In the United States District Court for the Southern District of New York, Judge Rakoff handed down a Memorandum decision after a pretrial conference that could have far-reaching implications.
First, STOP USING AI to get legal answers, until you read this.
In the case of United States of America v Bradley Heppner, Judge Rakoff held a pretrial conference. The government requested a ruling that “certain written exchanges that defendant Bradley Heppner had with a generative artificial intelligence (“AI”) platform were not protected from Government inspection by either the attorney-client privilege or the work product doctrine” and Judge Rakoff agreed.
The judge noted that this ruling is the first time that a court has answered the question of whether, when a user communicates with a publicly available AI platform in connection with a pending criminal investigation, are the AI user’s communications protected by attorney-client privilege or the work product doctrine?
In this case, the defendant was indicted, arrested and pled not guilty. Agents with the FBI executed a search warrant at the defendant’s home and seized numerous documents and electronic devices. Heppner’s lawyer later represented to the Government that among the seized materials were approximately 31 documents that memorialize communications that the defendant Heppner had with the generative AI platform “Claude,” which is operated by the private company Anthropic. According to Heppner’s attorney, the documents represent communications between the defendant and Claude that took place “in 2025, after Mr. Heppner had received a grand jury subpoena [and] after it was clear with discussions with the government that Mr. Heppner was the target of this investigation.” The court then said,
Without any suggestion from counsel that he do so, Heppner “prepared reports that outline defense strategy, that outlined what he might argue with respect to the facts and the law that we anticipated that the government might be charging.”
Thus, Heppner’s attorney asserted that Heppner “was preparing these reports in anticipation of a potential indictment.” Heppner’s attorney asserted privilege over these documents arguing that among other things Heppner’s inputs to Claude were based on information Heppner had learned from his lawyer, that Heppner had created the AI documents for the purpose of speaking with counsel to obtain legal advice, and Heppner had subsequently shared the contents of the AI documents with his lawyer. Heppner’s attorney had to concede however that he “did not direct [Heppner] to run Claude searches.”
In ruling against Heppner’s attorney-client privilege claim, the court set forth the fundamental requirements for communications to be subject to the privilege:
It is well-established that the attorney-client privilege attaches to, and protects from disclosure, “communications (1) between a client and his or her attorney (2) that are intended to be, and in fact were, kept confidential (3) for the purpose of obtaining or providing legal advice.
The judge said that the AI documents lacked at least two if not all three elements of the attorney-client privilege.
First, the AI documents were not communications between Heppner and his lawyer. Heppner did not, and could not have, maintained that Claude is an attorney. The court cited the general rule: “In the absence of an attorney-client relationship, the discussion of legal issues between two non-attorneys is not protected by attorney-client privilege.” Because Claude is not an attorney, Heppner could not claim privilege.
The judge dismissed Heppner’s assertion that “some commentators have argued that whether Claude is an attorney is irrelevant because a user’s AI inputs, rather than being communications, are more akin to the use of other Internet-based software, such as cloud-based word processing applications.” The court said however that “the use of such applications is not intrinsically privileged in any case.” The attorney-client privilege require “a trusting human relationship” with “a licensed professional who owes fiduciary duties and is subject to discipline.” “No such relationship exists, or could exist, between an AI user and a platform such as Claude.”
Second, the communications were not confidential. That’s not merely because Heppner communicated with a third party AI platform, but also because the written privacy policy to which users of Claude consents provides that Anthropic collects data on both user inputs and Claude’s outputs, and that it uses such data to train Claude. Anthropic reserves the right to disclose such data to a host of third parties including the government. That policy clearly puts Claude’s users on notice that Anthropic, even in the absence of the subpoena, may “disclose personal data to third parties in connection with claims, disputes or litigation.” On top of that, the court said
More generally, as another court in this District recently observed, AI users do not have substantial privacy interests in their “conversations with [another publicly accessible AI platform] which users voluntarily disclosed” to the platform and which the platform “retains in the normal course of its business.”
Third, Heppner did not communicate with Claude for the purpose of obtaining legal advice. The court acknowledge that this may be a “closer call” because Heppner’s attorney asserted that Heppner communicated for the express purpose of talking to counsel.” But Heppner did not do so at the suggestion or direction of counsel. The court went on to say
Had counsel directed Heppner to use Claude, Claude might arguably be said to have functioned in a manner akin to a highly trained professional who may act as a lawyer’s agent within the protection of the attorney-client privilege… But because Heppner communicated with Claude of his own volition, what matters for the attorney-client privilege is whether Heppner intended to obtain legal advice from Claude, not whether he later shared Claude’s outputs with counsel. And Claude disclaims providing legal advice. Indeed, when the Government asked Claude whether it could give legal advice, it responded that “I’m not a lawyer and can’t provide formal legal advice or recommendations” and went on to recommend that a user “should consult with a highly qualified attorney who can properly assess your specific circumstances.”
Thus, the court concluded that the communications were not privileged at the time they took place. Even if Heppner intended to share those communications with his attorney and eventually did so, it is still “black letter law that non-privileged communications are not some how alchemically changed into privilege once once being shared with counsel. Thus, because the AI documents “would not be privileged if they remained in [Heppner’s] hands,” they did not “acquire protection merely because they were transferred” to his lawyer.
The court went on to discuss the work product doctrine. However, many people who read this newsletter will not be involved in any sort of litigation, which is the only situation to which the work product doctrine applies. Yet they will be discussing matters – attorneys with their clients – and clients with their attorneys – and there will be the temptation to take something, perhaps from the attorney or as Heppner did creating his own searches, and run them through a publicly available AI database like Claude, Google Gemini, Chat GPT and others. Those searches are discoverable. And that could be a disaster.
There are FOUR MORALS from this case:
#1 – Obviously, don’t use publicly available artificial intelligence websites, either to submit what your attorney has provided, whether for review or for whatever other purpose. Don’t copy/paste emails, memos or other documents from your attorney into artificial intelligence websites.
You may ask, “may I use public AI if my attorney tells me I should do that?” Answer: No. As in the Heppner case, most, if not all, of those services retain the right to keep your information, to train on it and to disclose it. There is no guarantee that it is going to be kept confidential and if it’s not kept confidential, it’s not covered by the attorney-client privilege.
#2 – Attorneys should begin warning clients about the dangers of using AI. Even if there is no belief that any dispute whatsoever is going to occur on any representation, it doesn’t matter. We cannot know the future. Things done today may end up in court a year or a decade from now. At that point in time, we may want to assert the attorney-client privilege and we may find that it has been blown completely. It may be prudent to begin putting language like that in engagement letters. Or maybe it’s prudent to have a separate document the client signs to make them aware of this potential risk.
#3 – Attorneys should use only closed AI systems that are private such as Lexis AI and similar services.
#4 – Note the court’s reference to other Internet-based software “such as cloud-based word processor applications.” The judge said “But the use of such applications is not intrinsically privileged in any case…” Does that mean your cloud-based documents, accounting software, spreadsheets etc. are destroying the attorney-client privilege you might like to claim someday?
Stay tuned.
COPIES: If you would like a copy of the ruling, please send an email to me asking for it. I will be glad to attach it to a reply email to you.