AI and Attorney-Client Privilege: What the Heppner Ruling Means for Lawyers Using AI

A federal court has now held that a defendant's exchanges with an AI tool are not protected by attorney-client privilege, and that the AI itself cannot form a privileged relationship with the user. Two other recent federal rulings have extended work-product protection to a party's own AI use, but only in pro se settings, and no court has yet held that an attorney's AI use is privileged or protected as work product. The combined effect for the working lawyer is that the rules of privilege and protection are being written in real time and the conservative posture is no longer optional.

I am a Florida trial lawyer who writes about AI in legal practice for a national audience. This article is for the practitioner who uses AI in client matters and wants to know what the recent rulings mean for confidentiality, privilege, and discovery exposure. It is not legal advice. The case law in this area is moving quickly, and the controlling authority depends on jurisdiction.

Educational only. Not legal advice. I am a Florida trial lawyer, licensed only in Florida. Reading this article does not create an attorney-client, fiduciary, or advisory relationship. The rulings cited here are recent and the law is unsettled. The protection that applies in your jurisdiction depends on the federal circuit, state law, and the specific facts of the matter. Consult counsel familiar with the privilege law of the relevant jurisdiction before relying on any of the structural conclusions in this article.

What Heppner held

In United States v. Heppner, decided in February 2026 in the Southern District of New York, Judge Rakoff addressed whether documents a defendant had created using an AI tool, and the underlying exchanges with the tool, were protected by the attorney-client privilege. The defendant had used Claude to generate documents in connection with the matter. The government sought production of the underlying AI exchanges. The defendant asserted attorney-client privilege.

The court rejected the privilege claim on three independent grounds.

First, the AI exchanges were not communications with an attorney. The privilege protects confidential communications between a client and the client's lawyer, made for the purpose of seeking or providing legal advice. An AI tool is not a lawyer, and the court reasoned that the defendant could not maintain that Claude was an attorney or that the AI could form a privileged relationship with the user. The relationship that the privilege requires simply did not exist between the user and the tool.

Second, even if the exchanges had occurred with an attorney, the participation of the AI tool would have broken any privilege that existed. The privilege protects communications made in confidence and within the attorney-client relationship; sharing those communications with a third party defeats the privilege. The court treated the AI provider as a third party for these purposes.

Third, the documents the AI had generated were the product of the user's own work, not the protected output of an attorney's legal advice. Whatever protection the documents might have qualified for under a different theory, attorney-client privilege was not the right theory.

The ruling is narrow in the sense that it addresses a specific factual setting where a defendant used a consumer-tier AI tool to generate documents. It is broad in the sense that the three independent grounds make the holding hard to distinguish. Each ground would be sufficient on its own, and a litigant who wanted to preserve privilege over AI exchanges in a similar factual posture would have to overcome all three.

The pro se work-product rulings

Two other federal courts addressed adjacent questions in early 2026 and reached results that are not in tension with Heppner but apply to a different setting than the one most working lawyers occupy.

In Warner v. Gilbarco, decided in the Eastern District of Michigan in February 2026, the plaintiff was proceeding pro se in an employment-discrimination action. The court denied a motion to compel the plaintiff's AI-related materials, holding that a pro se litigant's use of AI did not waive work-product protection because AI platforms function as tools, not as persons. The protection ran to the litigant's own preparation of her case.

In Morgan v. V2X, decided in the District of Colorado in March 2026, the litigant was again pro se. The court held that a pro se litigant's AI use in litigation preparation is protected work product under Rule 26(b)(3). The court also imposed a protective-order restriction: no party could upload confidential information into an AI tool unless the provider was contractually prohibited from training on, retaining, or disclosing the data.

What Warner and Morgando not do is decide whether an attorney's use of AI in case preparation is protected work product. Both cases involve a party's own AI use, not counsel's. The doctrinally precise read is that Warner and Morgan stand for the proposition that interaction with an AI provider does not, by itself, automatically waive work-product protection. They do not extend that protection to attorney-directed AI workflows.

