Claude for Legal: Pros, Cons, and Privilege (2026)

On May 12, 2026, Anthropic launched Claude for Legal, an open-source suite of practice-area plugins and workflow agents. For in-house counsel, the question is whether they can trust it with privileged, confidential work.

On February 17, 2026, Judge Jed S. Rakoff of the Southern District of New York ruled in United States v. Heppner that a criminal defendant's written exchanges with Claude carried neither attorney-client privilege nor work product protection. The case is the first-impression precedent for Claude legal AI use, nationwide in effect.

Heppner is the first nationwide privilege ruling against generative AI use by a represented party. For in-house teams, that makes Claude's deployment model the practical issue.

GC AI is the legal AI enterprise software Cecilia Ziniti built for the kind of in-house counsel she used to be at Anki, BloomTech, and Replit. We use Anthropic's models among others, which means we know where Claude shines for in-house legal work and where the gaps still need closing.

Can In-House Counsel Use Claude AI for Legal Work?

Yes, with the same caveats every generative AI platform now carries. ABA Formal Opinion 512, issued July 2024, confirmed that generative AI use by lawyers is permissible under existing ethics rules, so long as counsel maintains three duties: competence, supervision, and confidentiality.

State bars have built on the same framework. California, New York, Florida, and the D.C. Bar all anchor their guidance on those three pillars.

The hard part is the duties themselves. Competence means understanding what Claude can and cannot do, including hallucination patterns and jurisdictional blind spots. Supervision means treating Claude output like a sharp intern's draft, something to be checked rather than signed. Confidentiality means knowing what happens to the text you paste, where it lives, who can read it, whether the platform trains on it, and whether your subscription tier carries enforceable confidentiality terms.

Lawyers can use Claude well when the duties hold. The duties carry the work.

Four Rules for Using Claude Legal AI Safely

Four rules govern the safe use of Claude legal AI for in-house work. None of them are new. All of them carry more weight after Heppner and the August 2025 Anthropic policy shift.

1. Choose the right tier, and elect the right setting: For privileged, regulated, or client-identifying work, deploy on Claude for Work or a legal AI platform built on the Commercial Terms posture. For any consumer-tier use that touches sensitive content, confirm the user did not opt in to model training under the August 2025 update.

2. Document the deployment as counsel-directed: The privilege analysis after Heppner turns on whether the AI functions as an agent of counsel. Counsel-directed use on a platform with enforceable confidentiality is the path the court left open. A short policy memo from the GC office naming the platform and workflow documents that direction.

3. Verify every citation against a primary source: Verify against Westlaw, LexisNexis, Casetext, the official code, or the actual contract. Claude hallucinates. Counsel signs what counsel verifies, and the verification step is the workflow.

4. Match the scope to the model: Long-context document analysis plays to Claude's strength. Niche jurisdictional analysis sits outside that strength. Use Claude on the work it is built for, and pair it with a legal-specific platform on the work that requires playbook context, team templates, and verifiable citations.

What Claude Does Well for Legal Work

Three Claude strengths matter for in-house work: long context, writing quality, and reasoning across documents. Anthropic built Claude on a long-context model with a writing style that lawyers find unusually compatible with how legal documents read.

Anthropic's framework: Per Anthropic's model documentation, Claude Opus 5.5 offers a one-million-token context window and up to 128,000 output tokens. That capacity lets teams work across a large deal binder or related contract set in one request, but it does not replace citation checks or data controls. Anthropic launched Claude Opus 5.5 on September 22, 2026, as its current Opus model for long-running coding and knowledge work. Claude.ai behavior varies by plan and model.

Writing quality: Claude produces prose that reads as drafted by a senior associate. For client memos, executive summaries, and translating dense regulatory text into business-readable English, the first draft typically requires light editing rather than rewriting.

Reasoning across documents: Long-context reasoning means Claude can hold a contract and a playbook in the same window and identify deviations clause by clause. Used carefully and reviewed properly, that workflow saves hours on first-pass NDA review.

In-house teams get real value from Claude on the following work, used safely:

• Summarizing a 60-page diligence memo into a three-bullet executive version

• Drafting a first pass at a regulatory update for engineering or product leads

• Issue-spotting in a contract as a second set of eyes on a clause counsel has already reviewed

• Outlining a brief or a board memo before counsel fills in the citations

• Translating dense statutory text such as GDPR Article 28, DGCL 203, and the EU AI Act into plain English

• Generating training outlines, interview questions, or framework sketches for internal legal education

What unites these use cases is that a competent in-house lawyer reviews the output before anything moves. That review is the entire game.

