AI, Privilege, and the Heppner Decision: Why Founders Still Need Lawyers in the Loop

Originally published February 18, 2026 on LinkedIn

Key facts from the Heppner ruling

• In United States v. Bradley Heppner, Judge Jed S. Rakoff of the Southern District of New York held that a defendant’s written exchanges with the public Claude AI platform were not protected by attorney client privilege or the work product doctrine.

• After receiving a grand jury subpoena and learning he was a target, Heppner used Claude on his own to draft about thirty one reports outlining facts, defense strategy, and legal theories, then later shared those documents with his lawyers.

• The court found no protection because Claude is not a lawyer, the chats were not confidential under Anthropic’s privacy policy, and the documents were not prepared by or at the direction of counsel or reflective of counsel’s mental impressions.

• Judge Rakoff emphasized that non privileged communications are not “alchemically changed” into privileged ones simply because a client later hands them to a lawyer.

• The opinion stressed that Heppner acted on his “own volition” without suggestion from counsel, so Claude was not acting as an agent of counsel in any Kovel type sense.

• The AI documents were located on devices seized under an FBI search warrant, illustrating that materials can be recovered through forensic acquisition even if a user deletes chat history from the front end interface.

• Judge Rakoff respectfully disagreed with the broader approach to work product taken in Shih v. Petal Card, Inc., 565 F. Supp. 3d 557 (S.D.N.Y. 2021), signaling that older assumptions about client generated notes are being narrowed rather than expanded in the AI context.

• Law firms and commentators describe this as a first of its kind federal decision holding that using a public generative AI tool to work through legal strategy can destroy privilege and work product and they expect it to be a reference point in future AI privilege disputes.

Founders, general counsels, and business leaders are under real pressure to control legal spend, and public AI tools look like a low cost way to think through legal risk. The Heppner decision makes clear that when those tools are used instead of counsel for legal strategy, the result can be a set of non privileged documents that prosecutors, regulators, and civil plaintiffs are free to use.

The Heppner decision in context

Heppner is a federal criminal case arising from alleged securities fraud, wire fraud, conspiracy, false statements to auditors, and falsified corporate records tied to GWG Holdings and related entities. After receiving a grand jury subpoena and being told he was a target, Heppner retained counsel but also began interacting on his own with the publicly available Claude platform, entering factual narratives and drafting legal arguments about his exposure and possible defenses.

When the FBI executed a search warrant at his home, agents seized numerous documents and electronic devices and later identified approximately thirty one documents memorializing his AI chats among the seized data. Defense counsel sought to withhold those documents as privileged or protected work product, and on February 17, 2026, Judge Rakoff issued a written memorandum explaining why the government is entitled to review them.

How Judge Rakoff analyzed attorney client privilege

Judge Rakoff applied the familiar Second Circuit test. Privilege protects communications between client and attorney that are intended to be and kept confidential for the purpose of obtaining or providing legal advice. Because privilege is an exception to the principle that fact finders should have access to all relevant evidence, courts construe it narrowly in order to preserve confidence in the administration of justice.

On those terms, the AI documents failed at multiple steps. First, Claude is not a lawyer and the conversations were not between client and counsel. The court cited authority holding that discussions of legal issues between non lawyers are not privileged and noted that Claude itself disclaims the ability to give legal advice and directs users to consult qualified attorneys. Second, even if some inputs reflected prior legal advice, the court concluded that using a public AI service with a broad data use and disclosure policy destroyed any reasonable expectation of confidentiality, much like discussing sensitive legal issues in front of a third party.

Courts have long held that voluntary disclosure of attorney client communications to third parties destroys confidentiality. In re Horowitz and United States v. Mejia are classic Second Circuit examples that emphasize that once a client shares privileged content beyond the protected circle, the privilege is waived. The Supreme Court, in United States v. Nobles, has similarly emphasized that the related work product doctrine exists to protect the mental impressions of counsel, not to convert every litigation related document into a secret file that adversaries can never see.

The “alchemic” myth and the permanent witness problem

One of the most quotable passages in the opinion addresses a common misconception about privilege in the AI era. Judge Rakoff underscored that non privileged communications are not “alchemically changed” into privileged ones simply because a client later shares them with a lawyer. If a document would not be privileged in the client’s hands, it does not become privileged simply by being emailed to counsel or attached to a defense strategy memo.

The court also explained why these AI chats are not like confidential personal notes drafted for later discussion with counsel. The defendant first shared the equivalent of his notes with Claude and Anthropic, whose privacy policy affirmatively allows retention, training use, and disclosure to regulators and other third parties. That makes the AI platform a kind of permanent witness to the defendant’s internal thinking. From a litigation standpoint, Anthropic occupies the same posture as any other third party custodian of sensitive material and can be compelled through subpoena, warrant, or discovery orders to produce those communications.

