James Andersen and Pat Murphy//March 23, 2026//

U.S. District Court judge ruled AI-generated documents lack attorney-client privilege.

The defendant used the AI tool Claude after being subpoenaed but before arrest in a securities fraud case.

The ruling highlights that communications with AI do not substitute for privileged communications with attorneys.

Lawyers across the country are assessing the ramifications of a federal judge’s ruling that a white-collar criminal defendant waived the attorney-client privilege to — and lacked work-product protections for — information in documents he created using a consumer-grade artificial intelligence tool.

The government in U.S. v. Heppner moved for a ruling that neither the attorney-client privilege nor the work product doctrine prevented prosecutors from having access to certain written communications that the defendant exchanged with the AI platform Claude.

The defendant used the AI tool before his arrest but after he was subpoenaed by a grand jury and became aware he was the target of a criminal investigation.

U.S. District Court Judge Jed S. Rakoff of the Southern District of New York granted the government’s motion first in a ruling from the bench and then in an opinion memorializing his bench ruling.

In his written decision, Rakoff acknowledged that the ruling “appears to answer a question of first impression nationwide: whether, when a user communicates with a publicly available AI platform in connection with a pending criminal investigation, are the user’s communications protected by the attorney-client privilege or the work-product doctrine?”

In explaining his bench ruling, Rakoff rejected defense counsel’s argument that the materials in question were protected from disclosure because in his interactions with Claude the defendant had inputted information learned from counsel, created the documents in question for the purpose of obtaining legal advice, and later shared those documents with counsel.

“AI’s novelty does not mean that its use is not subject to longstanding principles, such as those governing the attorney-client privilege and the work product doctrine,” Rakoff wrote. “Because [the defendant’s] use of Claude fails to satisfy either of these rules, the AI documents do not merit the protections [he] has claimed.”

Boston lawyer Jessica Gray Kelly, who chairs her firm’s professional liability and errors and omissions national practice section, said in an email that the client’s communications with the AI platform in Heppner “clearly” were not attorney-client communications.

Gerald J. Gleeson III think it is incumbent upon attorneys to warn clients [and their employees] not to use AI to second-guess lawyers or minimize their legal fees. The ability to discover these materials could be catastrophic. If a second opinion is needed, it should be from another lawyer — not software.

— Gerald J. Gleeson II, Troy

“The court could have stopped at saying these were not communications between an attorney, or an agent of the attorney, and a client,” Kelly said. “But the court further explained that the attorney-client privilege is based on a ‘trusting human relationship’ between a client and a person who is licensed to practice law and has fiduciary duties. This note is important because it highlights the attributes of human lawyers that AI will not be able to replace.”

Troy business litigation attorney Gerald J. Gleeson II said while Heppner is a criminal case, the decision implicates cases across the board.

“I think it is incumbent upon attorneys to warn clients [and their employees] not to use AI to second-guess lawyers or minimize their legal fees,” he said. “The ability to discover these materials could be catastrophic. If a second opinion is needed, it should be from another lawyer — not software.”

Lansing business litigator Alexander S. Rusek agreed with the analysis of the issues presented in the case but suggested that there should be further development of the issue.

“I do believe that Judge Rakoff reached the correct conclusion based on the current state of the law and circumstances of the defendant’s case,” he said. “However, there is certainly room for improvement either through legislative initiatives or our courts as AI privilege issues become more prevalent in our justice system. In the context of a criminal defendant’s rights, perhaps there should be a higher standard, such as requiring a finding that a defendant knowingly and voluntarily waived the attorney-client or other privileges by using AI.”

Fraud charges
According to court records, the defendant was indicted on Oct. 28, 2025, for securities fraud, wire fraud, and related charges. The criminal charges related to actions he allegedly took as an executive of the publicly traded company GWG Holdings, Inc.

Prosecutors alleged that the defendant defrauded investors of more than $150 million by making false representations about the company and orchestrating one-sided, self-serving deals between GWG and two companies controlled by him.

On Nov. 4, 2025, FBI agents arrested the defendant and executed a search warrant at his home. During the course of the search, the government seized numerous documents and electronic devices.

In the aftermath of the search, defense counsel notified prosecutors that approximately 31 of the seized documents memorialized the defendant’s communications with the AI tool Claude.

Defense counsel said they would assert that those documents were generated “in 2025, after [the defendant] had received a grand jury subpoena [and] after it was clear [from] discussions with the government that [the defendant] was the target of this investigation.”

Further, defense attorneys said they would claim that the defendant prepared the documents in anticipation of a potential indictment for the purpose of outlining a defense strategy in response to likely charges.

After the defendant notified prosecutors he would be asserting that the AI-generated documents were privileged, the government agreed to segregate those materials from inspection until resolution of the claim of privilege.

In the government’s motion in opposition to the defendant’s assertion that the documents were protected, Assistant U.S. Attorney Alexandra N. Rothman argued that the attorney-client privilege did not apply because the documents did not memorialize communications between the defendant and counsel.

“[O]utside of certain narrow exceptions not relevant here, the attorney-client privilege does not attach to non-attorney communications,” Rothman wrote. “The defendant’s use of the AI tool here is no different than if he had asked friends for their input on his legal situation. But it is well-settled that discussing legal matters with non-attorneys does not imbue those communications with the attorney-client privilege.”

