Visalaw Team
Artificial intelligence is becoming an increasingly important fixture in modern legal practice. From drafting correspondence to researching case law, attorneys and their clients are using AI tools at an unprecedented rate. But on February 10, 2026, a federal judge in the Southern District of New York issued a ruling on AI and attorney-client privilege that every legal practitioner should understand.
In United States v. Heppner, Judge Jed S. Rakoff held that documents generated by a criminal defendant using a consumer-grade AI tool were not protected by the attorney-client privilege or the work product doctrine. On February 17, Judge Rakoff followed up with a written opinion describing the issue as one of "nationwide" first impression. The consequences for how attorneys counsel their clients about AI use are immediate and far-reaching.
Bradley Heppner, former CEO of Beneficient, an alternative asset investment/fintech company, faced federal charges of securities fraud, wire fraud, conspiracy, making false statements to auditors, and falsification of records in connection with an alleged scheme to misappropriate approximately $150 million from publicly traded GWG Holdings — a fraud that ultimately contributed to GWG's bankruptcy and over $1 billion in losses to retail investors and bondholders. After retaining counsel and receiving a grand jury subpoena, Heppner turned to a familiar tool: Anthropic's Claude—specifically, the free consumer version.
Without direction from his attorneys, Heppner fed information he had received from his lawyers into Claude and used the platform to generate reports outlining defense strategy and factual and legal arguments. He later shared these AI-generated documents with his counsel. Defense attorneys ultimately asserted privilege over 31 such documents when the government sought their production.
Judge Rakoff denied both claims.
The attorney-client privilege protects confidential communications between a client and their attorney made for the purpose of obtaining legal advice. The foundational requirement of a confidential communication with counsel was simply not present when Heppner typed into Claude.
Judge Rakoff was direct: Claude is not an attorney. The privilege, as traditionally understood, requires a "trusting human relationship" with "a licensed professional who owes fiduciary duties and is subject to discipline." No such relationship can exist between a user and an AI platform.
But the Court went further. Even setting aside the absence of an attorney, Heppner used the consumer version of Claude. Anthropic's privacy policy for that tier expressly reserves the right to disclose user data to third parties, including governmental regulatory authorities, and the platform trains on user inputs. Heppner, in the Court's view, could not have had a reasonable expectation of confidentiality.
The work product doctrine, rooted in the Supreme Court's decision in Hickman v. Taylor, protects documents and tangible things prepared in anticipation of litigation, particularly materials that reflect an attorney's mental impressions, conclusions, and strategy. While the doctrine is codified for civil cases in Federal Rule of Civil Procedure 26(b)(3), it applies with equal force in criminal proceedings under Hickman and its progeny.
Judge Rakoff acknowledged that Heppner's documents were arguably prepared in anticipation of litigation. The problem was that they were not prepared by or at the behest of counsel, nor did they reflect defense counsel's strategy. They were the client's own prompts and outputs with AI generated analysis, created without attorney direction.
The Court declined to adopt an expansive reading that would extend work product protection to client-generated materials prepared without attorney involvement. Such an extension, Rakoff reasoned, would undermine the very purpose of the doctrine—protecting the mental processes of lawyers—not those of unrepresented clients using chatbots.
The ruling is not a blanket prohibition on AI-assisted legal work. Judge Rakoff acknowledged a significant potential carve-out grounded in the Kovel doctrine.
Under United States v. Kovel, attorney-client privilege can extend to non-attorney third parties such as accountants, translators, experts, and consultants who are engaged by counsel to assist in rendering legal advice. The privilege extends to the third party because they are functioning as the attorney's agent.
Judge Rakoff left open the possibility that if counsel had directed Heppner to use Claude as part of the attorney's own analytical process, the documents might have qualified for protection. In the Court's words, "Claude might arguably be said to have functioned in a manner akin to a highly trained professional who may act as a lawyer's agent within the protection of the attorney-client privilege"—provided there was a genuine expectation of confidentiality and the client was acting on counsel's instructions.
This distinction is critical for practitioners. AI tools used by attorneys or at their express direction as part of providing legal advice occupy meaningfully different legal ground than the same tools used independently by clients.
Beyond denying privilege over the AI-generated documents themselves, Judge Rakoff signaled a concern that deserves close attention from every practitioner: waiver of privilege over the underlying attorney-client communications.
In its motion, the government argued that when Heppner input information he had received from his attorneys into Claude, he disclosed the substance of otherwise privileged communications to a third-party platform — one whose privacy policy expressly reserves the right to collect user inputs, use them to train its models, and disclose user data to third parties including governmental regulatory authorities. The government contended that this disclosure was inconsistent with the confidentiality required to maintain privilege, and that Heppner could not have had a reasonable expectation of confidentiality given the terms he accepted when using the consumer platform.