Volition, agency, and why initiative can destroy privilege

Another key theme in the ruling is volition. Defense counsel candidly confirmed that they did not ask or direct Heppner to use Claude and that he created the AI documents entirely on his own. That fact allowed the court to distinguish situations where lawyers engage outside professionals as agents of the attorney client relationship, such as accountants or translators, under the Kovel doctrine. In those cases, the intermediary is used so that counsel can better understand facts and provide legal advice and the lawyer, not the client, is driving the process.

For business leaders, the lesson is counterintuitive. In this context, initiative can be the enemy of privilege. When executives independently experiment with public AI tools to analyze legal risk or brainstorm strategy, they move outside the structured attorney client framework that privilege doctrine protects. In the legal realm, it is often safer to follow qualified counsel’s process than to improvise with unvetted technology.

Why the work product doctrine did not save the AI documents

The court also rejected the argument that the AI documents were protected work product. The doctrine, as the Supreme Court explained in Nobles, shelters the mental processes of attorneys by preserving a private space for lawyers to analyze facts, develop legal theories, and plan litigation strategy. Although work product can extend to materials prepared by agents for the attorney, it presupposes that those materials are prepared by or at the direction of counsel in anticipation of litigation.

In Heppner there was no dispute that the AI documents were created solely by the defendant, not by counsel or at counsel’s request, and that they did not reflect defense counsel’s strategy at the time they were drafted, even if they later informed how the defense team thought about the case. Judge Rakoff expressly noted and respectfully disagreed with the broader approach taken in Shih v. Petal Card, Inc., which had extended work product protection to certain client generated materials even without a clear showing that counsel directed the work, warning that such an expansion would drift away from the doctrine’s core focus on protecting lawyers’ mental impressions. On these facts, he held that the AI documents could not be shielded as work product.

Discovery specifics and the myth of “deleted” chats

The procedural posture in Heppner is as important as the doctrinal analysis. The AI documents were not produced voluntarily in discovery. They were found on devices seized from the defendant’s home under a judicially authorized search warrant. That context highlights a practical point that applies far beyond this one case. Deleting a chat thread in a user interface does not necessarily remove it from local devices, backup systems, or provider logs, all of which may be accessible to forensic examiners or through legal process.

Digital forensics vendors and practitioners routinely explain that with full device images, cloud backups, and specialized tools, investigators can often recover deleted messages, residual artifacts, and related metadata long after a user believes a conversation is gone. For startups and executives who rely heavily on mobile and web based tools, that means a late night AI session about legal risk can remain discoverable even if the visible chat history is cleared the next morning.

What the ruling does not say and where enterprise tools may differ

Given the attention this decision has received, it is important to be precise about its limits. The opinion does not declare generative AI unlawful, does not prohibit lawyers from using AI in practice, and does not hold that AI related documents can never be privileged under any circumstances. Instead, it applies traditional privilege and work product principles to a specific situation involving a public AI platform with broad data use and disclosure terms, a client acting independently of counsel, and no indication that lawyers designed or supervised the workflow.

Judge Rakoff also did not foreclose the possibility that AI tools could function as agents within a privileged relationship if used under counsel’s direction. The opinion notes that if counsel had directed the client to use Claude in a specific way, the tool might arguably have functioned like a highly trained professional assisting the legal team, similar to the accountant in Kovel, who was brought in so that counsel could understand complex financial data. For an AI tool to occupy that kind of agent role, the lawyer must be driving the bus by defining the purpose, choosing the tool, and integrating its outputs into the legal analysis, rather than the client unilaterally experimenting with a public chatbot.

The court’s reasoning also targets the publicly available version of Claude and Anthropic’s then current privacy policy, which allowed training on user data and disclosure to regulators and other third parties. By contrast, some enterprise or application programming interface offerings are structured to disable training on client content, impose strict confidentiality obligations, and limit disclosure. While Heppner does not decide how courts will treat those closed environments, it strongly suggests that counsel and clients who want to preserve privilege should gravitate toward tools with enterprise grade terms rather than consumer interfaces.

Why this matters for startups and cost conscious businesses

In the startup and growth company ecosystem, it is common to see founders use AI to draft term sheets, employment policies, privacy notices, internal investigative chronologies, and even regulator facing narratives, with lawyers brought in only at the end if something looks serious. From a budget perspective, that pattern is understandable, especially where traditional hourly models feel misaligned with early revenue and cash flow.

Heppner illustrates how this approach can create unpriced legal risk. For example, in a later enforcement action or shareholder lawsuit, prosecutors or plaintiffs could introduce a founder’s AI chat transcript to show contemporaneous knowledge of regulatory exposure or securities disclosure issues. That document might never exist if the same discussion had occurred in a privileged call, memo, or conference with counsel. For companies in financial services, health technology, data intensive platforms, or any sector where regulators focus heavily on intent and internal deliberations, these transcripts can become powerful evidence of what the company knew and how it weighed risks.

How a lawyer in the loop model changes the risk

The alternative is not to abandon AI, but to use it under legal supervision. In a lawyer in the loop model, counsel defines the legal questions, selects AI tools with appropriate enterprise terms, configures privacy and no training settings, and reviews AI assisted work product before it is relied upon externally. Used this way, AI accelerates research, helps organize factual material, and generates structured drafts that reflect counsel’s framing rather than replacing legal judgment.

