On February 10, 2026, Judge Jed S. Rakoff of the United States District Court for the Southern District of New York ruled from the bench in United States v. Heppner, No. 25-cr-00503-JSR, that 31 documents a criminal defendant created using Anthropic’s Claude were not protected by attorney-client privilege or the work product doctrine. A week later, on February 17, Rakoff issued the written opinion. On April 17, Reuters coverage of the ruling hit the front page of Hacker News with 213 points and 411 comments, two months after the ink dried on the docket. That delay matters. Every knowledge worker in the United States who types anything sensitive into a consumer AI tool is now searching for what the ruling actually means.
The short answer the law firm blogs have already written: do not discuss your legal situation with ChatGPT, Claude, or Gemini if you might end up in litigation. The shorter answer Rakoff actually wrote: Bradley Heppner’s Claude chats failed all three prongs of the federal attorney-client privilege test, and the work product doctrine failed independently on top of that. The answer the coverage has mostly missed: Rakoff’s opinion leaves a narrow doctrinal door open, and understanding where that door is matters more than the headline.
This piece walks the three-prong test as a mechanism, names exactly which escape hatch defeats which prong, and explains why the single most underreported holding in the opinion is the one that cannot be fixed by upgrading to an enterprise plan.
The facts matter because the ruling is fact-specific
Bradley Heppner was indicted on October 28, 2025, on charges of securities fraud, wire fraud, conspiracy, making false statements to auditors, and falsification of records related to an alleged scheme at Beneficient, a financial services company he founded and controlled as CEO. The alleged scheme involved roughly $150 million in investor losses. Heppner was arrested in November 2025 and his residence was searched. Federal agents seized electronic devices containing approximately 31 documents that Heppner had generated by typing queries into a publicly available version of Claude. The prompts discussed facts of the government’s investigation, outlined potential defense strategies, and walked through what arguments he might make about the facts and the law.
Three timing details drive the ruling. First, Heppner created the documents after receiving a grand jury subpoena and after the government had made it clear he was the target of the investigation. Second, his counsel did not direct him to use Claude. He used it on his own initiative. Third, he later shared the resulting documents with his defense attorneys. On February 6, 2026, the government filed a motion asking the court to rule that these AI Documents were not privileged. After oral argument on February 10, Rakoff granted the motion from the bench. His written memorandum followed on February 17 and characterized the question as one of first impression at the federal level.
The three-prong test, walked as a mechanism
Federal attorney-client privilege is not a general confidentiality shield. It is a narrow common-law protection that the Second Circuit articulated in United States v. Mejia, 655 F.3d 126, 132 (2d Cir. 2011), as covering communications (1) between a client and his or her attorney, (2) intended to be and in fact kept confidential, (3) for the purpose of obtaining or providing legal advice. The party asserting privilege carries the burden of establishing all three. Missing any one element is fatal.
Prong one: attorney. Rakoff’s opinion addresses this prong first and most sharply. “Because Claude is not an attorney,” he wrote, “that alone disposes of Heppner’s claim of privilege.” Claude does not hold a law license. It cannot form an attorney-client relationship with a user. Federal courts have consistently held that communications between two non-attorneys discussing legal matters are not privileged, no matter how sophisticated or accurate the exchange. The government’s analogy was deliberate: Heppner typing to Claude was legally equivalent to Heppner asking a friend for input on his criminal case. Friends with good information do not create privilege. Neither does a probabilistic language model.
Prong two: confidentiality. This is where the opinion gets practical. Rakoff held that the documents were not confidential because Heppner used the public version of the AI tool, and its privacy policy explicitly disclaimed any expectation of confidentiality. Anthropic’s policy, the court observed, states that the company collects data on user inputs and outputs, uses that data for training, and reserves the right to disclose that data to third parties including governmental regulatory authorities. When a user clicks accept on that policy, they are consenting that their inputs are not private in any legally cognizable sense. The court did not need to evaluate whether Anthropic would in fact disclose the data. The disclaimed expectation of confidentiality alone defeats the privilege, because the privilege requires both that the communication was intended to be confidential and that it was in fact kept confidential. A public chat tool trained on user inputs satisfies neither.