When Claude Searches Instead of Reads

Claude can help with legal work, but one recurring failure mode matters:

Cecilia Ziniti shared a story from Rupert Goodway, Of Counsel at Quinn Emanuel. He asked Claude whether a contract allowed termination at will, and it confidently told him there was no such clause. Claude had not read the contract. It had run a keyword search, a coder's tool it called “grep,” essentially Claude's version of Ctrl-F, found nothing matching, and reported that the right did not exist.

A termination-at-will right is rarely drafted in those words. It might appear as “terminate for convenience” or “on thirty days' notice.” “I did not find the keyword” is not the same as “the contractual right does not exist.” That difference matters in a legal AI.

The fix is manual: insist that Claude reads the whole document, then confirm that it did. As Cecilia put it:

No shade on Claude. I still use it for math, personal things, and various other things, but now that GC AI has connectors, I use it less and less.

Catching exactly this kind of thing is what purpose-built legal AI is built for.

What United States v. Heppner Changed for Claude Users

For any lawyer using Claude, Heppner is the 2026 update that changes the playbook.

The fact pattern was specific. Bradley Heppner was indicted in October 2025 on securities and wire fraud, conspiracy, false statements to auditors, and falsifying corporate records. After indictment, and after retaining counsel, Heppner used Claude to prepare reports outlining his defense strategy and potential legal arguments. The government moved to compel production of those Claude exchanges. Judge Rakoff held oral argument on February 10, 2026, and ruled on February 17, 2026, that the exchanges were neither privileged nor protected work product.

The case did not end with the privilege ruling. On May 7, 2026, a jury convicted Heppner on all counts after a three-week trial in which prosecutors introduced his Claude exchanges as evidence. Sentencing is set for October 7, 2026. The discoverability risk the ruling named is now a trial record.

Rakoff's reasoning ran on three tracks. First, the AI is not an attorney, so communications with it cannot be attorney-client privileged on their face. Second, the confidentiality prong failed on the terms of service in effect at the time. Third, Heppner's counsel had not directed him to use Claude, and self-directed client use is not a counsel-directed channel.

The court left one door open. Under the Kovel doctrine, which extends privilege to accountants, translators, and other agents retained by counsel to help render legal advice, Rakoff acknowledged that counsel-directed use of AI on a platform with contractual confidentiality might preserve privilege. That is the operational path purpose-built legal AI platforms are designed to support.

For the full breakdown of the ruling and what it means day to day, see our Heppner deep dive. The practical takeaway is narrow but actionable: if your Claude use does not satisfy all three Rakoff prongs, assume the chat is discoverable. Outside the Southern District of New York, the ruling is persuasive rather than binding, and commentators, including the Harvard Law Review, have argued for a more fact-specific confidentiality inquiry. Until an appellate court weighs in, the conservative read is the operating assumption.

Anthropic's August 2025 Policy Shift, and Why It Matters Post-Heppner

Anthropic's August 2025 consumer Claude policy shift changed how Claude legal AI use intersects with Heppner prong two. Coverage of Heppner tends to skip this part of the analysis.

On August 28, 2025, Anthropic updated its consumer Claude terms and introduced a user choice to share chat and coding-session data for model training. Users who opt in get five-year retention on the data they share. Existing users had until October 8, 2025 to make their selection to continue using Claude. Anthropic's privacy center confirms the posture.

The Commercial Terms tier kept the same posture. Claude for Work, Claude for Government, Claude for Education, and API use remain no-train, with separate enterprise data handling. Anthropic was explicit on this distinction.

Here is what this means for Heppner prong two:

• Free or Pro Claude with opt-in to model training: Chats train the model and live in Anthropic's systems for five years. Heppner prong two fails on the face of the terms.

• Free or Pro Claude with opt-in declined: Standard retention, no training. Better, and still subject to consumer-tier indemnities and terms.

• Claude for Work or API: No training, enterprise data handling, contractual terms negotiable. This is the closest a raw Claude deployment gets to satisfying Heppner prong two, and the configuration is the customer's responsibility.

The consumer tier serves general consumer needs. Privileged legal work needs different scaffolding.

Claude for Word: What Anthropic Launched in April 2026

On April 11, 2026, Anthropic launched Claude for Word in public beta, with legal contract review as the headline use case. Lawyers can invoke Claude inside Microsoft Word to summarize commercial terms, flag off-market clauses, and work through reviewer comments without leaving the document. It was the first sign of what arrived in full a month later.

Hayley McAllister, Senior Counsel and Head of Commercial Legal at Jasper, put it plainly:

Once the Word plugin rolled out, I pretty much exclusively started using it for all of my redlining and contract review.

For an in-house lawyer who lives in Word, the live question is whether the AI shows up with the team's templates, playbooks, and prior context already loaded. For a side-by-side on the in-house deployment, see GC AI for Word.

