AI-induced privilege waiver rattles lawyers everywhere

Listen to this article

BOSTON — Lawyers across the country are assessing the ramifications of a federal judge’s ruling that a white-collar criminal defendant waived the attorney-client privilege to — and lacked work-product protections for — information in documents he created using a consumer-grade artificial intelligence tool.

The government in U.S. v. Heppner moved for a ruling that neither the attorney-client privilege nor the work product doctrine prevented prosecutors from having access to certain written communications that defendant Bradley Heppner exchanged with the AI platform Claude.

Heppner used the AI tool before his arrest but after he was subpoenaed by a grand jury and became aware he was the target of a criminal investigation.

U.S. District Court Judge Jed S. Rakoff in the Southern District of New York granted the government’s motion first in a Feb. 10 ruling from the bench and then in a Feb. 17 opinion memorializing his bench ruling.

In his written decision, Rakoff acknowledged that the ruling “appears to answer a question of first impression nationwide: whether, when a user communicates with a publicly available AI platform in connection with a pending criminal investigation, are the user’s communications protected by the attorney-client privilege or the work-product doctrine?”

In explaining his bench ruling, Rakoff rejected defense counsel’s argument that the materials in question were protected from disclosure because Heppner in his interactions with Claude had inputted information learned from counsel, created the documents in question for the purpose of obtaining legal advice, and later shared those documents with counsel.

“AI’s novelty does not mean that its use is not subject to longstanding principles, such as those governing the attorney-client privilege and the work product doctrine,” Rakoff wrote. “Because Heppner’s use of Claude fails to satisfy either of these rules, the AI documents do not merit the protections Heppner has claimed.”

Boston lawyer Jessica Gray Kelly, who chairs her firm’s professional liability and errors and omissions national practice section, said in an email that the client’s communications with the AI platform in Heppner “clearly” were not attorney-client communications.

“The court could have stopped at saying these were not communications between an attorney, or an agent of the attorney, and a client,” Kelly said. “But the court further explained that the attorney-client privilege is based on a ‘trusting human relationship’ between a client and a person who is licensed to practice law and has fiduciary duties. This note is important because it highlights the attributes of human lawyers that AI will not be able to replace.”

Business litigator Nicole J. Benjamin said baked into the decision “is that we now have a heightened duty to advise clients of the risks of using AI.”

Benjamin said she found one aspect of the decision particularly concerning: its discussion of confidentiality and the notion that communications with an AI platform are not treated as confidential.

“That raises very different issues for lawyers and law firms,” said Benjamin, who co-chairs the cyber and data security practice group at her Providence firm.

Burlington business litigator Sean T. Carnathan said he agreed with the judge’s analysis of the issues presented in the case.

“When you walk through the analysis, you can see how he got to where he got to,” he said.

According to Carnathan, aside from addressing a cutting-edge issue, one reason Rakoff’s ruling has struck a chord with legal bloggers across the country is the judge’s reputation as a top jurist and one of the more influential members on the federal bench.

“Judge Rakoff is a big hitter,” Carnathan said. “That’s probably why this case is getting so much attention. He’s not just some random judge.”

What happened in ‘Heppner’

According to court records, Heppner involved the defendant’s Oct. 28, 2025, indictment for securities fraud, wire fraud and related charges. The criminal charges related to actions the defendant allegedly took as an executive of the publicly traded company GWG Holdings, Inc.

Prosecutors alleged that Heppner defrauded GWG investors of more than $150 million by making false representations about the company and orchestrating one-sided, self-serving deals between GWG and two companies controlled by Heppner.

On Nov. 4, 2025, FBI agents arrested Heppner and executed a search warrant at his home. During the course of the search, the government seized numerous documents and electronic devices.

In the aftermath of the search, defense counsel notified prosecutors that approximately 31 of the seized documents memorialized Heppner’s communications with the AI tool Claude.

Defense counsel would assert that those documents were generated “in 2025, after Mr. Heppner had received a grand jury subpoena [and] after it was clear [from] discussions with the government that Mr. Heppner was the target of this investigation.”

Further, defense attorneys would claim that Heppner prepared the documents in anticipation of a potential indictment for the purpose of outlining a defense strategy in response to likely charges.

After the defendant notified prosecutors he would be asserting that the AI-generated documents were privileged, the government agreed to segregate those materials from inspection until resolution of Heppner’s claim of privilege.

In the government’s motion in opposition to the defendant’s assertion that the documents were protected, Assistant U.S. Attorney Alexandra N. Rothman argued that the attorney-client privilege did not apply because the documents did not memorialize communications between the defendant and counsel.

“[O]utside of certain narrow exceptions not relevant here, the attorney-client privilege does not attach to non-attorney communications,” Rothman wrote. “The defendant’s use of the AI tool here is no different than if he had asked friends for their input on his legal situation. But it is well-settled that discussing legal matters with non-attorneys does not imbue those communications with the attorney-client privilege.”

As to the work product doctrine, Rothman pointed to a concession by defense counsel that Heppner had not acted at the direction of his lawyers in creating the AI documents.

