A.I. Documents Deemed Not Privileged

In AI Docs Sent By Exec To Attys Not Privileged, Judge Says – Law360 (Feb. 10, 2026), Pete Brush reported a bench ruling holding that “a Texas financial services executive accused of a $150 million fraud cannot claim privilege over documents that he prepared using an artificial intelligence service and sent to his attorneys — but suggested the materials could be problematic if used at trial.”

The article states that: “In 2025, after Heppner knew he was a law enforcement target, he used an unnamed AI tool to prepare 31 documents related to his legal case and shared them with defense counsel from Quinn Emanuel Urquhart & Sullivan LLP, according to filings and statements in court Tuesday.”

The government challenged privilege and work product assertions and:

Judge Rakoff quickly dispatched the first theory, saying Tuesday, “I’m not seeing remotely any basis for any claim of attorney-client privilege.”

On the work-product theory, defense counsel Benjamin O’Neil then argued that the documents incorporate information that Quinn Emanuel conveyed to Heppner.

“It’s not as if these were documents created during the course of the alleged scheme,” O’Neil said, though he conceded they “were prepared by the defendant of his own volition.”

Prosecutor Alexandra Rothman said the documents do not “reflect the legal strategy” of Heppner’s defense team.

Judge Rakoff agreed, concluding that the AI documents were not prepared by attorneys.

The judge also noted that the tool used by Heppner contains a provision that any information inputted is not confidential — essentially, that a user has no expectation of privacy.

Id.  However, the article reports that the Judge “said that if prosecutors try to use the AI-generated information at trial, it could give rise to a ‘witness-advocate conflict’ since his law firm would become a witness in such a scenario.”

The decision does not appear on Westlaw. However, the government’s motion is posted.  U.S. v. Heppner, No. 25 Cr. 503 (S.D.N.Y.).

The government asserted that Mr. Heppner used “a commercial artificial intelligence tool.” The output was created prior to arrest and was later shared with counsel.  It argued:

First, the AI Documents fail every element of the attorney-client privilege. They are not communications between a client and attorney—the AI tool is plainly not an attorney, and no attorney was involved when he created the documents. They were not made for the purpose of obtaining legal advice—the AI platform’s terms of service expressly disclaim any attorney-client relationship and state that the tool does not provide legal advice. And they are not confidential— the defendant voluntarily shared his queries with the AI tool, and the AI responses were generated from a third-party commercial platform whose privacy policy permits disclosure to governmental authorities.

Second, the defendant cannot retroactively cloak unprivileged documents with privilege by later transmitting them to counsel. Well-settled law holds that preexisting, non-privileged materials do not become privileged merely because a client eventually shares them with an attorney.

Third, the work product doctrine does not protect these materials. Defense counsel has represented that the defendant created the AI Documents on his own initiative—not at counsel’s behest or direction. The doctrine shields materials prepared by or for a party’s attorney or representative; it does not protect a layperson’s independent internet research.

The government stated that the 31 documents and devices were seized pursuant to a search warrant. “Shortly after the search, defense counsel informed the Government that, before his arrest, the defendant had run queries related to the Government’s investigation through an AI tool (Claude) created by a third-party company, Anthropic.”

Defense counsel asserted that the documents were created for the “express purpose of talking to counsel” and obtaining his counsel’s “legal advice,” and were shared with counsel.  However, they were not prepared at counsel’s direction, and counsel was not involved in their creation.

The government argued that: “The defendant appears to have directed legal and factual prompts at an AI tool, not his attorneys. Defense counsel has informed the Government that, once the defendant obtained responses to his AI prompts, he transmitted those responses to counsel. But that act of transmission does not transform the defendant’s non-privileged use of an AI tool into a privileged communication shielded from disclosure.”

The prosecution further asserted that:

The AI-generated documents fail each element of the attorney-client privilege. They are not communications between the defendant and an attorney. They were not made for the purpose of obtaining legal advice. And they are not confidential. Each deficiency independently defeats the defendant’s privilege claim.

