Download a Sample Client AI Confidentiality Notice
Every few months we see a headline suggesting that artificial intelligence has upended some settled area of law. It usually hasn’t. More often, a court simply applies existing doctrine to a new tool and reaches the same result it would have reached twenty years ago with email, Google, or a yellow legal pad. A recent ruling from the Southern District of New York is a good example.
In United States v. Heppner, a criminal defendant used the AI tool Claude to generate written analyses related to his situation. Importantly, this was not a purely “pre-lawyer” scenario. By the time Heppner used the tool, he reportedly knew he was a law enforcement target and had already engaged counsel. That timing at least made a work product argument colorable.
Even so, the court rejected privilege and work product protection and allowed the documents to be used. From the bench, Judge Rakoff was blunt: “I’m not seeing remotely any basis for any claim of attorney-client privilege.” Some coverage framed this as an “AI privilege” case. It really isn’t. It is a privilege case that happens to involve AI. And doctrinally, the outcome is exactly what you would expect.
Privilege Has Always Been about Relationships, Not Tools
Attorney-client privilege protects confidential communications between a client and a lawyer for the purpose of obtaining legal advice. The relationship is what matters. Not the technology. Not the format. Not the sophistication of the drafting process.
If I write notes to myself, those notes are not privileged. If I brainstorm with a friend, that conversation is not privileged. If I type my thoughts into a software platform run by a third party, that is not privileged. Nothing about that analysis changes because the platform is labeled “AI.”
In Heppner, the documents were generated through a commercial, third-party system. The AI provider was not the lawyer. It was not the lawyer’s agent. It was not functioning inside the attorney-client relationship. That alone creates a structural problem for privilege. Forwarding those materials to counsel later does not retroactively convert them into privileged communications. If it did, any business record could become privileged simply by emailing it to your attorney. Courts have rejected that theory for decades. It is important to note that Judge Rakoff noted that had the lawyers instructed Heppner to use AI, the result might have been different.
The Dispositive Issue was Control and Confidentiality
Even accepting that counsel had already been retained, the key problem remained the same: the materials were created by sending sensitive information to a third-party vendor outside the attorney-client relationship. Privilege doctrine has always treated voluntary disclosure to outsiders as fatal or at least highly problematic.
From an evidentiary perspective, a consumer AI platform is not meaningfully different from a shared cloud service, a consultant, a friend, or any other non-lawyer third party. Courts do not protect those communications simply because they feel related to legal strategy.
Privilege protects communications with your lawyer, not tools you use while thinking about your case. That is why this opinion reads as routine rather than groundbreaking. Replace “Claude” with “Google” or “Excel” and the analysis comes out the same way.
The Interesting Wrinkle: Trial Complications
The ruling does create one modern complication worth noting. Because the defendant reportedly fed information from his attorneys into the AI system, Judge Rakoff flagged a potential downstream problem: if the prosecution tries to use these materials at trial, defense counsel could become a fact witness about what was shared and how the documents were created.
That raises the possibility of a witness–advocate conflict. In other words, even after winning the privilege fight, the evidentiary picture is not clean. That is not a traditional privilege issue. It is a practical litigation consequence that arises specifically because sensitive legal information was routed through an external system. It’s a good example of how AI use can create collateral problems even when the doctrinal answer is straightforward.
This is Not Anti-AI. It is Ordinary Privilege Law.
I do not read this decision as hostility toward AI. I read it as doctrinal consistency. Courts are not saying “AI destroys privilege.” They are saying something much simpler: if you disclose sensitive information to a third party outside the attorney-client relationship, you should not expect privilege to apply. That principle predates generative AI by decades. AI just makes the boundary easier to see.
A Practical Step Lawyers Should Consider
There is also a mundane operational takeaway here. Clients can waive privilege on their own, often without realizing it. A client who pastes facts, documents, or strategy into a consumer AI tool may be disclosing that information to a third party before the lawyer ever sees it. By then, the damage may already be done.
One straightforward response is client education. Providing new clients with a short written advisory that explains that communications with the lawyer are confidential, that communications with third-party platforms generally are not, and that consumer AI tools should not be used for sensitive legal matters without counsel’s guidance is simply basic risk management.
We already warn clients not to forward privileged emails or copy outsiders. AI belongs in the same category. It is just another third party.
One Distinction That Does Matter: Consumer vs. Enterprise Tools
There is, however, an important nuance. Not all AI environments are identical. Consumer tools typically retain prompts, process data on shared infrastructure, and operate under broad vendor terms. Enterprise or controlled deployments may avoid training on inputs, maintain contractual confidentiality, operate inside secured environments, and function more like a firm-controlled technology stack. Those differences could matter in a future privilege analysis.
Using an enterprise system under attorney control looks much more like using internal firm software than disclosing information to the public internet. Courts may reasonably treat those situations differently. But that is a different factual posture than typing sensitive information into a consumer chatbot on your own.
I Disagree with the Reasoning, Not the Result
I agree that Heppner does not have privilege in this case because he was not instructed by counsel to use AI and AI cannot act as counsel. But I disagree with Judge Rakoff’s reasoning. Simply reviewing the privacy policy of an AI and failing to look at the settings Heppner was actually using was a mistake, in my opinion. I also think there could be other reasons for the evidence to be kept out because AI is actually meant to be private. In criminal cases especially, where defendants should enjoy robust privacy for internal preparation (akin to a digital diary), courts might benefit from more granular inquiry into tool configurations before finding waiver.
When we chat with AI, we are generally not expecting to share that information with third parties. Even if training is left on, the results, when used by the AI company, are anonymized. The notion that AI is public is, to my mind, a mistake. I think a deeper analysis is required in this case than Judge Rakoff actually engaged in.
It is also interesting to note that another judge, this time an expert in discovery, ruled the opposite. In a civil case Warner v. Gilbarco, Magistrate Judge Patti found that privilege did attach and that the Defendant was on a fishing expedition. I suspect Heppner will appeal, and the appellate court may disagree with Judge Rakoff’s reasoning.
The Bottom Line
Novel technology does not produce novel privilege law. The doctrine has not changed. If sensitive information is shared with a third party outside the attorney-client relationship, courts are going to analyze it the same way they always have. The tools are new. The analysis isn’t.