In February 2026, a federal judge in Manhattan read a defendant’s AI chat history into the record and ruled it fair game for the prosecution. The defendant had typed his defense strategy into Claude after he was indicted and after he had hired a lawyer. The government asked for those exchanges. Judge Jed S. Rakoff said yes, they could have them, because attorney-client privilege never attached to a conversation with a chatbot.
That case, United States v. Heppner, is the first ruling of its kind in the country, and it reframed a question every in-house lawyer is now asking: where does attorney-client privilege and AI overlap, and where does the privilege fall away? For general counsel and legal ops leaders, the privilege turns on three conditions the court named directly, and every one of them is about how the AI is used.
Cecilia Ziniti, the CEO and co-founder of GC AI, was a general counsel three times over, at Anki, Bloomtech, and Replit, and an in-house counsel at Amazon and Cruise before that. She built GC AI to solve the problems she ran into as an in-house lawyer, and privilege was always one of them. The platform’s posture maps to the Heppner test on purpose.
What Attorney-Client Privilege and Work-Product Protection Cover
Attorney-client privilege protects confidential communications between a client and their lawyer made for the purpose of seeking or giving legal advice. Work-product protection is broader and covers materials a lawyer or their agent prepares in anticipation of litigation. Both are old doctrines, and both rest on assumptions that generative AI breaks.
The privilege has always required a lawyer on one end of the conversation. It has always required confidentiality, which means the communication stays inside the attorney-client relationship and does not get shared with an outside party. And it has always required that the purpose be legal advice the client seeks through counsel.
Generative AI strains all three. A chatbot is not a lawyer. A consumer AI account often runs on terms that let the provider read prompts and use them for training. And a lawyer who opens ChatGPT to think through a problem is frequently working alone, not under the direction of counsel in any formal sense, because they are the counsel. None of this was a problem when the doctrines were written. It is a problem now, and Heppner is where a court said so out loud.
United States v. Heppner: The First Ruling on AI and Privilege
In United States v. Heppner, decided February 17, 2026, the Southern District of New York held that written exchanges between a criminal defendant and a generative AI platform are not protected by attorney-client privilege or the work-product doctrine. It is the first ruling in the country to decide the question, and Judge Rakoff is one of the most cited trial judges in the federal system, which means the opinion travels.
Bradley Heppner was indicted in October 2025 on securities fraud, wire fraud, and related counts. After the indictment, and after he retained counsel, he used Claude to draft reports outlining his defense strategy and potential legal arguments. When the government moved to compel production of those AI exchanges, Heppner claimed privilege. The court rejected the claim on three independent grounds, and each ground maps to a question in-house counsel can ask about their own AI use:
The AI was not an attorney, so no attorney-client relationship existed.
The platform’s terms permitted disclosure, so the exchanges were never confidential.
The defendant used the AI on his own initiative, without his lawyers directing it.
Track One: The AI Is Not an Attorney
The court started with the most basic element of the privilege. Attorney-client privilege protects communications with a lawyer, and a generative AI platform is not a lawyer. There is no licensed professional on the other end, no bar membership, no duty of confidentiality running back to the client. A communication with a non-attorney generally cannot be a privileged attorney-client communication, and the court saw no reason to invent an exception for software.
Track Two: Confidentiality Turned on the Platform’s Terms
The second ground was confidentiality, and this is the track that matters most for procurement. At the relevant time, the consumer privacy policy governing Heppner’s use stated that user prompts could be used to train models and could be disclosed to third parties, including the government. Sharing a communication with a party outside the attorney-client relationship waives the privilege. Because the terms of service permitted exactly that kind of disclosure, the court found no reasonable expectation of confidentiality. The privilege failed before it ever attached.
Track Three: Self-Directed Use by the Client
The third ground was purpose. Privilege protects communications made to obtain legal advice through counsel. Heppner used Claude on his own initiative. His lawyers did not direct him to use it, did not supervise the exchanges, and did not treat the AI as part of their legal work. Self-directed use by a client is different from counsel-directed use of an agent, and the court treated that difference as decisive.
The Three-Part Test That Emerged, and the Kovel Workaround
Heppner gives in-house counsel a usable framework. Call it the Rakoff Privilege Test. AI-assisted work has the best chance of staying privileged when three conditions hold:
The AI functions as an agent of counsel. The legal team deploys it, so it works under the attorney the way the Kovel accountant did.
The platform’s terms guarantee confidentiality. The contract bars training on your inputs and disclosure to third parties.
A lawyer directs the use for legal advice. Counsel selects the tool, sets the use cases, and reviews the output.