Claude for Legal: What Anthropic Shipped in May 2026, and the Privilege Question Nobody Is Answering

On May 12, 2026, Anthropic launched Claude for Legal, an open-source suite of 12 practice-area plugins, more than 90 named workflow agents, and data connectors. The named agents handle jobs such as vendor-agreement review, DSAR response, termination review, and claim-chart building. Compared with the April beta, it is a broader move toward legal workflows.

What Claude for Legal gets right: According to Anthropic's repository, each plugin runs a cold-start interview to learn your playbook and create a practice profile that every skill reads.

The suite connects to Ironclad, iManage, DocuSign, Everlaw, CourtListener, and Westlaw through Thomson Reuters CoCounsel. Every contract-touching skill works in the Claude for Word sidebar with tracked changes, and one thread can span Word, Excel, PowerPoint, and Outlook.

The plugins are open source under Apache 2.0. Since launch, the repository has added a Thomson Reuters CoCounsel partner plugin, a community legal-builder hub with a security-review layer for third-party skills, and Managed Agents templates for scheduled watchers, including renewal-watcher and docket-watcher, without a lawyer at the keyboard.

Where the gap is for an in-house team. Claude for Legal is infrastructure the customer assembles. The team installs Claude Cowork or Claude Code, chooses plugins, connects systems, runs a cold-start interview for each practice area, and maintains the profiles. The plugins are free, but Cowork still requires a paid Claude plan. The choice is whether to assemble and maintain these workflows or buy a legal AI platform.

Cecilia framed the build-or-buy choice this way in a June 2026 founder interview:

It's the ability to build my own car. I have that ability right now. But when was the last time you changed your own oil? Never. You go to Jiffy Lube.

The community reaction followed the same line. In the r/legaltech discussion practitioners said the model plus the Model Context Protocol was the value, while the launch exposed overpriced wrappers. One practitioner raised the security question directly: “I can't feed in my docs unless I know it's completely locked down and my company has its own walled garden. I'll keep waiting.” Another summarized the buying logic: “Companies don't buy software, they buy trust.”

Tricia Kinney of BlueLinx draws the line in-house teams keep landing on:

I am a huge fan of using legal specific AI tools as opposed to consumer specific AI tools. You want them training in the same context that we're operating in.

What the benchmark shows. GC AI's In-House Legal Bench (May 2026) tested 100 in-house legal tasks against an answer key averaging 12 criteria built by attorneys with more than 80 combined years of practice. The models landed in this order:

AI tool	In-House Legal Bench pass rate (answer-key criteria across 100 tasks, May 2026)
GC AI	86.8%
ChatGPT (GPT-5.5)	79.8%
Claude (Opus 4.7)	68.4%
Gemini (3.1 Pro)	57.5%

Source: GC AI In-House Legal Bench, May 2026.

That May 2026 result predates Opus 5.5, so treat it as a dated benchmark rather than a current model score.

Anthropic's own repository states the point directly. Every plugin includes the disclaimer that its output is “a draft for attorney review, not legal advice, not a legal conclusion, not a substitute for a lawyer,” and its guardrails apply “conservative defaults on privilege.” The repository states that “the attorney using the plugin, not the plugin, and not Anthropic, is responsible for the legal positions taken in their work product.”

Running the Heppner Three-Part Test on Claude for Legal

Claude for Legal gives you a workflow, not a privilege result. Apply the same three-part analysis to its deployment.

• Prong one, the AI is not an attorney. A plugin does not make Claude your lawyer.

• Prong two, confidentiality. Claude for Legal can run as a Cowork plugin, a Code plugin, or the Managed Agents API. Consumer-tier Cowork carries the posture that failed in Heppner. The Managed Agents API on Anthropic's Commercial Terms can satisfy prong two when the customer configures it correctly.

• Prong three, counsel-directed. The plugins automate the workflow but do not document that counsel directed the use, which the Kovel path requires.

Molly Abraham at Coinbase put the confidentiality stakes plainly:

A non-lawyer asking an LLM for legal advice, that LLM is not necessarily their lawyer. If something ingests your confidential information and can spit it out, even in a transformed state, that's still your confidential information.

Claude's Model Line Keeps Changing

Anthropic launched Claude Opus 4.8 on May 28, 2026, citing Legal Agent Benchmark results and CoCounsel improvements. Claude Fable 5 launched June 9, was suspended under US export controls on June 12, and returned on July 1 with a classifier routing flagged requests to Opus 4.8. Its plan and usage-credit terms changed again in July. Claude Opus 5 launched July 24 with reported gains in legal-agent work, then logged about an hour of elevated errors on July 27.

Anthropic launched Claude Fable 5.1 alongside Claude Mythos 5.1 on September 1, 2026, opening again with a legal proof point: Crosby's Raymond Lin, Member of Technical Staff, reported on RedlineBench, Crosby's contract-redlining benchmark:

Compared to Fable 5, Claude Fable 5.1 was a massive improvement on RedlineBench, our contract redlining benchmark, improving from 47.9 to 57.0. Most of the gain came on first-turn quality, where it doubled the previous score, with substantial gains on counterparty acceptance as well. Its edits were also more concise, with smaller changes on average to the documents.

