Attorney-Client Privilege and AI: What a 2026 Federal Ruling Actually Changed

This is a technical and general-compliance explainer, not legal advice. Talk to your bar association or counsel about your firm's specific obligations.

For most of the debate about lawyers and generative AI, "will this waive privilege" was a hypothetical risk lawyers were told to worry about. In February 2026, it stopped being hypothetical. A federal court ruled on the question directly, and the answer was not favorable to the party who'd used a consumer AI tool.

What privilege actually requires

Attorney-client privilege protects confidential communications between a client and counsel, made for the purpose of obtaining or giving legal advice — federal courts apply this standard under Federal Rule of Evidence 501, and every state recognizes a version of it. Three elements have to hold: the communication has to actually be between the client and counsel (or counsel's agent), it has to be intended as confidential, and its purpose has to be legal advice. Miss any one of those, and there's nothing to protect — a document doesn't become privileged because someone writes "privileged" at the top of it.

What the Heppner case actually decided

United States v. Heppner is a real, currently-litigated federal criminal case, not a hypothetical. Bradley Heppner, indicted on securities and wire fraud charges, had roughly 31 documents seized from his home that recorded his written exchanges with Anthropic's consumer Claude product. Prosecutors sought them; Heppner argued they were privileged. On February 10, 2026, Judge Jed S. Rakoff of the Southern District of New York ruled from the bench — addressing, in the court's own words, "a question of first impression nationwide" — that the exchanges were protected by neither attorney-client privilege nor the work-product doctrine. He issued the full written opinion a week later.

The reasoning tracked the three-element test above, and it's worth reading closely because it's narrower than some of the coverage suggested:

• No attorney-client communication. Claude isn't a lawyer, and it wasn't engaged by Heppner's counsel as an agent assisting with legal advice — he queried it on his own initiative. A conversation with a tool isn't a conversation with counsel, however legal the subject matter.
• No reasonable expectation of confidentiality. The court looked directly at the consumer product's terms of service and privacy policy, which reserved Anthropic's rights to log the conversation and use it for model training. Submitting information to a system whose own terms disclaim confidentiality, the court held, is inconsistent with treating that submission as confidential.
• No work-product protection either, for a related but distinct reason: the documents were created on Heppner's own initiative, not at counsel's direction as part of litigation strategy — the nexus to counsel's work that work-product protection requires wasn't there.

What the court did not decide is at least as important: it left open whether an attorney's own use of generative AI to draft work product would be protected, whether a non-public or enterprise AI tool with real contractual confidentiality terms would change the confidentiality analysis, and whether a client using AI at counsel's specific direction could claim privilege over the output. Heppner is a first-of-its-kind ruling on one specific fact pattern — a criminal defendant, unilaterally, using a free consumer chatbot — not a blanket rule that "AI plus legal matter" always breaks privilege.

Why "it was inadvertent" won't save you

A natural response is to lean on the inadvertent-disclosure doctrine — Federal Rule of Evidence 502(b), which can preserve privilege over an accidental disclosure in federal proceedings if the holder took reasonable steps to prevent it and acted promptly to fix it once discovered. That rule is real and does real work. But it's built for accidents, and routinely pasting client material into a consumer AI tool as a standing practice is a choice, not a slip — the same reasoning Heppner applied would likely apply just as directly, and 502(b) only reaches privilege and work-product in federal proceedings to begin with, not state matters or regulatory investigations.

The ABA reached a related but broader conclusion the year before, for a different reason: ABA Formal Opinion 512, issued July 29, 2024, is the ABA's first formal ethics guidance on generative AI in practice, and it addresses competence, confidentiality, communication, candor to the tribunal, and supervisory duties over anyone at the firm using these tools. On confidentiality specifically, it recommends lawyers obtain a client's informed consent before feeding that client's confidential information into a generative AI tool — and it's explicit that a boilerplate line buried in a standard engagement letter doesn't count as informed consent for this purpose.

What actually changes the analysis

Reading Heppner and Opinion 512 together, the load-bearing variable in both isn't "did AI touch this matter" — it's where the AI is actually running, and under what terms. A consumer chatbot whose own privacy policy reserves the right to log and train on your input is a third party in every sense that matters to a confidentiality analysis. A model that never receives the query outside the firm's own infrastructure in the first place doesn't raise the same question, because there's no third-party terms-of-service to point to and no transmission to weigh against confidentiality.

That's the specific problem AssistantGeneral is built around for legal use: the reasoning model, the firm's document index, and the document generation engine all run on the firm's own hardware, so client material doesn't cross a vendor boundary to get an answer. That architectural fact answers the "is this a third-party disclosure" question the same way an internal, on-premise document database always has — it doesn't, on its own, satisfy every duty Opinion 512 lays out. Informed consent, supervision, competence in actually understanding what the tool does and doesn't get right — those are firm-level practices no deployment model does for you automatically.

If your firm is currently forming a policy on AI use, the practical takeaway from Heppner isn't "never use AI on a matter." It's "know whether the tool you're using is, legally, a third party" — and get that answer in writing before it becomes the subject of a motion.

Sources: Harvard Law Review — United States v. Heppner · McDermott Will & Emery — Using AI Without Waiving Privilege · ABA Formal Opinion 512 (PDF)