Judge Rakoff appeared to agree. In his written opinion, the Court noted that Heppner "first shared the equivalent of his notes with a third-party, Claude," distinguishing the AI-generated documents from confidential notes a client might prepare privately with the intent of sharing only with counsel. The Court cited a recent decision from the same district observing that AI users "do not have substantial privacy interests" in conversations voluntarily disclosed to a platform that retains them in the ordinary course of business.
The practical implication is significant. A client who independently uses a consumer AI tool to analyze, summarize, or build upon advice they received from counsel may inadvertently strip protection not just from the AI-generated outputs, but from the original privileged communications themselves. The privilege belongs to the client — and so does the obligation to preserve it.
Heppner is a wake-up call, not just for criminal defense practitioners but for any attorney whose clients may be using AI tools. Immigration attorneys, who routinely handle sensitive personal, financial, and strategic information in high-stakes proceedings, face particular exposure.
Counsel clients explicitly about AI use. Clients should be advised in writing, ideally as part of an engagement letter or separate acknowledgment that using consumer AI platforms to research their case, analyze their options, or draft documents related to their representation carries serious privilege risks. They should understand that feeding attorney communications into any public AI tool may waive privilege over those communications.
Distinguish consumer tools from enterprise solutions. The enterprise versions of major AI platforms (including Anthropic's Claude for Work, OpenAI's enterprise tier, and similar offerings) generally do not train on user inputs and contractually commit to data confidentiality. These platforms offer a substantially stronger foundation for any privilege or work product argument. Attorneys who use AI in their practice should default to enterprise tools, and should ensure that any AI tools made available to clients or used in client-facing workflows meet this standard.
Document attorney direction when AI is part of the workflow. If you or members of your team use AI tools as part of legal analysis, maintain clear records showing that the AI was used at counsel's direction, in support of an attorney's own analytical work. This documentation supports a Kovel argument should privilege ever be challenged.
Review your firm's AI policy. If your practice does not already have a written policy governing attorney and staff use of AI tools in client matters, now is the time to develop one. That policy should address, at minimum: which platforms are approved for use, how client data may and may not be used with AI systems, and how AI-assisted work product should be documented.
Choosing the right legal AI tools requires understanding a few key security features. For attorneys who aren't security experts, the checklist is actually short:
Does it promise not to train on your data? Consumer AI tools, like the free versions of ChatGPT, Claude, and others typically reserve the right to use your inputs to improve their models. That means your client's information could become part of the system's training data, essentially this means inputs are published the second the user submits them. A tool built for legal practice should commit in writing that your inputs, documents, and outputs are never used to train AI models.
Has it been independently audited? Any vendor can claim they take security seriously. What matters is whether an independent third party has verified it. SOC 2 Type II is the standard audit framework that evaluates whether a company's security controls actually work over time. Other industry security and privacy standards are ISO/IEC 42001 which is designed for entities providing or utilizing AI-based products or services, ensuring responsible development and use of AI systems.
Does it give you control over your data? You should be able to decide what gets uploaded, how long it's retained, and when it's deleted. That control matters both for client confidentiality and for your professional obligations.
Learn more about Visalaw AI’s security and privacy commitments, built to be an immigration intelligence platform you can trust and work with sensitive client information knowing it stays protected. Learn more about how we approach security →
Judge Rakoff was careful to note that Heppner does not establish a categorical rule against privilege protection for all AI-generated documents. Traditional attorney-client privilege and work product principles apply; the outcome is fact and jurisdiction specific. But the decision makes clear that the legal profession can no longer treat AI tools as functionally equivalent to a private notebook.
The privilege framework was built around human relationships—the confidential bond between client and licensed counsel. AI tools are powerful, but they are third parties. Using them without appropriate safeguards can compromise everything that framework was designed to protect.
For immigration attorneys advising clients navigating complex, high-stakes proceedings, the message from Heppner is straightforward: AI literacy is no longer optional. Understanding where the privilege ends—and where the waiver begins—is now part of competent representation.
Where the Case Stands
As of this writing, Heppner has not publicly indicated an intent to appeal Judge Rakoff's privilege ruling, and the criminal case remains in its pretrial phase. Because the ruling addresses a pretrial evidentiary question in an ongoing criminal matter, interlocutory appeal options are limited. However, given that Judge Rakoff himself characterized the privilege issue as one of "nationwide" first impression, the reasoning in the written opinion is likely to be cited by courts and litigants well beyond this case. Practitioners should treat the decision as persuasive authority that will shape privilege disputes involving AI tools for the foreseeable future — regardless of how the underlying criminal case is ultimately resolved.
FAQs
View all blogs
Subscribe below to receive tips for using AI in immigration law, product updates, and relevant news in immigration.
Memphis, TN
.png)
.png)