Part of our AI Regulation and Compliance News series

AI and attorney-client privilege: what Heppner means and how to keep Claude chats protected

Key Takeaways

What happened: in United States v. Heppner, Judge Jed Rakoff of the Southern District of New York ruled on February 10, 2026 (written opinion February 17) that a defendant's exchanges with Claude were not protected by attorney-client privilege or the work-product doctrine, and the AI material was ordered produced. The Harvard Law Review Blog and the New York State Bar Association both covered it as a first-of-its-kind federal holding.
Why it stings: the defendant typed his own counsel's case strategy into a public AI tool on his own, with no direction from his lawyers. Agents recovered those queries and responses on a search warrant. The privilege never attached because no lawyer was steering the use.
The fix the court itself signaled: Rakoff noted that had counsel directed the use, Claude might have functioned as the lawyer's agent, the way an accountant does under the Kovel doctrine, and privilege might have attached. Attorney-directed use is the difference between a protected workflow and a discoverable one.
What to do now: route privileged AI use through counsel, document the direction, wall off candid strategy from open tools, and use confidentiality controls that support the argument. Unsupervised AI breaks privilege. Supervised AI can keep the shield.

The Leveraged Years Briefing. Permalink

What Heppner actually held

For the first time, a federal court has put a name on something the bar had only worried about in the abstract. In United States v. Heppner, in the Southern District of New York, Judge Jed Rakoff ruled from the bench on February 10, 2026, with a written opinion following on February 17, that a defendant's conversations with Claude carried no protection under the attorney-client privilege or the work-product doctrine. The AI material was ordered turned over. The ruling kept circulating through bar commentary into the spring, and the New York State Bar Association ran a piece under the headline that loose AI prompts sink ships.

The facts matter, because they are the whole lesson. The defendant took case strategy material that had come from his own lawyers and typed it into Claude himself. His counsel did not tell him to do that. They did not supervise it. They did not even know it was happening in the way that would have made the tool part of their work. Government agents later recovered the queries and the model's responses while executing a search warrant, and the question landed in front of the court: are these protected.

Rakoff's answer was no, and the reasoning was not exotic. Attorney-client privilege protects confidential communications made to get legal advice from a lawyer. Work product protects material a lawyer or the lawyer's agent prepares in anticipation of litigation. A person sitting alone with a chatbot, feeding it strategy his lawyers gave him, is not communicating with his lawyer and is not acting as the lawyer's agent. He is talking to a third party. Talking to a third party is how you lose the privilege, whether that third party is a friend at dinner or a model in a browser tab.

The opinion was careful about its own reach. Rakoff observed that the implications of AI for the law are only beginning to be explored. This is a first marker, not the last word. But it is a marker every lawyer who touches AI now has to plan around.

Why attorney AI use is exposed

Most coverage of Heppner stopped at the scary version: your AI chats can be used against you. True, and not very useful. The part that should change how you work is quieter. The privilege did not fail because AI is dangerous. It failed because the use was unsupervised.

Think about how privilege normally extends past the lawyer. When a litigator hires a translator to sit in on a client meeting, the translator is covered, because the translator is functioning as the lawyer's agent in delivering legal advice. The same logic covers the paralegal, the investigator, and, under the Kovel doctrine, the accountant a lawyer brings in to make the client's financial picture legible enough to advise on. The agent is inside the tent because the lawyer put them there for the purpose of giving legal advice.

An AI tool can sit in either world. If a client opens Claude on his own and pours in strategy, the tool is a stranger and the privilege is gone, which is the Heppner fact pattern. If a lawyer directs the use of the tool as part of preparing advice, the argument that the tool is the lawyer's agent becomes available. Rakoff said this in almost so many words: had counsel directed Heppner to use Claude, Claude might arguably have functioned as a highly trained professional acting as the lawyer's agent within the protection of the privilege. The court drew the map. It did not walk the road, because on these facts no lawyer was directing anything.

That is the exposure, stated plainly. Every time AI use in your matters happens outside your direction, you are recreating the Heppner facts. The risk is not the tool. It is the absence of the lawyer.

The Kovel-supervision protocol, step by step

Here is the protocol that puts you on the protected side of the line the court drew. None of it is heavy. It is the difference between a workflow you can defend and one you cannot.

Direct the use in writing. If a client or a non-lawyer on your team is going to use AI on a matter, the instruction to do so should come from counsel and be documented. A short engagement-letter clause or a matter memo that says the firm is directing AI-assisted work for the purpose of providing legal advice is what makes the agency argument real rather than hopeful. Kovel worked because the lawyer hired the accountant for legal advice and could prove it.
Keep the tool inside the legal-advice purpose. The privilege covers communications made to obtain legal advice. Frame the AI task that way and keep it there. The model is summarizing a deposition so counsel can advise, or organizing records so counsel can assess exposure. It is not the client venting or doing unrelated business in the same thread.
Wall off candid strategy from open tools. The most dangerous content is the part where you think out loud about the weakness in your own case. Keep that in the channels that are most defensibly protected, and keep the AI prompts task-focused and neutral. A prompt log is a transcript of your process, and a hostile reader will mine it. Do not hand them the material.
Control confidentiality at the tool level. Use settings that support the argument that the communication stayed confidential. With Claude that means workspace controls and a no-training configuration, so that the inputs are not used to train models and are not leaving the protected environment. Privilege depends on confidentiality, and confidentiality has to be a fact about your setup, not a hope.
Tell the client the rule. Heppner forfeited the privilege by acting alone. The single most useful thing you can say to a client is do not put anything about this case into any AI tool unless we tell you to and tell you how. The unsupervised client is the leak.
Log the direction and the controls. If the question ever reaches a judge, you want a record that counsel directed the use, defined its legal-advice purpose, and kept it confidential. That record is what turns Rakoff's hypothetical into your defense.