Claude Opus 5.5 arrived on September 22, 2026, as Anthropic's current Opus model and the first Claude 5.5 model. Anthropic lists a one-million-token context window, adaptive thinking, and API pricing of $4 per million input tokens and $20 per million output tokens. It also reports gains on general-work and safety evaluations. Those results speak to general work and safety. Evaluate legal accuracy, confidentiality, and privilege separately.

From late May to late September, Anthropic changed models, export-control status, plan limits, service reliability, and enterprise data handling. Treat model scores, context limits, and data-handling terms as time-sensitive.

Enterprise Frontier Safeguards (EFS) arrived with Fable 5.1. It lets customers hold their data on their own cloud infrastructure, with human review defaulting to the customer rather than Anthropic. EFS is opt-in, and customers must set up that infrastructure. Its phased rollout starts this fall across Claude Code, Claude Enterprise, Claude Platform, and Anthropic's cloud partners.

A platform layer absorbs this recurring work: when the model under GC AI changes, the team's playbooks, citations, and privilege posture stay put.

How a Claude-Powered Legal AI Platform Closes the Gap

As of September 2026, 2,100+ legal teams use GC AI, including 300+ public companies and 25+ unicorns. GC AI adds the in-house counsel layer Anthropic does not provide, with a privilege posture designed around the Rakoff three-part test.

GC AI is SOC 2 Type II and SOC 3 certified, GDPR compliant, and uses AES-256 encryption. GC AI works with leading AI providers such as OpenAI and Anthropic. None of our providers train on your data, and GC AI maintains zero-data-retention agreements with LLM providers wherever feasible.

These protections apply to every customer tier, including non-enterprise plans. On top of that infrastructure, the platform layer adds:

• Files stores contracts, templates, playbooks, and prior matters across sessions.

• Projects carries matter context across conversations, so later lawyers can continue the work.

• Custom Company Profile applies the team's voice, templates, and standards to outputs.

• Playbooks includes pre-built workflows for NDAs, DPAs, and MSAs for SaaS and commercial purchases, with agentic execution.

• Exact Quote extracts character-level text from uploaded documents and links claims to the source line.

• Easy Prompt turns plain-language requests into legally optimized prompts.

• GC AI for Word brings Chat2 web research, Skill Library workflows, Files, Projects, and Easy Prompt into Microsoft Word.

• US Case Law searches 14M+ federal and state court opinions, reads full opinions, and flags whether a case is still good law. Citations link to the full opinion. GC AI also offers International Law, with case law and legislation from 30+ jurisdictions across Europe, Asia-Pacific, and Latin America.

Danielle Sheer, Chief Trust Officer at Commvault, said it directly on the CZ and Friends podcast:

What would be really helpful is if there was an entire universe that was like ChatGPT, but built for and made for the legal world and the compliance world: GC AI.

The product difference is the layer around the model: matter context, workflows, and cited research.

Claude vs GC AI for In-House Legal Work: Side by Side

Axis	Consumer Claude (Free / Pro / Max)	Claude for Work / API	Claude for Legal (plugins, May 2026)	GC AI
Training on data	Trains only when user opts in (August 2025 update); five-year retention on opted-in data	No training; enterprise data handling	Inherits the tier it runs on: consumer Cowork or Commercial Terms API	No provider training; zero-data-retention agreements with LLM providers wherever feasible; data isolated per tenant
Citations	Plausible summaries; no character-level verbatim citations as of May 2026	Same as consumer	Source attribution with research-connector verification (CourtListener, Westlaw via CoCounsel); citations flagged for review without a connector	Character-level verbatim citations from uploaded documents
Workflow context	Starts cold every session	Starts cold every session	Per-plugin practice profile from a cold-start interview, plus Cowork file access	Persistent context across sessions, matters, and team templates
_Heppner_ posture	Fails all three Rakoff prongs	Satisfies prong two when correctly configured	Tracks the tier it runs on; the plugins do not change the privilege analysis	Designed for all three prongs through counsel-directed deployment, contractual confidentiality, and agent-of-counsel posture

Sources: GC AI's In-House Legal Bench (May 2026), Anthropic's consumer terms, and Anthropic's Commercial Terms.

In-house teams switch when privileged work is routine, client data falls under a regulated framework such as HIPAA, GDPR, CCPA, or GLBA, or the team needs matter context across conversations.

For readers weighing ChatGPT instead, see the sister analysis at ChatGPT for lawyers. For the comparison page, see GC AI vs Claude.

Try GC AI for In-House Legal Work

See how GC AI puts the in-house legal layer to work.