Exchanges With Generative AI Not Protected By Privilege (United States Of America v. Heppner)

The growing use of generative Artificial Intelligence is undeniable. According to Justice Rakoff of the United States District Court of the Southern District of New York, "[o]nly three years after its release, one prominent AI platform is being used by more than 800 million people worldwide every week."

As we have already seen in several court cases, this growing use is having significant negative impacts on the justice system, as both self-represented litigants and lawyers have been caught citing AI-generated hallucinated cases and propositions to the courts. Notwithstanding that these decisions should be raising loud alarms within the legal community and for the public, lawyers and individuals continue to use publicly available generative AI platforms to chat about legal issues. However, these AI platforms are not lawyers and therefore there is a danger that any exchanges with them are not protected by solicitor-client privilege or litigation privilege/work product privilege.

In United States of America v. Heppner, 25 Cr. 503 (February 19, 2026, U.S.D.J. Rakoff), a New York court was required to determine whether an accused's exchanges with "Claude", a generative AI platform developed by Anthropic, were protected either by solicitor-client privilege or work-product privilege.

District Court Justice Rakoff found that there was no such protection.

In this case, on October 28, 2025, a grand jury indicted the accused on charges of securities fraud, wire fraud, conspiracy to commit securities and wire fraud, making false statements to auditors, and falsifying corporate records. The charges arose out of the accused's alleged misconduct as a corporate executive of several corporations, including GWG Holdings Inc., a public company.

A week later, the accused was arrested and the Federal Bureau of Investigation (the "FBI") executed a search warrant at his home. The FBI seized documents and electronic devices, including 31 documents that involved exchanges between the accused and Claude.

Those exchanges, which involved reports outlining defence strategy and potential legal arguments, took place in 2025, after the accused had received a grand jury subpoena and the accused knew that he was under investigation.

During the criminal prosecution, the government sought a ruling that the exchanges were not protected from inspection. In contrast, the accused contended that the exchanges were privileged because:

1. He had inputted into Claude information that he learned from his lawyers;
2. He had created the documents for the purposes of obtaining legal advice from his lawyers; and
3. He had subsequently shared the documents with his lawyers.

In the United States, solicitor-client privilege (attorney-client privilege) protects from disclosure all communications between a client and their lawyer that is intended to be kept confidential and for the purpose of providing legal advice. The law in Canada is the same.

Justice Rakoff found that the attorney-client privilege was inapplicable because at least 2 of its 3 elements could not be met.

His Honour found that the documents were not communications between the accused and his lawyer because, simply put, Claude was not a lawyer.

Furthermore, Justice Rakoff found that the exchanges were not confidential because (i) the accused had communicated with a third party AI platform, (ii) the privacy policy of the platform permitted Anthropic to collect "inputs" and "outputs" for training purposes, and (iii) Anthropic reserved the right to disclose the data collected to "third parties", including government regulatory authorities.

Lastly, Justice Rakoff concluded that the accused was not communicating with Claude for the purposes of obtaining legal advice. Indeed, Claude expressly disclaimed providing legal advice.

The accused's contention that he had intended to share his exchanges with his lawyers was, in the view of the court, irrelevant because "it [was] black-letter law that non-privileged communications are not somehow alchemically changed into privileged ones upon being shared with counsel."

With respect to work-product privilege, Justice Rakoff explained that this privilege provided a zone of privilege to the mental processes of an attorney, including a lawyer's legal analysis and preparation of client's case. However, this privilege did not protect from discovery "materials in an attorney's possession that were prepared neither by the attorney nor his agents."

Similarly, in Canada, litigation privilege (known as work-product privilege) also exists to protect the disclosure of documents and communications.

As mentioned by the Supreme Court of Canada in Lizotte v. Aviva Insurance Co. of Canada, 2016 SCC 52 (CanLII), this privilege protects from disclosure documents and communications whose dominant purpose is preparation for litigation. It applies to both a lawyer's file and a lawyer's oral and written communications with third parties, such as witnesses or experts.

Justice Rakoff concluded that the work-product privilege did not apply to the exchanges because even if it could be argued that the accused was using Claude to prepare for anticipated litigation, he conceded that the exchanges were not produced at the behest of his lawyer.

The accused's lawyer "did not direct [him] to run Claude searches." This was critical and fatal to the accused's reliance on the work-product privilege to protect the exchanges from disclosure. In this regard, although Justice Rakoff mused in the analysis of solicitor-client privilege that if the accused's lawyer had directed him to use Claude, it could have been argued that the AI platform may have functioned like a highly trained professional who had been engaged to act as the lawyer's agent, Justice Rakoff was obligated to conclude: "Because the AI Documents were not prepared at the behest of counsel and did not disclose counsel's litigation strategy, they do not merit protection as work product."

Solicitor-client and litigation privilege play important roles in our justice system. In particular, the solicitor-client privilege is essential to the relationship between a lawyer and their client because it permits the client to have free and candid communications with their lawyer without compromising their legal rights and allows the lawyer to know all of the facts of the client's position. Without robust solicitor-client privilege, there would be a danger that communications between a client and a lawyer would be stifled. Litigation privilege has a similar purpose.

While these privileges should be cherished, the use of AI platforms by clients is endangering their legal rights and, as shown in Heppner, compromising their zone of privacy with respect to legal advice. Accordingly, clients should beware that their use of AI platforms to seek "legal advice" or to test the legal advice provided to them by their own lawyer, which anecdotally appears to be becoming a norm, could eventually obligate them to disclose either on discovery or at trial communications that might otherwise have been immune from disclosure and compromise their cases.

In Mr. Heppner's case, it remains to be seen what he "discussed" with Claude and how his exchanges with Claude will be used by the government in the prosecution of the criminal charges.

[This blog was not prepared with the assistance of generative artificial intelligence.] A PDF version is available to download here.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.