There have long been privacy concerns about the use of public generative artificial intelligence (GAI) models such as ChatGPT, Claude, and Google Gemini by lawyers and their clients. For the most part, those concerns were theoretical. It has failed to meaningfully deter lawyers seeking efficiency and clients seeking to reduce costs by submitting legal questions directly to AI tools. That theoretical risk is now a reality.
in United States vs. Heppnerdecided in February 2026, the U.S. District Court for the Southern District of New York addressed what it called a “national first impression issue”: whether criminal defendants waived the attorney-client privilege and/or attorney work product doctrine when they used the GAI platform for defense strategies. The court held that Mr. Heppner did so because his attorney did not direct Mr. Heppner’s use of the GAI Platform and Mr. Heppner did not have a reasonable expectation of privacy in his interactions with the GAI Platform, and therefore any such claim of privilege was waived.
underlying facts
Mr. Heppner was indicted on multiple counts of securities fraud and related charges stemming from his actions as a corporate executive. Prior to his indictment, after receiving a grand jury subpoena and learning that he was the subject of a government investigation, Heppner entered multiple prompts on the public GAI platform to understand how the government would respond to him and what defense strategy he could develop. Notably, he did so without the guidance of a lawyer.
When Hoeppner’s office was later searched, the government recovered 31 AI-generated reports. Mr. Heppner invoked attorney-client privilege and work product doctrine to prevent the government from using these reports in prosecutions. Although Heppner was not instructed by his attorney to use the GAI model, he used information he learned from the attorney to create prompts. Mr. Heppner also claimed that the purpose of preparing these documents was to prepare for a meeting with an attorney seeking legal advice. Mr. Hepner also shared these reports with his attorney.
Attorney-client privilege analysis
To understand the risks of Mr. Heppner’s actions, you must first understand the basic mechanics of public GAI platforms. When a user enters information into a public GAI tool, the data is sent to a remote server operated by a GAI provider. Depending on the platform’s terms of use and privacy policy, the information may be stored, reviewed by human employees, used to train future model iterations, or provided to third parties, particularly government authorities, upon request.
The attorney-client privilege is one of the oldest and most sacred protections in American law, protecting confidential communications made for the purpose of seeking or providing legal advice. Privileges belong to the client and can typically be relinquished only by or through client action. Importantly, communications must remain confidential. Courts have consistently held that this privilege does not protect communications that the client does not intend to be confidential.
of heppner The court found that AI-generated reports did not meet these threshold requirements. First, the report was not a communication between Mr. Heppner and his attorney, even though he later provided it to his attorney. The GAI platform itself is not a lawyer and could not be treated as one for privileged purposes.
Second, the communications were not confidential. The platform’s written terms and conditions indicated that inputs and outputs may be shared with third parties. As a result, Heppner learned that platform owners can disclose both their prompts and the resulting reports.
Finally, the court emphasized that Mr. Heppner was not instructed by his attorney to conduct an AI investigation. Therefore, the report is not prepared for the purpose of seeking legal advice.
Analysis of deliverable doctrine
The attorney work product doctrine protects materials created by or for attorneys in preparation for litigation or trial. Unlike the attorney-client privilege, work product protection extends to documents and tangible objects and focuses on protecting the attorney’s impressions, conclusions, opinions, and legal theories.
The court held that work product protection did not apply because the report was not prepared at the attorney’s order or request and therefore did not constitute a “mental impression” of the attorney. Mr. Heppner was not acting as an agent of attorney when he interacted with GAI Models. Although the report may have later influenced defense strategy, it did not reflect the mental impressions of the defense attorney at the time the report was written.
Practical considerations for lawyers
Lawyers should explicitly address the use of AI in engagement letters and other client communications, including the risks associated with sharing attorney communications and defense strategies with public GAI platforms. Although the Heppner court emphasized the lack of an attorney’s instruction, its reliance on the platform’s terms of service suggests that even the involvement of an attorney may not eliminate the risk of a waiver if confidentiality cannot be guaranteed.
Lawyers must also be careful not to violate Rule 1.1 (Capacity), which includes technical competency, and Rule 1.6 (Confidentiality), which prohibits unauthorized disclosure of client information. Using public GAI tools without proper safeguards can impact both.
Lawyers should therefore determine whether the use of publicly available GAI models is necessary, whether it could lead to disclosure of client confidentiality or their own work product, and should strongly consider securing informed consent from clients before using such AI tools. In many cases, a safer method may be to use GAI on a legally trained private (private) GAI platform that protects your privacy and therefore protects your work.