This is the same move good lawyers already make with every other agent they bring inside the privilege. You are doing it with a new kind of agent, on the record, on purpose.

Confidentiality and work-product guardrails

The Kovel structure gets you the privilege argument. Two more guardrails keep it from springing a leak.

First, confidentiality is the thing that can quietly waive everything. Privilege protects confidential communications, and the moment a communication stops being confidential, the protection can go with it. Pasting client material into a tool that trains on inputs, or that exposes the conversation outside the protected environment, is the kind of disclosure that breaks confidentiality. The tool configuration is not an IT footnote. It is part of the legal argument. Verify the no-training and workspace settings, and treat anything you cannot verify as if it is public.

Second, work product has its own seam. It is broad, but it is not a force field. The protection thins where AI output crosses out of pure attorney mental impression and into something a testifying expert relies on. That is exactly the seam that ran through the June 2026 order disclosing an expert witness's AI prompts. Keep your expert's AI use and your privileged strategy use in separate, clearly labeled lanes, so that one does not drag the other into the open. The doctrines still cover a great deal of AI-assisted legal work, but they are being worked out in real time, and the conservative reading is the right one until your jurisdiction settles the question.

What to do now

You do not need a task force. You need a rule, a clause, and a setting.

Adopt one firm-wide rule: privileged AI use is attorney-directed AI use. If counsel did not direct it, treat it as discoverable.
Add the engagement-letter language that documents the firm directing AI-assisted work for the purpose of legal advice, so the Kovel agency argument exists before you need it.
Lock the tool configuration. No-training, workspace-controlled, confidential by default. Confirm it rather than assume it.
Brief every client and every non-lawyer team member: nothing about the matter goes into any AI tool unless counsel directs it and confirms how.
Keep candid strategy out of prompt logs, and keep expert AI use in its own lane away from privileged work.

Done together, these turn the lesson of Heppner into a competitive edge. The firms that get sloppy will keep handing opposing counsel a transcript. The firms that supervise will keep the shield and keep the speed.

What AI does not replace

AI does not make the privilege call. That is legal judgment, and the cases above are a reminder that the judgment is the job. The model can summarize the deposition, but deciding what is privileged, structuring the engagement so the privilege attaches, and reading how a developing doctrine applies to your matter and your jurisdiction are work only a lawyer can own. A tool that drafts faster does not change who is accountable when a judge asks whether the communication was protected. The leverage is in doing the judgment work cleanly and letting the model carry the volume underneath it.

If you want to build that discipline into a full operating system for your practice, the role-specific program is below. It is the same skill set that separates a leveraged attorney from an exposed one: knowing exactly where the tool helps and where the lawyer has to stay in the chair.

Frequently Asked Questions

Did a federal court really rule that AI chats are not privileged?

Yes, on these facts. In United States v. Heppner, Judge Jed Rakoff of the Southern District of New York ruled on February 10, 2026 (written opinion February 17) that a defendant's exchanges with Claude were not protected by attorney-client privilege or work product, and the AI material was ordered produced. The defendant had typed his counsel's strategy into the tool himself, with no direction from his lawyers, which is why the privilege never attached. It was covered by the Harvard Law Review Blog and the New York State Bar Association as a first-of-its-kind federal holding.

How can attorney-directed AI use stay inside the privilege?

By using the Kovel structure. The court noted that had counsel directed the use, the AI might have functioned as the lawyer's agent, the way an accountant does under the Kovel doctrine, and privilege might have attached. In practice that means documenting that counsel directed the AI-assisted work for the purpose of legal advice, keeping the task inside that purpose, controlling confidentiality at the tool level with no-training and workspace settings, and walling candid strategy off from open tools. Direction plus confidentiality is what turns the court's hypothetical into a defensible workflow.

Does this mean my firm should stop using Claude?

No. Heppner is about unsupervised use, not about the tool. The risk in the case came from a client acting alone, not from AI as such. Supervised, attorney-directed, confidentiality-controlled use is exactly the workflow the opinion suggests can keep privilege intact. The practical response is to direct AI use through counsel and lock the settings, not to abandon a tool that does real work.

Is this briefing legal advice?

No. The Leveraged Years is an education company, not a law firm. This is a plain-language read on developing case law, and the rules around AI, privilege, and work product are being worked out in real time. Treat it as background, and confirm how any of this applies to your matter, your jurisdiction, and your ethical obligations with a qualified professional.