Going to Market in the U.S. (II): The First Federal Ruling That AI Chats Are Not Protected by Attorney-Client Privilege

AI platform conversations do not receive attorney-client privilege protection

Overview: Thirty-One AI Chat Logs Ruled Admissible

In November 2025, Bradley Heppner, former CEO of the U.S. company GWG Holdings, was arrested in connection with a securities fraud case involving more than $150 million. Before that, under the weight of a grand jury proceeding, Heppner took a step that proved to be a compliance disaster.

Without instruction from counsel, he opened the AI assistant Claude, entered core case information his lawyers had conveyed to him, and directed the AI to help him organize his defense strategy and analyze doctrinal weaknesses. He then sent the AI-generated reports to his legal team.

When federal investigators executed a search warrant, they extracted 31 detailed AI conversation documents from his devices.

Defense counsel argued the documents were protected by attorney-client privilege and the work product doctrine and should not be produced to the government.

On February 10, 2026, Judge Jed S. Rakoff of the Southern District of New York ruled: the documents were protected by no privilege and had to be produced.

What Are Attorney-Client Privilege and the Work Product Doctrine?

In common law systems and most jurisdictions, these two doctrines are foundational protections:

Attorney-client privilege protects confidential communications between client and counsel for the purpose of seeking or providing legal advice. Its purpose is to encourage candor, so that the client discloses the facts fully and truthfully and legal advice — and the representation that follows — is accurate and effective. It has three core elements: the communication must be between client and attorney; it must be intended to be confidential and treated as such; and it must concern legal advice.

The work product doctrine protects materials prepared by counsel or counsel's agents in anticipation of litigation — memoranda, analyses, strategy outlines. It protects counsel's independent work and thinking, preventing an opponent from obtaining litigation preparation and core strategy through discovery, and thereby preserving procedural and substantive parity between the parties.

In practice these principles are not abstractions but operational standards. At LawMay, we build privilege protection into our standard process from the outset of an engagement: engagement letters, legal analyses, strategy memoranda, and client communications all carry privilege designations, so that confidentiality obligations and litigation defense are implemented at every step.

The Exception: Waiver by Third-Party Disclosure

Privilege is not absolute. Once a party voluntarily discloses confidential information to an unrelated third party, the law will generally find the privilege waived.

The central question in Heppner was whether an AI assistant is a communication tool or a third party whose involvement destroys privilege.

The Court's Three Lines of Reasoning

Judge Rakoff explained the ruling along three dimensions.

AI has no legal professional status. Privilege rests on professional trust between people. An AI holds no law license and bears no fiduciary duty. The court was explicit: privilege cannot be created unilaterally by a client; it must exist between the client and a regulated legal professional. Claude is not a lawyer, so the communication departed from the privilege track at the first step.

Consumer AI users lack a reasonable expectation of confidentiality. The privacy policies of mainstream consumer AI platforms — including Anthropic's Claude, at issue here — generally provide that the company collects user prompts for model training and reserves the right to disclose information to regulators. A user who accepts that policy and uses a consumer AI tool is treated in law as having voluntarily disclosed information to a third party.

Independent conduct is not work product. The work product doctrine generally requires that materials be prepared by counsel or at counsel's express direction. Heppner's own use of a consumer AI for research was personal initiative, not action under counsel's direction, and therefore did not qualify.

A Related Ruling: Losing Trade Secret Status

Heppner is not isolated. In the contemporaneous Trinidad v. OpenAI, the court took a similar position.

The plaintiff claimed an AI framework it had developed using ChatGPT was a trade secret and alleged infringement by OpenAI. The court rejected the claim, reasoning that by entering the information into ChatGPT, the plaintiff had affirmatively disclosed it to a third party owing no duty of confidentiality.

The implication: information entered into a public AI platform without redaction may lose its legal status as a trade secret.

How Privilege Can Be Preserved

If disclosure to a public consumer AI platform can destroy privilege, must one avoid AI entirely? No.