Fail any one of the three and the privilege is exposed. The same test sorts the two ways a legal team can put AI to work:
The Rakoff Privilege Test | Consumer AI, Used Alone | Counsel-Directed Enterprise Platform |
Is there an attorney or an agent of counsel? | No licensed attorney in the loop; the user works solo | The legal team deploys the AI as its agent under Kovel |
Do the terms guarantee confidentiality? | Terms may permit training on prompts and disclosure to third parties | Contractual no-training, no-disclosure, zero data retention |
Who directed the use? | The user, on their own initiative | Counsel selects the platform, sets the use cases, and reviews output |
The most important sentence in the opinion for legal departments is the one about the Kovel doctrine. In United States v. Kovel, 296 F.2d 918 (2d Cir. 1961), Judge Henry Friendly held that attorney-client privilege can extend to a non-lawyer the attorney retains to help deliver legal advice. The case involved an accountant working for a tax law firm, and Friendly compared the accountant to a translator: accounting was a language as foreign to the lawyer as French, and the privilege covered the translation because it served the legal advice.
Rakoff acknowledged that a generative AI platform could arguably function as a lawyer’s agent under Kovel, if the client used it at counsel’s specific direction and with an appropriate expectation of confidentiality.
That is the operational opening. Counsel-directed AI use, on a platform with contractual confidentiality and no training on the inputs, sits much closer to the Kovel accountant than to the consumer chatbot Heppner used alone. The doctrine that protected a tax accountant in 1961 is the doctrine that can protect an AI-assisted legal workflow today, when the workflow is built the right way.
ABA Formal Opinion 512 and the Three Duties Underneath the Ruling
Heppner is about evidence. The ethics layer is about conduct, and the controlling guidance is ABA Formal Opinion 512, issued July 29, 2024. It was the ABA’s first formal guidance on generative AI, and it grounds the analysis in the existing Model Rules. Three of those duties carry the weight for in-house teams.
The duty of competence under Model Rule 1.1 requires a lawyer to understand the benefits and risks of the technology they use to deliver legal services. A GC who deploys AI without understanding how it handles data is exposed on the same rule that covers any other professional skill gap.
The duty of supervision under Model Rules 5.1 and 5.3 requires lawyers to oversee the work of nonlawyer assistants, and the opinion treats AI outputs as work that needs review. This is the conduct-side mirror of Heppner’s third track: a lawyer in the loop is both an ethics requirement and a privilege strategy.
The duty of confidentiality under Model Rule 1.6 requires a lawyer to keep client information confidential regardless of its source, and the opinion is specific that lawyers must know how an AI platform uses data and put safeguards in place against unauthorized disclosure. This is the conduct-side mirror of Heppner’s second track. The ethics rule and the evidentiary rule point at the same control. Read the terms, confirm the data stays in, and document it.
How In-House Counsel Preserve Privilege With AI in Practice
The path from the ruling to daily practice runs through four moves. All four keep AI in the workflow. Each deploys it the way the Kovel accountant was deployed: at counsel’s direction, under confidentiality, for legal advice.
Deploy AI at the direction of counsel. The cleanest way to satisfy Heppner’s third track is for the legal department to own the deployment. When the legal team selects the platform, sets the use cases, and runs the workflows, the AI operates as an agent of counsel under the lawyer’s direction. Document the policy so the agent-of-counsel posture is visible if it ever gets tested.
Choose an enterprise or commercial tier. The privacy policy is the pivot in Heppner’s second track. Consumer accounts that reserve the right to train on prompts or disclose them to third parties cannot support a reasonable expectation of confidentiality. Enterprise and commercial agreements that contractually bar training on your inputs and prohibit third-party disclosure are a different posture entirely. The tier is the whole ballgame, which is why evaluating the best legal AI tools for in-house counsel starts with the data terms in the contract.
Put confidentiality in the contract itself. The protection that counts is the one a court can read: a written commitment that the provider will not train on your data, will not disclose it, and will delete it on request. A promise in a sales deck does not survive a subpoena. Confirm the term in the contract and keep the executed copy.
Keep a lawyer in the loop and verify the output. Supervision under Rules 5.1 and 5.3 and the verification habit that prevents the Mata v. Avianca problem are the same discipline. A lawyer reviews the AI’s work, confirms the citations, and applies judgment. That review reinforces the agent-of-counsel posture and catches the errors that have sanctioned lawyers who filed AI output unchecked.
Ritesh Patel, Chief Legal Officer at Viant Technology, runs that lawyer-in-the-loop pattern as his default:
“I use it for research and issue spotting. If there’s an HR or privacy question, I’ll run it through GC AI first. Before, I’d call outside counsel and pay by the hour for a generic answer. Now, I can analyze it myself, see where it gets me, and call outside counsel if I’m truly out of depth.”
The first pass happens inside a platform built for legal work. The judgment stays with the lawyer.
