Attorney-Client Privilege and AI: Keeping Work Privileged

In February 2026, a federal judge in Manhattan read a defendant’s AI chat history into the record and ruled it fair game for the prosecution. The defendant had typed his defense strategy into Claude after he was indicted and after he had hired a lawyer. The government asked for those exchanges. Judge Jed S. Rakoff said yes, they could have them, because attorney-client privilege never attached to a conversation with a chatbot.

That case, United States v. Heppner, is the first ruling of its kind in the country, and it reframed a question every in-house lawyer is now asking: where does attorney-client privilege and AI overlap, and where does the privilege fall away? For general counsel and legal ops leaders, the privilege turns on three conditions the court named directly, and every one of them is about how the AI is used.

Cecilia Ziniti, the CEO and co-founder of GC AI, was a general counsel three times over, at Anki, Bloomtech, and Replit, and an in-house counsel at Amazon and Cruise before that. She built GC AI to solve the problems she ran into as an in-house lawyer, and privilege was always one of them. The platform’s posture maps to the Heppner test on purpose.

What Attorney-Client Privilege and Work-Product Protection Cover

Attorney-client privilege protects confidential communications between a client and their lawyer made for the purpose of seeking or giving legal advice. Work-product protection is broader and covers materials a lawyer or their agent prepares in anticipation of litigation. Both are old doctrines, and both rest on assumptions that generative AI breaks.

The privilege has always required a lawyer on one end of the conversation. It has always required confidentiality, which means the communication stays inside the attorney-client relationship and does not get shared with an outside party. And it has always required that the purpose be legal advice the client seeks through counsel.

Generative AI strains all three. A chatbot is not a lawyer. A consumer AI account often runs on terms that let the provider read prompts and use them for training. And a lawyer who opens ChatGPT to think through a problem is frequently working alone, not under the direction of counsel in any formal sense, because they are the counsel. None of this was a problem when the doctrines were written. It is a problem now, and Heppner is where a court said so out loud.

United States v. Heppner: The First Ruling on AI and Privilege

In United States v. Heppner, decided February 17, 2026, the Southern District of New York held that written exchanges between a criminal defendant and a generative AI platform are not protected by attorney-client privilege or the work-product doctrine. It is the first ruling in the country to decide the question, and Judge Rakoff is one of the most cited trial judges in the federal system, which means the opinion travels.

Bradley Heppner was indicted in October 2025 on securities fraud, wire fraud, and related counts. After the indictment, and after he retained counsel, he used Claude to draft reports outlining his defense strategy and potential legal arguments. When the government moved to compel production of those AI exchanges, Heppner claimed privilege. The court rejected the claim on three independent grounds, and each ground maps to a question in-house counsel can ask about their own AI use:

1. The AI was not an attorney, so no attorney-client relationship existed.

2. The platform’s terms permitted disclosure, so the exchanges were never confidential.

3. The defendant used the AI on his own initiative, without his lawyers directing it.

Track One: The AI Is Not an Attorney

The court started with the most basic element of the privilege. Attorney-client privilege protects communications with a lawyer, and a generative AI platform is not a lawyer. There is no licensed professional on the other end, no bar membership, no duty of confidentiality running back to the client. A communication with a non-attorney generally cannot be a privileged attorney-client communication, and the court saw no reason to invent an exception for software.

Track Two: Confidentiality Turned on the Platform’s Terms

The second ground was confidentiality, and this is the track that matters most for procurement. At the relevant time, the consumer privacy policy governing Heppner’s use stated that user prompts could be used to train models and could be disclosed to third parties, including the government. Sharing a communication with a party outside the attorney-client relationship waives the privilege. Because the terms of service permitted exactly that kind of disclosure, the court found no reasonable expectation of confidentiality. The privilege failed before it ever attached.

Track Three: Self-Directed Use by the Client

The third ground was purpose. Privilege protects communications made to obtain legal advice through counsel. Heppner used Claude on his own initiative. His lawyers did not direct him to use it, did not supervise the exchanges, and did not treat the AI as part of their legal work. Self-directed use by a client is different from counsel-directed use of an agent, and the court treated that difference as decisive.

The Three-Part Test That Emerged, and the Kovel Workaround

Heppner gives in-house counsel a usable framework. Call it the Rakoff Privilege Test. AI-assisted work has the best chance of staying privileged when three conditions hold:

1. The AI functions as an agent of counsel. The legal team deploys it, so it works under the attorney the way the Kovel accountant did.

