of privilege, stating there was "not remotely any basis for any claim of attorney-client privilege." His reasoning came down to three key points:
1. An AI Is Not a Lawyer
The court noted that an AI tool holds no law license, owes no duty of loyalty or confidentiality, cannot form an attorney-client relationship, and is not subject to professional regulation. Communicating with an AI is fundamentally different from communicating with legal counsel.
2. No Expectation of Confidentiality
This is critical for businesses. The court pointed to Anthropic's privacy policy, which states that prompts can be used to train their models and inputs may be disclosed to government authorities and third parties. When you use a consumer AI tool, you have no reasonable expectation that your communications will remain confidential.
3. Work Product Doctrine Failed
Heppner's lawyers conceded that he created the documents "of his own volition" and that the legal team "did not direct" him to run the AI searches. Without attorney direction, work product protection does not apply. The court noted this was more like a client doing their own Google research than participating in legal strategy.
The Waiver Problem
Perhaps most concerning: because Heppner fed information from his attorneys into Claude, the government argued that he may have waived privilege over the original attorney-client communications themselves. Judge Rakoff agreed with this reasoning. Sharing privileged information with a third-party AI platform could destroy the privilege that protected it in the first place.
What This Means for Your Business
Consumer AI Tools Are Not Confidential
If you're using ChatGPT, Claude, Gemini, or other consumer AI tools (including the $20/month subscriptions), anything you type into them could potentially be:
- Used to train the AI model
- Disclosed to government authorities
- Discoverable in litigation
- Not protected by any privilege
Enterprise Tiers Are Different
Enterprise-tier AI agreements (like ChatGPT Enterprise, Claude's commercial and government plans) typically exclude user data from training and include contractual confidentiality protections. If you're using AI for sensitive business matters, you need enterprise-level agreements with clear data handling terms.
Don't Feed Privileged Information to AI
Never input information from your lawyers, attorney communications, or legal strategy documents into consumer AI tools. You could be waiving the very privilege that protects those communications.
AI Research Is Discoverable
If you're facing litigation or a government investigation, assume that any AI-assisted research you've done could be obtained by the opposing party. This includes questions you've asked, scenarios you've explored, and any documents you've generated.
Practical Steps to Protect Your Business
- Audit your AI usage: Know which AI tools your employees are using and what data they're putting into them
- Implement AI policies: Create clear guidelines about what types of information can and cannot be entered into AI tools
- Use enterprise AI when needed: If you need AI assistance with sensitive matters, invest in enterprise-tier services with proper data agreements
- Train your team: Make sure employees understand that consumer AI conversations are not private
- Consult with counsel: Before using AI for anything related to legal matters, investigations, or disputes, talk to your lawyer first
The Bottom Line
This ruling is the first of its kind, but it reflects common-sense legal principles: you cannot expect confidentiality when communicating through a third-party platform that explicitly states it may use and share your data. As AI becomes more integrated into business operations, companies need to be thoughtful about what information they're sharing and with which tools.
The case is U.S. v. Heppner, case number 1:25-cr-00503, in the U.S. District Court for the Southern District of New York.
If you have questions about implementing secure AI policies for your business, contact TechNet New England. We help businesses in Western Massachusetts and Connecticut navigate technology decisions with security and compliance in mind.