None of this waits for a policy overhaul. A legal team can close the gap inside one quarter:
This week: inventory which AI tools the team uses and on what tier, so the consumer-tier exposure is visible.
This month: move legal-adjacent work onto one platform the legal department selects and supervises.
This quarter: get the no-training, no-disclosure, delete-on-request terms into the contract and keep the executed copy.
Waiver Traps and the Consumer-Tier Discoverability Problem
A ruling like Heppner can make AI feel like a liability to keep at arm’s length. Danielle Sheer, Chief Trust, Legal and Compliance Officer at Commvault, named that fear directly on CZ and Friends, GC AI’s podcast hosted by CEO Cecilia Ziniti:
“I was scared of AI. I was scared of what it meant for our profession… Just take that fear head on.”
For a legal department, taking it head-on starts with knowing where the privilege leaks.
The fastest way to lose privilege is to never have it. Consumer AI tiers are the most common trap, because the terms of service do the waiving before a single prompt is typed. When a privacy policy permits training on prompts or disclosure to third parties, there is no confidential channel for the privilege to protect, which is precisely the reasoning in Heppner’s second track. Pasting information that is already privileged into a consumer tool runs the same risk in the other direction, because sharing it with a party outside the attorney-client relationship can waive the protection it had. And the waiver cannot be undone by routing: forwarding a chatbot exchange to a lawyer after the fact does not make it privileged, because the disclosure has already happened.
Discoverability is the consequence. AI chat logs are records, and records get subpoenaed. A defendant’s self-directed Claude history became a government exhibit in Heppner.
A business user pasting deal terms into a free chatbot is creating the same kind of record, sitting on a third-party server, governed by terms that may permit disclosure. For a regulated company, that is an evidentiary exposure that has nothing to do with whether the AI gave good advice.
Two habits keep the traps closed. First, route legal-adjacent AI work through the legal department’s approved platform.
Shadow AI use by sales, HR, or finance, in whatever tab they happen to have open, is where the privilege leaks.
Second, treat the question “is ChatGPT privileged” as a question about the account tier and the contract, because that is what the court treated it as. The deciding variable is the terms and the tier, the same analysis that decides whether ChatGPT is confidential in the first place.
How GC AI Is Built for the Rakoff Test
GC AI is a legal AI platform purpose-built for in-house counsel, used by 1,800+ legal teams across 53 countries, including legal departments at TIME, Liquid Death, Snyk, and Columbia Sportswear, plus 80+ public companies and 25 unicorns. The platform’s posture was designed around the same questions the Heppner court asked, which is why the ruling reads like a build specification.
Ziniti designed it that way deliberately. Having sat in the general counsel seat three times, she built the confidentiality controls around the question every in-house lawyer asks before a tool touches a privileged matter. Where does my data go, and who can read it?
On the confidentiality track, the controls are contractual and specific. GC AI is SOC 2 Type II and SOC 3 certified, GDPR compliant, with zero data retention agreements with OpenAI and Anthropic, and AES-256 encryption. The platform does not train on customer inputs, and customer data sits in segregated databases. That is the difference between a consumer policy that reserves training rights and an enterprise posture that contractually forecloses them. The GC AI security page cites Heppner directly for this reason.
On the counsel-directed track, GC AI is deployed by the legal department for legal workflows: contract review, research, drafting, issue spotting. It is the legal team’s own platform, selected by counsel and run for legal advice, which is the agent-of-counsel posture the Kovel doctrine rewards. Playbooks, GC AI’s reusable review standards that capture how a team wants contracts handled, and verifiable citations keep a lawyer in the loop by design.
KT Farley, Chief Privacy Officer and Associate General Counsel at Helix, frames the fit for a privacy-first legal department in one line:
“It’s cost-effective, fine-tuned for attorneys, and the cost of a license is a couple of hours of outside counsel time.”
For a lawyer whose whole job is data handling, a platform that handles data the way the privilege requires is the baseline, and the productivity is the bonus.
GC AI also teaches the discipline that keeps privilege intact. Our free legal AI classes, taught by former general counsels and California CLE-eligible, cover the prompting, supervision, and verification habits that satisfy both the ethics duties and the privilege test.
More than 6,000 lawyers have completed them. The same habits carry over to everyday tools like ChatGPT for lawyers and Claude legal AI, and the Heppner ruling analysis breaks down the opinion in full.
Start With the Three Questions That Decide Privilege
Before the next deal closes or the next strategy memo gets drafted with AI, run your stack through the Rakoff Privilege Test: Is the AI deployed at the direction of counsel? Does the contract guarantee confidentiality and bar training on your inputs? Is a lawyer reviewing the output? A platform built for in-house legal work answers all three by design.
See how GC AI handles privileged legal work on your own matters, no credit card required.