This structure aligns much more closely with existing privilege and work product doctrine. Materials generated by or at the direction of counsel, in an environment that provides a reasonable expectation of confidentiality, are more likely to be treated as privileged communications or work product. Operationally, many companies now achieve this by engaging experienced outside counsel in a fractional general counsel capacity, which provides ongoing oversight of AI use, contracts, compliance, and litigation risk without the fixed cost of a full time general counsel.

Concrete risks and a sharp litigation example

From a litigator’s perspective, the risk is concrete rather than theoretical. Consider a founder who pastes internal emails and draft investor slides into a public AI tool and asks whether the company is violating securities laws or how likely it is that the SEC will sue over specific disclosures. Years later, in a government action or derivative suit, that transcript could be retrieved from seized devices, cloud backups, or the AI provider’s logs and used to argue that the founder had detailed contemporaneous knowledge of particular risks and chose a given course of action anyway.

If that same founder had walked through identical concerns with counsel in a privileged setting, the conversation would likely be shielded by attorney client privilege and work product protection, enabling a candid exploration of options without creating a discoverable, point by point record of perceived exposure. The Heppner opinion makes clear that moving that internal debate into a public AI window strips away those protections and invites later use against the company and its leadership.

Practical steps, compliance notes, and action items

Companies that may be affected by this ruling, particularly startups and fast growing businesses, can take several practical steps to align AI use with traditional privilege principles.

1. Map current AI use Identify where and how generative AI is used across the organization, with special attention to legal, compliance, finance, and human resources. Distinguish consumer chatbots from enterprise or API based tools and document which terms apply in each setting.

2. Review AI provider terms and classify tools For any AI tool that might touch legal issues, review the terms of service and privacy policy to see whether user data is retained, used for training, or shared with regulators and other third parties. Treat public tools that reserve these rights as nonconfidential for legal communications and, where AI is needed in legal workflows, favor enterprise versions with explicit no training clauses and robust confidentiality protections.

3. Adopt an AI legal use policy Implement a written policy that prohibits employees from using public AI platforms to discuss pending or threatened litigation, government investigations, possible regulatory violations, or attorney advice, and routes those issues to counsel instead. The policy should identify approved AI channels, explain that unauthorized use can create discoverable documents, and authorize audits in high risk functions.

4. Formalize a lawyer in the loop requirement For any workflow that touches investigations, regulatory strategy, significant transactions, or material contractual terms, require that in house or outside counsel approve the use of AI and be responsible for tool selection, configuration, and review of outputs. This increases the likelihood that AI assisted work will qualify as attorney work product and will be created within a privileged framework.

5. Consider fractional general counsel arrangements Startups and growth companies that cannot yet justify a full time legal hire can engage experienced counsel on a fractional general counsel basis, gaining ongoing strategic advice on AI governance, contracts, compliance, and disputes at a more predictable cost. This structure helps ensure that AI deployments are designed with privilege and evidentiary risk in mind from the outset.

6. Train teams on privilege and digital evidence Educate founders, managers, and staff on the difference between talking to a lawyer and talking to a chatbot, using examples from Heppner to show how AI transcripts can later appear in discovery, even if a user believes they have been deleted. Include a basic primer on mobile and cloud forensics so employees understand that clearing local history does not guarantee that communications are beyond the reach of investigators or civil discovery.

7. Build AI into incident response and investigation protocols When issues arise, ensure that counsel is involved immediately and that any use of AI occurs under legal direction within an environment that preserves confidentiality and work product protections. Avoid letting employees improvise with public AI tools during crisis moments, since those are the communications most likely to be scrutinized later.

A forward looking closing thought

In the end, Heppner is not an indictment of AI. It is a reminder that privilege and work product exist to protect human legal judgment, not automated analysis. For founders, executives, and investors who rely on AI to move faster and spend less, the decision is an invitation to pair that technology with experienced counsel rather than to treat it as a replacement.

Given the prominence of the court, the novelty of the question, and the speed with which law firms and commentators have responded, this decision will likely become a reference point in future privilege disputes involving AI assisted legal workflows. Companies that act now to keep lawyers in the loop, use genuinely confidential enterprise tools, and draw a bright line against public AI for sensitive legal strategy will be far better positioned when the next wave of enforcement actions, shareholder suits, and regulatory reviews arrives.

Leave a comment

Share

Enjoyed this article? Subscribe to Jabari-Jason Tyson-Phipps — it’s free, and you’ll get future articles by email via Substack.

This article is published by JJTP Law PLLC as a general-interest news and information service for clients and friends of the firm. Nothing in it is legal advice, and reading it does not create an attorney-client relationship. If you have a question about how this topic applies to your own situation, please reach out to the attorney you normally work with, or schedule a consultation. This is not a solicitation for legal work in any jurisdiction where JJTP Law is not authorized to practice. See our Attorney Advertising & Terms of Use