It argued: “The defendant’s use of the AI tool here is no different than if he had asked friends for their input on his legal situation.” The prosecution asserted:

The AI tool that the defendant used has no law degree and is not a member of the bar. It owes no duties of loyalty and confidentiality to its users. It owes no professional duties to courts, regulatory bodies, and professional organizations. The policy balance embodied by the attorney-client privilege cannot be mapped onto a machine that provides what may resemble legal advice.

The United States quoted Claude documents stating that Claude chooses the “response that least gives the impression of giving specific legal advice’ and ‘instead suggest[s] asking a lawyer.’”

Further, Anthropic’s privacy policy tells users that it gathers prompts and outputs and uses them to train its tool, “and that it may disclose this data to ‘governmental regulatory authorities’ and ‘third parties.’”

Interestingly, the government argued: “Likewise, if the defendant had instead conducted Google searches or checked out certain books from the library to assist with his legal case, the underlying searches or library records would not be protected from disclosure simply because the defendant later discussed what he learned with his attorney.”

Turning from privilege to work product, the government wrote that, “as defense counsel has conceded in its discussions with the Government, the defendant’s AI-research was not prepared at the behest of anyone, including counsel. Rather, as the Government understands, the defendant took these actions himself— without any direction from counsel—and then shared the products of his research with counsel after it was created.”  It added:

Had counsel directed the defendant to run the AI searches, the analysis might be different. But the defendant elected to run his own AI searches and then shared the outputs of those searches with counsel.

For more information, please see “Against an AI Privilege” – Are Prompts Discoverable?  Is Output? (Jan. 2, 2026).

UPDATE: A written decision was issued in U.S. v. Heppner, __ F. Supp. 3d __, 2026 WL 436479 (S.D.N.Y. Feb. 17, 2026).

• “Generative artificial intelligence tools have become increasingly prevalent across various domains of human activity. It has reliably been estimated, for instance, that more than half of United States households have adopted AI in some form…. Only three years after its release, one prominent AI platform is being used by more than 800 million people worldwide every week.”
• “[T]he Court’s ruling in this case appears to answer a question of first impression nationwide: whether, when a user communicates with a publicly available AI platform in connection with a pending criminal investigation, are the AI user’s communications protected by attorney-client privilege or the work product doctrine?1 For the reasons that follow, the answer is no.”
• “Without any suggestion from counsel that he do so, Heppner ‘prepared reports that outlined defense strategy, that outlined what he might argue with respect to the facts and the law that we anticipated that the government might be charging.’”
• “Heppner does not, and indeed could not, maintain that Claude is an attorney.”
• “the communications memorialized in the AI Documents were not confidential. This is not merely because Heppner communicated with a third-party AI platform but also because the written privacy policy to which users of Claude consent….”
• “Heppner did not communicate with Claude for the purpose of obtaining legal advice. This issue perhaps presents a closer call because Heppner’s counsel asserts that Heppner communicated with Claude for the ‘express purpose of talking to counsel.’ … But, as Heppner’s counsel also conceded, Heppner did not do so at the suggestion or direction of counsel.”
• “And Claude disclaims providing legal advice. Indeed, when the Government asked Claude whether it could give legal advice, it responded that ‘I’m not a lawyer and can’t provide formal legal advice or recommendations’ and went on to recommend that a user ‘should consult with a qualified attorney who can properly assess your specific circumstances.’”
• ” The AI Documents do not merit protection under the work product doctrine because, even assuming, arguendo, that they were prepared ‘in anticipation of litigation,’ …  they were nevertheless not ‘prepared by or at the behest of counsel,’ … nor did they reflect defense counsel’s strategy….”
• “Heppner was not acting as his counsel’s agent when he communicated with Claude.”
• “Here, there is no dispute that Heppner acted on his own when he created the AI Documents.”
• “Generative artificial intelligence presents a new frontier in the ongoing dialogue between technology and the law. Time will tell whether, as in the case of other technological advances, generative artificial intelligence will fulfill its promise to revolutionize the way we process information. But AI’s novelty does not mean that its use is not subject to longstanding legal principles, such as those governing the attorney-client privilege and the work product doctrine. Because Heppner’s use of Claude fails to satisfy either of these rules, the AI Documents do not merit the protections Heppner has claimed.”

This blog was initially posted on  Electronic Discovery Reference Model and  JD Supra.