Heppner itself flagged the open question. The court noted that a counsel-directed AI arrangement, structured along the lines of United States v. Kovelwhere the lawyer directs a non-lawyer agent as part of the legal representation, was a path it was not deciding. The Kovel-type arrangement is the conceptual frame courts may eventually use to extend privilege or work-product protection to lawyer-supervised AI use, but no court has yet held that an attorney's AI use is privileged or protected as work product on that theory. As of this writing, attorney AI use sits in unsettled territory.

Attorney-client privilege and work-product doctrine are distinct protections. Privilege protects confidential communications between client and counsel; work product protects materials prepared in anticipation of litigation. The two doctrines operate independently. The current authority says client-AI exchanges are not privileged under Heppner, pro se litigant AI use can be protected work product under Warner and Morgan, and attorney-directed AI use is the open question.

What the rulings mean for client communications

The single sharpest implication of Heppner is that a client who uses an AI tool to prepare documents or work through a legal problem does not get attorney-client privilege over that exchange.

That changes the landscape in several ways.

A client who uses an AI tool before retaining counsel is creating a record that may be discoverable in subsequent litigation. The conservative posture is to advise clients early in any matter that their pre-retention AI exchanges may be subject to discovery and that they should not assume those exchanges are confidential.

A client who is encouraged by counsel to use an AI tool during a representation is creating a record that probably is not privileged. The exchange does not gain the protection of the attorney-client relationship just because the client is the lawyer's client; the privilege requires a communication with the lawyer, not a communication facilitated by the lawyer.

A client who shares confidential matter material with an AI tool may be waiving privilege over the underlying material. That risk is not new in concept. Sharing privileged material with a third party has always risked waiver. What the AI ruling does is treat the AI provider as a third party for these purposes, with all the consequences that classification carries.

The implication for engagement letters and intake practice is concrete. Lawyers who handle matters where confidentiality is sensitive should now affirmatively warn clients about pre-retention AI use, and should think hard about whether to encourage or facilitate client AI use during the representation.

What the rulings mean for attorney AI use

Attorney use of AI tools sits in a different posture from client AI use, but the case law has not yet drawn a clear protective line. The structure that emerges from a careful read of all three cases looks like this.

Attorney communications with the client remain protected by attorney-client privilege under the ordinary rules. AI tools do not change that.

Attorney use of AI tools as part of case preparation is the open question. Warner and Morganprotect a pro se litigant's own AI use; they do not hold that an attorney's AI use is work product. Heppner explicitly left open a Kovel-type arrangement in which the lawyer directs the AI use as a non-lawyer agent of the representation. No court has yet ruled that arrangement protected. The conservative read is that attorney AI use may eventually qualify as work product, particularly in a Kovel-style structure, but the protection is not yet established and a lawyer who relies on it is running ahead of the case law.

Attorney AI exchanges that include client confidences are still subject to the underlying confidentiality rules under Rule 1.6 regardless of how the privilege or work-product question comes out. Confidentiality and privilege are distinct duties. An exchange can fail the privilege test, leave the work-product question unresolved, and still be a Rule 1.6 violation if the lawyer did not exercise reasonable diligence in protecting the client information.

Attorney AI exchanges that occur on a tier without enterprise-grade data protections are at the highest risk. Consumer-tier products often retain inputs for model training. Inputs retained for training may be accessible to the provider's employees under various circumstances. The combination of third-party retention and the Heppner analysis means that consumer-tier use of AI for client matters is the highest-exposure posture available.

How to structure AI use to preserve protection

A working lawyer who wants to use AI tools without losing the protections that the rules permit can do several things.

Use enterprise or API tier products with zero-retention or no-training commitments. The major providers offer business-tier products with stronger data protections than the consumer tiers. The terms vary, and they change. The lawyer who is using AI in client matters has to know what tier they are on and what that tier means for retention, training use, and provider access.