“Had counsel directed the defendant to run the AI searches, the analysis might be different,” Rothman wrote. “But the defendant elected to run his own AI searches and then shared the outputs of those searches with counsel. The policy interests underlying the work-product doctrine — to ‘preserve a zone of privacy in which a lawyer can prepare and develop legal theories and strategies “with an eye toward litigation,” free from unnecessary intrusion by his adversaries,’ — simply do not apply.”

No privilege

In finding Heppner’s AI-generated documents were not protected by the attorney-client privilege, the judge concluded that the materials lacked at “least two, if not three” of the essential elements of the privilege.

First, he found the documents were not communications between Heppner and his attorneys.

“Because Claude is not an attorney, that alone disposes of Heppner’s claim of privilege,” Rakoff wrote.

Next, he found that the privilege did not apply because the communications memorialized in the documents were not confidential.

“This is not merely because Heppner communicated with a third-party AI platform but also because the written privacy policy to which users of Claude consent provides that Anthropic collects data on both users’ ‘inputs’ and Claude’s ‘outputs,’ that it uses such data to ‘train’ Claude, and that Anthropic reserves the right to disclose such data to a host of ‘third parties,’ including ‘governmental regulatory authorities,’” he wrote.

One layer of protection might be to tell your clients up front, ‘Don’t do this without talking to me.’ At our firm, we send around a memo to our clients reminding them about the attorney-client privilege. I’m literally going to edit that memo to add a section about AI searches.

— Sean T. Carnathan, Burlington

Rakoff found it to be a “closer call” as to whether Heppner could meet the third privilege element: whether his communication with Claude was for the purpose of obtaining legal advice.

“Had counsel directed Heppner to use Claude, Claude might arguably be said to have functioned in a manner akin to a highly trained professional who may act as a lawyer’s agent within the protection of the attorney-client privilege,” Rakoff wrote. “But because Heppner communicated with Claude of his own volition, what matters for the attorney-client privilege is whether Heppner intended to obtain legal advice from Claude, not whether he later shared Claude’s outputs with counsel. And Claude disclaims providing legal advice.”

In finding the work product doctrine did not protect Heppner’s AI documents, Rakoff once again pointed to the undisputed fact that that the defendant had acted on his own.

“The AI documents do not merit protection under the work product doctrine because, even assuming, arguendo, that they were prepared in preparation ‘in anticipation of litigation,’ they were nevertheless not ‘prepared by or at the behest of counsel,’ nor did they reflect defense counsel’s strategy,” Rakoff stated. “As to the former, Heppner’s counsel confirmed that the AI Documents ‘were prepared by the defendant on his own volition.’ That means he was not acting as counsel’s agent when he communicated with Claude. As to the latter, counsel conceded that while the AI Documents did ‘affect’ counsel’s strategy going forward, they did not ‘reflect’ counsel’s strategy at the time that Heppner created them.”

Lessons to be learned

Echoing Rakoff’s sentiments, Kelly said the work product issue raised in Heppner seemed a closer call.

“A client inputting information about the case into an AI platform could be compared to a client writing down notes or a chronology of what happened for his/her lawyer, in preparation for the case,” Kelly said. “The difference [here], however, is that the client used the AI platform on his own, without direction from counsel, and that it was not a closed AI platform. I believe this was more of a waiver issue than a ruling that the work product doctrine will not apply anytime a client or counsel uses an AI platform to assist with litigation. In fact, I believe lawyers will soon be expected, if not required, to responsibly incorporate AI into their practices, as part of the standard of care.”

Carnathan said Rakoff’s decision highlights an all-too-common problem facing today’s practitioners.

“I imagine that all lawyers these days have a lot of clients who are armchair lawyers who run searches on various AI [platforms], sending things along asking, ‘Hey, what do you think about what ChatGPT says we should be doing?’” he said.

Benjamin said Rakoff underscored a key point for the bar.

“The decision is pretty clear that closed [AI] systems where there is an expectation of confidentiality are distinct from these platforms that have terms and conditions that advise the user that [communications] are not treated as confidential,” Benjamin said.

On the other hand, she said the case law governing confidentiality regarding AI systems such as Claude likely will evolve as use of the platforms becomes more commonplace.

“The case law is going to evolve as we get more comfortable with this technology and our own expectations of privacy continue to change and evolve with respect to the technology,” she said.

For Kelly, the key takeaway is that lawyers need to start having conversations with their clients from the outset about the appropriate use of AI in connection with the representation and the danger that the client’s use of AI may not be privileged and/or may cause a waiver.

“This conversation could be incorporated into the ‘litigation hold’ conversation: ‘Don’t destroy documents and do not input any information about the case or our communications into an AI platform,’” Kelly suggested.

Carnathan agreed that educating clients on the risks of AI will be critical going forward.

“Plainly, you’ve got to get in front of it because, as Rakoff suggests, the outcome might have been different if the client had been acting at the direction of counsel,” he said. “So one layer of protection might be to tell your clients up front, ‘Don’t do this without talking to me.’ At our firm, at the start of a case, we send around a memo to our clients reminding them about the attorney-client privilege. I’m literally going to edit that memo to add a section about AI searches.”

But Carnathan predicted that it will become standard practice in future litigation for document requests made in discovery to include requests for AI-generated materials.

“Why not?” Carnathan asked. “There will be more fights about this. But certainly this decision tells us that this is a potential problem.”