SDNY Rules That AI-Generated Documents Are Not Privileged
February 26, 2026
Background
The defendant in the case, Benjamin Heppner, was indicted in October 2025 for securities fraud, wire fraud, and other related charges in the United States District Court for the Southern District of New York.[2]
In connection with Heppner’s arrest on November 4, 2025, the Federal Bureau of Investigation (FBI) seized from Heppner’s home approximately 31 documents reflecting communications that Heppner had with Anthropic’s generative AI platform, “Claude,” in 2025, after Heppner had received a grand jury subpoena and knew that he was a target of the government’s investigation.[3]
Without any suggestion from counsel that he do so, Heppner input into Claude information he learned from his counsel and used the platform to generate reports that outlined defense strategy and potential legal and factual arguments, which he subsequently shared with counsel.[4] Heppner asserted that the documents were protected from disclosure by the attorney-client privilege and the work product doctrine. On February 6, 2026, the government moved for a ruling that the AI-generated documents were not entitled to such protection.[5]
The Court’s Ruling
On February 10, 2026, Judge Jed S. Rakoff ruled from the bench during a pre-trial conference, granting the government’s motion, and set forth the bases for his ruling in a written opinion issued on February 17, 2026.[6]
Attorney-Client Privilege Does Not Apply. The Court held that the documents were not protected by the attorney-client privilege for the following reasons:
- The privilege only applies to communications between a client and his or her attorney. “Because Claude is not an attorney, that alone disposes of Heppner’s claim of privilege.”[7] The Court noted that the attorney-client relationship requires “a trusting human relationship,” which could not exist “between an AI user and a platform such as Claude.”[8]
- Heppner was on notice that his communications with Claude were not confidential. Claude’s written privacy policy provides that Anthropic may disclose the information users input into the platform and Claude’s outputs to third parties, including government authorities.[9] To the extent the documents incorporated privileged information that had been shared with Heppner by his counsel, Heppner waived the privilege by sharing it with a third-party platform.[10]
- While Heppner may have prepared the documents to facilitate his consultation with counsel, this did not support finding that his communications with Claude were “for the purpose of obtaining legal advice,” as required to establish privilege.[11] “[W]hat matters for the attorney-client privilege is whether Heppner intended to obtain legal advice from Claude, not whether he later shared Claude’s outputs with counsel.”[12]
No Work Product Protection. Similarly, the Court held that the documents were not protected by the work product doctrine because “they were … not prepared by or at the behest of counsel … nor did they reflect defense counsel’s strategy.”[13]
Key Takeaways for Individuals and Company Counsel
While many attorneys are familiar with media reports of counsel being reprimanded by courts for submitting AI-generated briefs with “hallucinated” (i.e., made-up) case citations, the Heppner ruling highlights the exposure that non-lawyers face in using generative AI in connection with their legal issues. Judge Rakoff’s opinion acknowledges several factors that may impact a future court’s analysis and allow for attorney-client privilege and/or work product doctrine to apply to AI-generated work product. For example, what if the user was not put on notice that the generative AI platform reserved the right to share their inputs and the platform’s outputs with third parties? What if counsel directs a user to use the platform? What if the AI-generated work product was not merely intended to impact counsel’s strategy going forward but instead reflected counsel’s preexisting strategy at the time the work product was created?
It is likely that these questions will soon arise and be addressed by the courts. However, in the meantime, individuals and companies alike should proceed with caution in incorporating generative AI products as part of their legal strategy:
- Only use enterprise versions of generative AI products that have express policies warranting that user inputs and platform outputs are kept within a closed system and not shared with third parties or only shared in a narrow set of circumstances (for example, pursuant to a court order and after the user is provided notice and an opportunity to object to disclosure).
- For companies, implement training and written policies that preclude employees from using the publicly available, retail versions of generative AI products in connection with legal issues impacting the company. This is particularly important for executives, managers, and other high-level employees, whose inputs into such generative AI may be viewed as waiving the company’s privilege.[14]
- To the extent counsel instructs a client to use generative AI as part of legal strategy, such instruction should be clearly documented should the client ever have to defend the privileged nature of the AI-generated work product.
Endnotes:
[1] United States v. Heppner, No. 25 Cr. 503 (JSR), 2026 WL 436479 (S.D.N.Y. Feb. 17, 2026).
[2] Id. at *1.
[3] Id.
[4] Id. at *1-2.
[5] Government’s Motion for a Ruling that Documents the Defendant Generated Through an Artificial Intelligence Tool Are Not Privileged, United States v. Heppner, No. 25 Cr. 503 (JSR), ECF No. 22 (S.D.N.Y. Feb. 6, 2026).
[6] Heppner, 2026 WL 436479, at *1.
[7] Id. at *2 (citation omitted).
[8] Id.
[9] Id.
[10] Id. at *3 n.3.
[11] Id. at *3.
[12] Id. (emphasis in original).
[13] Id. at *3 (internal quotation marks and citations omitted).
[14] See, e.g., Commodity Futures Trading Comm'n v. Weintraub, 471 U.S. 343, 348 (1985) (“[T]he power to waive the corporate attorney-client privilege rests with the corporation’s management and is normally exercised by its officers and directors.”).