Use the AI for attorney work product, not as a stand-in for attorney communications with the client. Standalone client AI use is the unprotected category under Heppner. Attorney-directed AI use as part of trial preparation is the unsettled category. The lawyer who keeps the AI use on the attorney's side of the line, supervised and directed as part of case preparation, is positioned for the work-product argument if and when a court extends protection to that arrangement. The argument is not yet a holding, so contemporaneous documentation of the supervisory structure matters.

Get informed consent from the client before uploading client confidences to any AI tool. Disclose what tool, what tier, what the data practices are, and what the privilege landscape looks like. Document the consent. ABA Formal Opinion 512 and Florida Bar Advisory Opinion 24-1, among others, point in this direction even where they do not require it explicitly.

Strip client-identifying information where possible. AI assistance with a legal research question or a brief structure does not always require uploading client-identifying material. Anonymized or hypothetical framing reduces the exposure.

Document the work-product purpose.If a court later has to decide whether AI exchanges are protected work product, the lawyer's contemporaneous documentation that the AI was used in case preparation rather than general business operations is the foundation of the protection. Keep notes on what was uploaded, why, and how the output was used.

Establish a written firm policy. A documented firm policy on AI use, including the tools allowed, the tiers, the verification steps, and the client-disclosure protocol, is both a Rule 5.1 supervision tool and an evidentiary anchor if a privilege or work-product question is later litigated.

What clients should be told

A practical engagement-letter addendum on AI use is becoming standard practice in firms that take this seriously. The substance varies, but the elements that matter include:

A description of how the firm uses AI in legal work, including the categories of tasks (drafting, research assistance, document review, deposition preparation) and the categories of tools (general-purpose, legal-specific, document-management).

A description of the data-handling practices of the tools the firm uses, at the level of detail the firm is comfortable disclosing. Enterprise tier, zero-retention commitments, and no-training commitments are the relevant categories.

A clear statement that the client should not assume that the client's own use of AI tools is privileged or confidential. The Heppner implication for client AI use is the part that most clients do not know and need to be told.

The client's affirmative consent to the firm's AI use, in a form that the firm retains.

The standard engagement letter has not historically addressed AI tool use because the question did not exist. It exists now, and the Heppner ruling makes the question concrete.

Where the law is going

The current state of the law on AI and privilege is unsettled. Heppner is one ruling from one judge in one district. Two other federal rulings have addressed adjacent questions in pro se settings, but the body of authority is small. The state-court and federal-circuit-level guidance is still developing.

Three patterns are likely.

Privilege over client-AI exchanges. Heppner's three-ground analysis is hard to distinguish. The likely trajectory is that other courts adopt similar reasoning. A reversal would require either a higher court rejecting the analysis or a factual posture distinguishable enough that the Heppner grounds do not all apply. Both are possible; neither is the safe bet.

Work product over attorney AI exchanges. This is the open question. Warner and Morganprotect a pro se litigant's own AI use; they do not reach attorney-directed AI workflows. Heppner explicitly left open a Kovel-type arrangement, in which counsel directs the AI as a non-lawyer agent of the representation, as a possible path to protection. A future court applying that framework could extend work-product protection to supervised attorney AI use, particularly where the AI is run on enterprise-tier infrastructure and the lawyer documents the supervisory structure. Until that ruling exists, attorney AI use is not yet protected as work product, and any lawyer relying on the doctrine is running ahead of the case law.

Bar-rule guidance. State bars have been issuing AI opinions for several years. The privilege and confidentiality questions are now the leading edge. Expect more guidance, and expect it to vary across jurisdictions before any consensus settles.

The conservative posture for a working lawyer in this environment is to assume the privilege analysis runs as Heppner describes it, structure the workflow so that any future work-product argument is available, and document the supervisory structure and the data-handling practices contemporaneously rather than reconstructively.

What this does not mean

The rulings discussed here do not mean that lawyers should stop using AI in their practice. They mean that the rules are being written and that the lawyer's responsibility is to know what the rules currently are.