As to the work product doctrine, Rothman pointed to a concession by defense counsel that the defendant had not acted at the direction of his lawyers in creating the AI documents.

“Had counsel directed the defendant to run the AI searches, the analysis might be different,” Rothman wrote. “But the defendant elected to run his own AI searches and then shared the outputs of those searches with counsel. The policy interests underlying the work-product doctrine — to ‘preserve a zone of privacy in which a lawyer can prepare and develop legal theories and strategies “with an eye toward litigation,” free from unnecessary intrusion by his adversaries,’ — simply do not apply.”

No privilege
In finding the defendant’s AI-generated documents were not protected by the attorney-client privilege, the judge concluded that the materials lacked at “least two, if not three” of the essential elements of the privilege.

First, he found the documents were not communications between the defendant and his attorneys.

“Because Claude is not an attorney, that alone disposes of [the defendant’s] claim of privilege,” Rakoff wrote.

Next, he found that the privilege did not apply because the communications memorialized in the documents were not confidential.

“This is not merely because [the defendant] communicated with a third-party AI platform but also because the written privacy policy to which users of Claude consent provides that Anthropic collects data on both users’ ‘inputs’ and Claude’s ‘outputs,’ that it uses such data to ‘train’ Claude, and that Anthropic reserves the right to disclose such data to a host of ‘third parties,’ including ‘governmental regulatory authorities,’” he wrote.

Rakoff found it to be a “closer call” as to whether the defendant could meet the third privilege element: whether his communication with Claude was for the purpose of obtaining legal advice.

“Had counsel directed [the defendant] to use Claude, Claude might arguably be said to have functioned in a manner akin to a highly trained professional who may act as a lawyer’s agent within the protection of the attorney-client privilege,” Rakoff wrote. “But because [the defendant] communicated with Claude of his own volition, what matters for the attorney-client privilege is whether [he] intended to obtain legal advice from Claude, not whether he later shared Claude’s outputs with counsel. And Claude disclaims providing legal advice.”

In finding the work product doctrine did not protect the defendant’s AI documents, Rakoff once again pointed to the undisputed fact that that the defendant had acted on his own.

“The AI documents do not merit protection under the work product doctrine because, even assuming, arguendo, that they were prepared in preparation ‘in anticipation of litigation,’ they were nevertheless not ‘prepared by or at the behest of counsel,’ nor did they reflect defense counsel’s strategy,” Rakoff stated. “As to the former, [defense] counsel confirmed that the AI Documents ‘were prepared by the defendant on his own volition.’ That means he was not acting as counsel’s agent when he communicated with Claude. As to the latter, counsel conceded that while the AI Documents did ‘affect’ counsel’s strategy going forward, they did not ‘reflect’ counsel’s strategy at the time that [the defendant] created them.”

Lessons to be learned
Echoing Rakoff’s sentiments, Kelly said the work product issue raised in Heppner seemed a closer call.

“A client inputting information about the case into an AI platform could be compared to a client writing down notes or a chronology of what happened for his/her lawyer, in preparation for the case,” Kelly said. “The difference [here], however, is that the client used the AI platform on his own, without direction from counsel, and that it was not a closed AI platform. I believe this was more of a waiver issue than a ruling that the work product doctrine will not apply anytime a client or counsel uses an AI platform to assist with litigation. In fact, I believe lawyers will soon be expected, if not required, to responsibly incorporate AI into their practices, as part of the standard of care.”

Rusek, of Foster Swift, said that although Heppner is not binding authority in Michigan, it highlights the need for attorneys to properly advise clients about potential privilege waivers in all situations.

He noted that the Michigan Rules of Professional Conduct must also be considered when using AI or advising clients on AI, including sections on confidentiality of information, responsibilities regarding nonlawyers assistants, and communication, several others.

“There will absolutely be additional litigation arising from the improper use of AI tools and the resulting waiver of privileges in the future due to the ever-growing use and integration of AI tools into our personal and professional lives,” he said.

Gleeson agreed that the continued use of AI will lead to future lawsuits.

“[Electronically stored information] discovery exploded with the use of emails and text messaging. The same will likely happen here,” he said. “The question will be where the discovery will be targeted: the AI provider [often cloud-based] or the in-house computing systems used to access it. Any query to AI about liability or damage calculations may be … a party admission under the evidence rules.”

For Kelly, the key takeaway is that lawyers need to start having conversations with their clients from the outset about the appropriate use of AI in connection with the representation and the danger that the client’s use of AI may not be privileged and/or may cause a waiver.

“This conversation could be incorporated into the ‘litigation hold’ conversation: ‘Don’t destroy documents and do not input any information about the case or our communications into an AI platform,’” Kelly suggested.

Gleeson said businesses would be wise to train their employees on the legal risks of using AI.

“Just as with texts, emails and other forms of communication … companies should train their employees on the use of AI and what it means from a litigation and business perspective,” he said.

Rusek agreed, noting that Heppner solidifies concerns that people using AI are unknowingly waiving legal privileges and exposing confidential information to the world. The decision is an eye-opener for businesses that don’t have AI training and policies in place, he said.

“This should be a wakeup call to any entity that has not already implemented appropriate AI-focused training and policies,” he added. “If entities have not already taken the proper steps to ensure their employees are trained appropriately and confirmed the terms of use of the AI platforms that their employees use, they should do so post haste. As Heppner exemplifies, failure here can result in very harsh consequences for the uninitiated.”