Frequently Asked Questions
Is ChatGPT Privileged When a Lawyer Uses It for Legal Work?
Not on its own. United States v. Heppner held that AI chat exchanges are not protected by attorney-client privilege when the platform’s terms permit training on prompts or disclosure to third parties, and when the use is self-directed by the client. Whether ChatGPT exchanges can be privileged depends on the account tier and the contract: a consumer tier that reserves training rights cannot support confidentiality, while an enterprise agreement with zero data retention and counsel-directed use sits much closer to the Kovel agent-of-counsel standard.
Does ChatGPT Enterprise or Another Enterprise AI Tier Change the Privilege Analysis?
An enterprise tier strengthens the confidentiality track, because the terms typically bar training on your inputs and disclosure to third parties. Counsel direction is the other half of the analysis: the platform still has to be deployed by the legal team for legal work, with a lawyer reviewing the output, so the use stays counsel-directed under Kovel. A secure tier used without counsel direction, or counsel direction on a leaky consumer tier, leaves one of Heppner’s three tracks exposed.
What Did United States v. Heppner Decide About AI and Privilege?
Decided February 17, 2026 by Judge Jed S. Rakoff in the Southern District of New York, Heppner is the first ruling in the country to hold that written exchanges with a generative AI platform are not protected by attorney-client privilege or the work-product doctrine. The court gave three independent reasons: the AI is not an attorney, the consumer terms of service permitted disclosure so there was no reasonable expectation of confidentiality, and the defendant used the AI on his own initiative, with no direction from counsel.
What Three Conditions Keep AI-Assisted Work Privileged?
AI-assisted work has the best chance of staying privileged when the deployment satisfies the three conditions Heppner named. Counsel should own the deployment so the AI functions as an agent of counsel, use an enterprise or commercial platform with contractual confidentiality and no training on inputs, and keep a lawyer in the loop to review the output. This mirrors the Kovel doctrine, under which attorney-client privilege extends to a non-lawyer agent the attorney directs to help deliver legal advice.
What Is the Kovel Doctrine and How Does It Apply to AI?
The Kovel doctrine extends attorney-client privilege to a non-lawyer an attorney retains to help deliver legal advice, named for United States v. Kovel, where the Second Circuit protected an accountant working under a tax law firm. Applied to AI, it is the opening Heppner left: when counsel directs the use of an AI platform, on confidential terms, for legal advice, the AI can function as the lawyer’s agent the way the Kovel accountant did, and the privilege has a path to attach.
Does ABA Formal Opinion 512 Say Lawyers Can Use Generative AI?
Yes, with duties attached. ABA Formal Opinion 512, issued July 29, 2024, applies existing Model Rules to generative AI and permits its use with duties attached. The three duties that matter most for in-house teams are competence under Rule 1.1, supervision under Rules 5.1 and 5.3, and confidentiality under Rule 1.6, which requires lawyers to understand how an AI platform handles data and to put safeguards in place against unauthorized disclosure.
How Does GC AI Protect Attorney-Client Privilege?
GC AI is built around the same confidentiality and counsel-direction controls the Heppner court analyzed. It is SOC 2 Type II and SOC 3 certified, GDPR compliant, with zero data retention agreements with OpenAI and Anthropic, and AES-256 encryption, and it does not train on customer inputs. Deployed by the legal department for legal workflows, with verifiable citations and a lawyer-in-the-loop, GC AI operates as an agent of counsel, which is the posture the Kovel doctrine and ABA Formal Opinion 512 both reward.
Can AI Chat Logs Be Subpoenaed or Used in Court?
They can be. AI chat exchanges are records that can be subpoenaed, and in Heppner the defendant’s self-directed Claude history became a government exhibit. Work done on a consumer tier governed by terms that permit disclosure carries the highest exposure, while counsel-directed work on an enterprise platform with contractual confidentiality and zero data retention is far better positioned to claim and keep the privilege.
Does Typing Privileged Information Into a Consumer AI Tool Waive Privilege?
Yes. Under the reasoning in United States v. Heppner, a consumer AI platform’s terms of service typically let the provider collect, use, and in some cases disclose user inputs, so the expectation of confidentiality can dissolve the moment privileged facts are typed into the tool. Forwarding the resulting output to a lawyer afterward does not restore the protection, because the disclosure to an outside party has already happened.
How Can In-House Legal Teams Limit Privilege Risk From Shadow AI Use?
Shadow AI, meaning employees in sales, HR, or finance using consumer AI tools without legal’s involvement, can expose privileged information because those exchanges sit outside counsel’s direction and confidentiality controls. Legal teams reduce the risk by routing legal-adjacent work through one platform the legal department selects and supervises, choosing an enterprise tier with contractual confidentiality terms, and keeping a lawyer in the loop to review output before it is relied on or shared.