Prong three: for the purpose of legal advice. Here Rakoff followed the government’s argument that Claude’s own materials, including its Constitution and terms of service, expressly disclaim the ability to provide legal advice and suggest that the user consult a qualified lawyer. Even if Heppner subjectively believed he was obtaining legal advice, the question under the privilege is whether the communication was made “for the purpose of obtaining or providing legal advice” from a lawyer. Because Claude is not a lawyer and says so in its own documentation, the third prong also failed. The opinion noted this prong’s failure is redundant with the first, but Rakoff held it separately as an alternative ground.
The Kovel escape hatch, and why Heppner could not walk through it
The ruling’s most important passage, for anyone thinking about how to use AI tools with legal counsel, is the one most coverage has skipped. Rakoff left open that “it could have been a different story if counsel had directed Heppner to use Claude. Then, Claude might have functioned as a lawyer’s highly trained agent, covered by attorney-client privilege under the Kovel doctrine.”
The Kovel doctrine comes from United States v. Kovel, 296 F.2d 918 (2d Cir. 1961), a Second Circuit opinion by Judge Friendly that extended attorney-client privilege to a non-lawyer accountant who worked under the direction of a law firm. Friendly’s analogy was that accounting concepts are a foreign language to lawyers, and an accountant translating those concepts so the lawyer can give legal advice is functionally acting as an interpreter. Subsequent Second Circuit cases have tightened the test. The current standard, as articulated in United States v. Ackert, 169 F.3d 136 (2d Cir. 1999), requires that the non-lawyer be “nearly indispensable” to the lawyer’s provision of legal advice, and that the engagement run through the attorney, not the client. The formalities matter: the consultant is typically engaged via a written Kovel letter from the attorney, reports to the attorney, invoices the attorney, and is directed by the attorney.
Applied to AI, the Kovel carve-out is narrow but real. If a criminal defense attorney directs a client to use a specific enterprise AI tool to organize timeline information that the attorney will then analyze, and the use runs through the attorney’s engagement with the provider, the output may qualify for privilege in the Second Circuit. The privilege attaches because the AI is acting as the attorney’s agent, not because it is a confidant of the client. Rakoff’s opinion, read carefully, does not close this door. It closes the door on the specific facts in front of him: self-directed use of a public chatbot by a target of investigation, with no attorney involvement until after the output was generated.
The narrower the Kovel reading, the more this matters. If the “nearly indispensable” standard controls, an AI that merely accelerates work the lawyer could do themselves probably fails the test. If the “significant purpose” reading from In re Kellogg Brown & Root, Inc., 756 F.3d 754 (D.C. Cir. 2014), controls in other circuits, the bar is lower but still requires attorney direction. What is not in doubt is that self-directed use defeats the doctrine before it begins. A client who uses Claude on their own to think through their criminal case cannot later claim the output was prepared at the direction of counsel.
Work product fails independently, and this is the subtler holding
The government argued, and Rakoff agreed, that even if the privilege analysis had come out differently, the work product doctrine would fail on its own grounds. Federal Rule of Civil Procedure 26(b)(3) (applicable to criminal cases through Federal Rule of Criminal Procedure 16(b)(2)) protects materials “prepared in anticipation of litigation by a party or that party’s representative.” The Second Circuit in In re Grand Jury Subpoenas Dated Mar. 19, 2002 and Aug. 2, 2002, 318 F.3d 379, 383 (2d Cir. 2003), refined this to require that the materials be prepared “by or at the behest of counsel.”