While rejecting Heppner's arguments, Judge Rakoff left an important compliance note in the opinion. He suggested the law does not resist technological progress but requires that technology be brought within the existing framework of legal ethics.

Specifically, the opinion indicated that where an attorney directs a client to use an AI tool, that tool may be regarded as an extension of counsel's discharge of the representation and fall within privilege protection. So where a client, under counsel's careful direction, uses an enterprise AI system subject to confidentiality obligations, the legal characterization of those communications in a privilege analysis differs materially — providing a persuasive basis for maintaining privilege or work product protection.

Risk Management Recommendations

Heppner marks the beginning of judicial line-drawing on artificial intelligence and privilege. The efficiency AI brings does not automatically offset legal confidentiality obligations. At the intersection of law and technology, the security of information depends not only on the algorithm but on the user's understanding of, and adherence to, legal rules.

For individual users. It is easy to fall into the trap of conversational psychological safety — assuming an exchange with an AI is private. Under third-party disclosure principles, once information flows to a commercial entity owing no fiduciary duty, the reasonable expectation of confidentiality is at risk of failing. Users must develop strict data redaction discipline and must not enter litigation strategy, unpublished sensitive agreements, or highly personal information into consumer AI tools. Any organization of information touching legal proceedings should be conducted under counsel's substantive direction.

For companies. AI is double-edged: while it raises output substantially, it can become an invisible channel for trade secret loss. Management must recognize that a single copy-paste or file upload may cost the company years of R&D or trade secret protection. As Trinidad v. OpenAI shows, secrecy is irreversibly lost once disclosed outside a legally protected confidential environment. Companies should therefore establish routine controls from the top down and, where AI is deeply integrated into operations, prioritize enterprise services with data isolation, no-training, and contractual confidentiality terms.

For legal professionals. Efficiency gains from AI must be reconciled with professional ethics and the rules of evidence. Counsel must raise their own technical literacy and discharge a duty of careful risk disclosure, advising clients at engagement that AI interactions not reviewed by counsel may collapse privilege entirely. Within a firm, the technical architecture of any tool should be assessed rigorously against what judicial practice requires of protected work product. Following the reasoning in Heppner, counsel should position AI tools as confidential auxiliary channels under counsel's substantive control, ensuring that data flow, purpose, and output review remain attorney-directed — so that the arrangement satisfies the legal elements of privilege in function as well as form.

Conclusion: The AI Trap in Outbound Compliance

For companies going to market in the United States, the combined effect of Heppner and Trinidad is more serious still. In cross-border practice, companies increasingly rely on generative AI to draft submissions, prepare compliance responses, or model strategy when handling overseas IP disputes, responding to regulatory inquiries (from the FTC, for example), or planning cross-border structures.

But if a company enters unpublished patent details, sensitive supply chain agreements, or internal accounts bearing on a tax dispute directly into a public AI platform for polishing or analysis, then under the principles these decisions confirm, that critical evidence automatically loses privilege protection through third-party disclosure.

Once cross-border litigation or an overseas regulatory investigation begins, a competitor or a regulator can obtain those AI logs through legal process and turn them into evidence against the company. More seriously still, where the brand patents and exclusive product frameworks on which cross-border e-commerce depends lose secrecy through AI interactions unprotected by confidentiality obligations, the company will find it extremely difficult to assert trade secret misappropriation in a foreign court.

Outbound companies handling legal matters across jurisdictions should therefore weigh these risks carefully and establish mitigations — an AI usage firewall, for example — in advance, ensuring that all conduct touching submission strategy and core assets proceeds within a closed loop guided by professional counsel.

Cases referenced: United States v. Heppner, No. 25-cr-00503-JSR (S.D.N.Y. Feb. 10 & 17, 2026); Trinidad v. OpenAI, Inc., No. 25-cv-06328-JST (N.D. Cal. Jan. 5, 2026).

This article addresses general legal questions only and does not constitute legal advice on any specific matter.