What the Heppner Ruling Changes for Companies Using AI

The case

In February 2026, Judge Jed Rakoff of the Southern District of New York ruled in United States v. Heppner that 31 documents the defendant generated using Anthropic's consumer version of Claude were not protected by attorney-client privilege or the work-product doctrine. The judge gave three reasons: Claude is not a lawyer; Anthropic's consumer privacy policy permits sharing user data with third parties including the government; and the defendant used Claude on his own, not at his lawyer's direction. It is the first US court ruling on whether conversations with a consumer chatbot can be privileged.

What this changes for companies

Before Heppner, the question of whether AI consultations could be privileged was genuinely open. Some attorneys argued that AI used for legal-adjacent work might fall within privilege the way a paralegal's notes do. Heppner answers that question in one direction, in one court: consumer-tier AI used without a lawyer's direction is not privileged.

Two features of the exposure are worth naming up front, because they are not how email or Slack work.

The records do not live on your servers. They live on the AI vendor's. Anthropic, OpenAI, Google, and Microsoft can be subpoenaed directly. Your legal team may not control preservation, search, or production timing in the way it does for company-owned systems.

Your contractual perimeter does not extend to your vendors' vendors. An NDA between your company and your marketing agency does not bind the AI provider the agency uses. If your agency pastes your campaign strategy, customer data, or pricing rationale into a consumer chatbot, that information is now in the chatbot vendor's custody, on terms set by the vendor, regardless of what your contract with the agency says.

Three things to pay closer attention to

• Your historical record, not just your future prompts. The most urgent exposure is the prompts already sitting on a vendor's server. Inventory what has been done. Request deletion where the vendor permits it. Document which tools your teams and your agencies' teams have been using to date.
• Whose contract governs the data. For any work that touches sensitive information, the tool should be one where your company (or your agency, in writing) has negotiated the data terms. Consumer-tier tools are governed by the vendor's standard policy, not by yours.
• The agent-of-counsel pathway. Judge Rakoff wrote that "had counsel directed Heppner to use Claude, Claude might arguably be said to have functioned in a manner akin to a highly trained professional who may act as a lawyer's agent within the protection of the attorney-client privilege." For work where privilege actually matters, route the AI use through counsel and document the direction. This is the only judicial guidance that currently exists on what might preserve privilege.

Limitations

Heppner is a single trial-court ruling. It is persuasive everywhere and binding only in the Southern District of New York. Other courts may follow it, distinguish it, or split. Treat it as a strong signal, not as settled national law.

Further reading

• Memorandum opinion: United States v. Heppner, No. 1:25-cr-00503-JSR (S.D.N.Y. Feb. 17, 2026)
• Harvard Law Review Blog, "United States v. Heppner" (Mar. 23, 2026)
• Paul, Weiss, "S.D.N.Y. Court Considers Whether AI-Generated Documents Are Subject to Privilege Protections" (Feb. 20, 2026)
• O'Melveny, "S.D.N.Y. First-of-its-Kind Ruling: AI-Generated Documents Are Not Privileged" (Feb. 2026)