Heppner admittedly created the documents on his own initiative. He was not operating at the behest of counsel. The court held that materials a party prepares on their own, even when unambiguously made in anticipation of litigation, do not qualify for work product protection. The opinion articulates a sharper sub-holding: even though the documents may have ended up affecting defense counsel’s strategy, affecting strategy is not the same as reflecting counsel’s mental impressions at the time of creation. Work product protects the lawyer’s thinking. It does not protect the client’s self-generated analysis that the lawyer later reads.
The retroactive-privilege argument also failed cleanly. Heppner’s counsel argued that sharing the AI documents with attorneys after the fact brought them inside the privilege. The Southern District has rejected this argument for decades. In United States v. Correia, 468 F. Supp. 3d 618, 622 (S.D.N.Y. 2020), the court held that sending non-privileged documents to counsel does not make them privileged. Upjohn Co. v. United States, 449 U.S. 383, 395 (1981), goes further: even inside an attorney-client relationship, the underlying facts in a communication are not privileged, only the communication itself. A client cannot launder unprivileged content through their lawyer’s inbox.
The mapping: consumer, enterprise, on-device
Here is where most of the law firm coverage stops, and where anyone building an AI-integrated product needs to keep reading. The three prongs do not all fail for the same reasons against different deployment models. Mapping the failure modes tells you which configurations retain a privilege claim and which do not.
Consumer tier (Heppner’s configuration). Public ChatGPT, public Claude, public Gemini, Copilot free tier. Privacy policies that permit training on inputs and disclosure to third parties. All three prongs fail: no attorney, no confidentiality, no legal-advice purpose. Work product also fails unless attorney direction is formalized. This is the case in front of Rakoff and the case closest to how most Americans actually use these tools.
Enterprise tier with no-training commitments. Claude for Work (Team or Enterprise), ChatGPT Enterprise or Team, Gemini for Workspace, Microsoft 365 Copilot. These tiers typically carry contractual commitments not to train on customer inputs, stricter confidentiality terms, data processing agreements, and in some cases SOC 2 attestations. Prong two (confidentiality) becomes at least arguable. Prong one (attorney) still fails outright because the tool is not a lawyer. Prong three (legal advice purpose) still fails unless attorney direction converts the use into a Kovel agent relationship. The upshot: enterprise tier does not save privilege on its own. It closes the confidentiality gap but leaves the attorney-involvement gap wide open. Courts have not yet ruled on enterprise-tier privilege claims directly, and any lawyer relying on that argument is betting on an untested reading.
On-device or self-hosted. Open-source models running locally (Llama, Qwen, Mistral), Apple Intelligence’s on-device tier, self-hosted LLMs behind a firm firewall, on-device Whisper for transcription. No data leaves the device. Prong two is robustly satisfied because no third party ever receives the communication. Prong one still fails because the model is not a lawyer. Prong three still requires attorney direction. The structural advantage of on-device is that it removes the third-party disclosure problem entirely. The structural disadvantage is that on-device models are typically smaller, narrower, or more specialized than frontier cloud models, and they still do not get you privilege by themselves.
The pattern across all three tiers is the same. Model quality does not create privilege. Privacy terms do not create privilege. The only thing that creates privilege is an attorney-directed workflow that fits inside the Kovel doctrine’s “nearly indispensable agent” test. Everything else is a waiver waiting to happen.
What Rakoff did not decide, and why that matters
The opinion is narrow by design. Three things Rakoff explicitly did not reach, and which the next round of cases will have to resolve.
First, enterprise AI tools with no-training contractual commitments. Heppner used the consumer version. The opinion does not reach the question of whether an enterprise deployment with a stringent data-processing agreement satisfies the confidentiality prong. The reasoning suggests it might, but a court has not yet said so directly.