They do not mean that all client communications are at risk because AI exists. They mean that client AI exchanges, specifically, are the unprotected category. Ordinary client-attorney communications still get the ordinary protections.

They do not mean that work product over attorney AI use is established. They mean that two federal courts have extended the protection to pro se litigants' AI use, and that Heppner left open a Kovel-type counsel-directed arrangement as a possible path to protection for attorney AI use. The argument exists. The holding does not yet.

They do not mean that the conservative posture is the only defensible posture. They mean that the conservative posture is the one that does not depend on a court adopting a position that no court has yet adopted. Lawyers who want to take a more aggressive position should do so with their eyes open about the authority they are running against.

Frequently asked questions

Is my conversation with Claude protected by attorney-client privilege?

A federal court held in February 2026 that client AI exchanges are not protected by attorney-client privilege, on three independent grounds, including that the AI is not an attorney and cannot form a privileged relationship with the user. The ruling is recent and the law is unsettled, but the conservative posture is to assume that AI exchanges are not privileged.

Can I use AI in my law practice without losing privilege?

Yes, with care. Attorney-client privilege over communications with the client remains intact when AI tools are used in the lawyer's preparation. The privilege issue arises when client AI exchanges are sought in discovery, not when the lawyer's own AI use is. Work-product protection for attorney AI use has not yet been decided. Two recent federal rulings extended work-product protection to pro se litigants' AI use, but neither held that an attorney's AI use is work product. Heppner left open a Kovel-type counsel-directed arrangement as a possible path to protection. A lawyer who structures AI use as supervised case preparation is positioned for that argument, but the argument is not yet a holding.

What is the difference between privilege and work product?

Attorney-client privilege protects confidential communications between client and counsel made for the purpose of seeking or providing legal advice. Work-product doctrine protects materials prepared by or for a party in anticipation of litigation. The two protections are distinct. Material can qualify for one and not the other. The recent rulings on AI suggest that client AI exchanges are unlikely to be privileged. Pro se litigant AI use can qualify as work product. Whether attorney AI use qualifies as work product is the open question.

Do I need to tell my clients I use AI?

Bar opinions on this question vary, and the recent rulings tilt toward affirmative disclosure as the prudent posture. The conservative move is to disclose AI use in the engagement letter, describe the data-handling practices of the tools the firm uses, and document client consent. Florida Bar Advisory Opinion 24-1 and ABA Formal Opinion 512 set the framework.

Should I tell my clients not to use AI tools to discuss their case?

Telling clients that their pre-retention AI exchanges may be discoverable, that ongoing AI use during the representation may not be privileged, and that they should consult with counsel before uploading sensitive matter information to any AI tool is becoming standard advice. The specific words depend on the matter and the relationship.

What about firms that use enterprise-tier AI tools with zero-retention commitments?

Enterprise tiers with zero-retention or no-training commitments substantially reduce the third-party exposure that drove part of the Heppner analysis. They do not eliminate the privilege analysis, because the AI is still not an attorney and the privilege still depends on the attorney-client relationship. They do strengthen the work-product position and the Rule 1.6 confidentiality position. The posture is materially better than consumer-tier use.

Bottom line

The privilege landscape for AI in legal practice has changed. A federal court has held that client AI exchanges are not privileged on three independent grounds, and the analysis is hard to distinguish. Two other federal rulings have extended work-product protection to pro se litigants' AI use, but no court has yet held that an attorney's AI use is privileged or work product. The Kovel-type counsel-directed arrangement Heppner flagged is the open question. The combined effect is that lawyers who use AI in their practice should structure the workflow so that any future work-product argument is available, should disclose AI use to clients and obtain consent, should use enterprise or API tier products with strong data-handling commitments, and should document the supervisory structure and litigation-preparation purpose contemporaneously.

The conservative posture is no longer optional. Verification protocols matter; documentation matters more than it did six months ago; the rules are being written, and the lawyer's job is to know what they currently are.