Use of public generative artificial intelligence (GAI) models like ChatGPT, Claude, and Google Gemini by lawyers and their clients has long carried privacy concerns. For the most part, those concerns were theoretical. They did not meaningfully deter attorneys seeking efficiency or clients attempting to reduce costs by posing legal questions directly to AI tools. That theoretical risk has now become real.
In U.S. v. Heppner, decided in February 2026, the United States District Court for the Southern District of New York addressed what it described as a “question of first impression nationwide”: whether a criminal defendant waived the attorney-client privilege and/or the attorney work product doctrine when he interacted with a GAI platform regarding his defense strategy. The court ruled that he did, because his attorney had not directed Heppner’s use of the GAI platform, and because Heppner had no reasonable expectation of privacy in his interactions with the GAI platform, and therefore, any such claim of privilege had been waived.
The Underlying Facts
Heppner was indicted on multiple counts of securities fraud and related charges arising from his conduct as a corporate executive. Prior to his indictment, and after receiving a grand jury subpoena and knowing he was the target of a government investigation, Heppner input multiple prompts into a public GAI platform seeking to understand how the government might proceed against him and what defense strategies he could raise. Notably, he did so without direction from his attorney.
When Heppner’s offices were later searched, the government recovered 31 AI-generated reports. Heppner raised attorney-client privilege and work product doctrine in an effort to prevent the government from using these reports in its prosecution. Although Heppner was not directed by counsel to use the GAI model, he did use information he had learned from his counsel to form his prompts. Heppner also claimed that the purpose of creating these documents was to prepare for speaking with his counsel for legal advice. Heppner had also shared these reports with his attorney.
Attorney-Client Privilege Analysis
To appreciate the risks of Heppner’s conduct, one must first understand the basic mechanics of public GAI platforms. When a user inputs information into a public GAI tool, the data is transmitted to remote servers operated by the GAI provider. Depending on the platform’s terms of service and privacy policies, the information may be stored, reviewed by human employees, used to train future iterations of the model, or potentially provided to third parties, particularly governmental authorities, if requested.
The attorney-client privilege, one of the oldest and most sacrosanct protections in American law, protects confidential communications made for the purpose of seeking or providing legal advice. The privilege belongs to the client and generally can only be waived by the client or through the client’s actions. Critically, the communication must remain confidential. Courts have consistently held that the privilege does not protect communications that the client does not intend to keep confidential.
The Heppner court held that the AI-generated reports failed to satisfy these threshold requirements. First, the reports were not communications between Heppner and his counsel, even though he later provided them to counsel. The GAI platform itself was not an attorney, nor could it be treated as one for purposes of privilege.
Second, the communications were not confidential. The platform’s written terms of use indicated that inputs and outputs could be shared with third parties. As a result, Heppner was on notice that the platform’s owner could disclose both his prompts and the resulting reports.
Finally, the court emphasized that Heppner was not directed by his attorney to undertake the AI inquiry. As a result, the reports were not created for the purpose of seeking legal advice.
Work Product Doctrine Analysis
The attorney work product doctrine protects materials prepared by or for an attorney in anticipation of litigation or for trial. Unlike the attorney-client privilege, work product protection extends to documents and tangible things, with a focus on protecting an attorney’s mental impressions, conclusions, opinions, and legal theories.
The court held that work product protection did not apply because the reports were not generated at the behest or request of an attorney, and therefore, did not amount to the “mental impressions” of counsel. Heppner was not acting as his counsel’s agent when he communicated with the GAI model. Although the reports may later have influenced defense strategy, they did not reflect counsel’s mental impressions at the time they were created.
Practical Considerations for Attorneys
Attorneys should address AI use explicitly in engagement letters or other client communications, including the risks associated with sharing attorney communications or defense strategy with public GAI platforms. While the Heppner court emphasized the absence of counsel’s direction, its reliance on the platform’s terms of use suggests that even attorney involvement may not eliminate waiver risk where confidentiality cannot be assured.
Attorneys should also take care that they are not violating Rule 1.1 (competence), which includes technological competence, and Rule 1.6 (confidentiality), which prohibits unauthorized disclosure of client information. Use of public GAI tools without appropriate safeguards may implicate both.
Accordingly, attorneys should determine if use of public GAI models is necessary, whether it may lead to disclosure of client secrets or their own work product, and they should strongly consider securing informed consent from clients before use of such AI tools. In many instances, the safer course may be to use GAI in closed (non-public) legally trained GAI platforms, which protect privacy, and therefore, their work product.