Second, attorney-directed AI use inside an engagement. Rakoff’s Kovel reference is dicta, not holding. No federal court has yet ruled on whether an AI tool directed by counsel, operating under a written engagement analogous to a Kovel letter, qualifies as a protected agent. The analogy is plausible. The doctrinal test is unsettled. The ABA’s Formal Opinion 512 (July 29, 2024) requires lawyers who use AI tools to assess disclosure risk, obtain informed client consent for self-learning tools, and maintain supervisory responsibility under Model Rules 1.1, 1.6, and 5.3. Courts will probably lean on these standards as the proxy for whether an attorney-directed AI use is reasonable enough to fit inside Kovel.
Third, voice and meeting-capture tools. Heppner involved typed prompts. Audio transcription, meeting note-taking, and voice-agent tools raise different issues, including whether the transcription vendor is a third party and whether the audio itself carries the privileged communication. Future rulings will have to reach these questions. The framework in Heppner applies, but the factual record will look different.
Fourth, state privilege rules. Heppner applies federal common law on attorney-client privilege. Most state privilege rules are functionally similar, requiring an attorney, confidentiality, and legal advice, but the specific contours vary. State courts confronting AI privilege questions will probably follow analogous reasoning, though they are not bound by Heppner and will apply their own precedent.
What this means if you ship products that integrate AI
The ruling changes product risk for anyone building software that puts an LLM in front of sensitive user input. Three practical implications.
The first is the retroactive-privilege problem. If your product captures user inputs that may later end up in litigation, no amount of post-hoc routing through counsel will cure the waiver. This is a fundamental data-retention question, not a legal-review question. If the input was not privileged when typed, it will not be privileged when subpoenaed. Enterprise buyers with any litigation exposure should be asking vendors about deletion, retention, and legal-hold workflows before deployment, not after.
The second is the privacy-policy audit problem. Rakoff relied heavily on the specific text of the provider’s privacy policy to find that confidentiality was disclaimed. Any product whose privacy policy preserves a training right, a disclosure right to governmental authorities, or an unrestricted third-party disclosure right is handing future prosecutors the argument that confidentiality was waived at the time of input. Products targeting regulated sectors (legal, healthcare, financial services) need privacy terms that carve out sensitive categories explicitly. Default terms inherited from consumer SaaS agreements will fail this test.
The third is the workflow-direction problem. If your product is going to be used inside an attorney-client relationship, the integration needs to support attorney-direction workflows cleanly. That means distinguishing user-initiated prompts from attorney-directed prompts, preserving evidence of the engagement relationship, and carrying through the confidentiality posture from the law firm’s own DPA. This is not a marketing feature. It is a doctrinal requirement for the Kovel analogy to survive.
What happens next
Three cases will probably test the Heppner framework within the next twelve to eighteen months. The first will involve an enterprise-tier AI with a no-training commitment, testing whether prong two can be satisfied by contract. The second will involve attorney-directed use with a formal engagement, testing the Kovel doctrine’s fit to AI tools. The third will involve voice or transcription, extending the framework beyond typed prompts. Each of these will come from different circuits, and the results will not be uniform.
The broader signal is that the federal courts are treating AI exactly like they have treated every prior category of non-lawyer communication: narrowly, with the burden on the party asserting privilege, and with the formalities of the engagement carrying most of the weight. The technology is new. The doctrine is not. A consumer tool plus a self-directed user plus a criminal target plus post-hoc routing through counsel was always going to fail this test, regardless of whether the tool was Claude or ChatGPT or a paralegal’s friend who happened to know a lot about securities law.
What Rakoff’s opinion actually holds is straightforward. What it does not hold is where the next year of AI-privilege litigation will land. Every American lawyer with clients who use AI tools, every developer building products that touch legal workflows, and every executive who types sensitive strategy into a chatbot should be treating February 10, 2026, as the starting line of the doctrinal fight, not the end of it.
Heppner’s defense team has three options going forward: argue the documents are harmless on the merits, accept that they come in as evidence, or find a Second Circuit panel willing to expand Kovel beyond where Judge Friendly’s successors have taken it. None of those options are easy. All of them will produce more caselaw. The trial is still ahead.