2. The platform’s terms guarantee confidentiality. The contract bars training on your inputs and disclosure to third parties.

3. A lawyer directs the use for legal advice. Counsel selects the tool, sets the use cases, and reviews the output.

Fail any one of the three and the privilege is exposed. The same test sorts the two ways a legal team can put AI to work:

The Rakoff Privilege Test	Consumer AI, Used Alone	Counsel-Directed Enterprise Platform
Is there an attorney or an agent of counsel?	No licensed attorney in the loop; the user works solo	The legal team deploys the AI as its agent under Kovel
Do the terms guarantee confidentiality?	Terms may permit training on prompts and disclosure to third parties	Contractual no-training, no-disclosure, zero-data-retention
Who directed the use?	The user, on their own initiative	Counsel selects the platform, sets the use cases, and reviews output

The most important sentence in the opinion for legal departments is the one about the Kovel doctrine. In United States v. Kovel, 296 F.2d 918 (2d Cir. 1961), Judge Henry Friendly held that attorney-client privilege can extend to a non-lawyer the attorney retains to help deliver legal advice. The case involved an accountant working for a tax law firm, and Friendly compared the accountant to a translator: accounting was a language as foreign to the lawyer as French, and the privilege covered the translation because it served the legal advice.

Rakoff acknowledged that a generative AI platform could arguably function as a lawyer’s agent under Kovel, if the client used it at counsel’s specific direction and with an appropriate expectation of confidentiality.

That is the operational opening. Counsel-directed AI use, on a platform with contractual confidentiality and no training on the inputs, sits much closer to the Kovel accountant than to the consumer chatbot Heppner used alone. The doctrine that protected a tax accountant in 1961 is the doctrine that can protect an AI-assisted legal workflow today, when the workflow is built the right way.

ABA Formal Opinion 512 and the Three Duties Underneath the Ruling

Heppner is about evidence. The ethics layer is about conduct, and the controlling guidance is ABA Formal Opinion 512, issued July 29, 2024. It was the ABA’s first formal guidance on generative AI, and it grounds the analysis in the existing Model Rules. Three of those duties carry the weight for in-house teams.

The duty of competence under Model Rule 1.1 requires a lawyer to understand the benefits and risks of the technology they use to deliver legal services. A GC who deploys AI without understanding how it handles data is exposed on the same rule that covers any other professional skill gap.

The duty of supervision under Model Rules 5.1 and 5.3 requires lawyers to oversee the work of nonlawyer assistants, and the opinion treats AI outputs as work that needs review. This is the conduct-side mirror of Heppner’s third track: a lawyer in the loop is both an ethics requirement and a privilege strategy.

The duty of confidentiality under Model Rule 1.6 requires a lawyer to keep client information confidential regardless of its source, and the opinion is specific that lawyers must know how an AI platform uses data and put safeguards in place against unauthorized disclosure. This is the conduct-side mirror of Heppner’s second track. The ethics rule and the evidentiary rule point at the same control. Read the terms, confirm the data stays in, and document it.

How In-House Counsel Preserve Privilege With AI in Practice

The path from the ruling to daily practice runs through four moves. All four keep AI in the workflow. Each deploys it the way the Kovel accountant was deployed: at counsel’s direction, under confidentiality, for legal advice.

Deploy AI at the direction of counsel. The cleanest way to satisfy Heppner’s third track is for the legal department to own the deployment. When the legal team selects the platform, sets the use cases, and runs the workflows, the AI operates as an agent of counsel under the lawyer’s direction. Document the policy so the agent-of-counsel posture is visible if it ever gets tested.

Choose an enterprise or commercial tier. The privacy policy is the pivot in Heppner’s second track. Consumer accounts that reserve the right to train on prompts or disclose them to third parties cannot support a reasonable expectation of confidentiality. Enterprise and commercial agreements that contractually bar training on your inputs and prohibit third-party disclosure are a different posture entirely. The tier is the whole ballgame, which is why evaluating the best legal AI tools for in-house counsel starts with the data terms in the contract.

Put confidentiality in the contract itself. The protection that counts is the one a court can read: a written commitment that the provider will not train on your data, will not disclose it, and will delete it on request. A promise in a sales deck does not survive a subpoena. Confirm the term in the contract and keep the executed copy.

Keep a lawyer in the loop and verify the output. Supervision under Rules 5.1 and 5.3 and the verification habit that prevents the Mata v. Avianca problem are the same discipline. A lawyer reviews the AI’s work, confirms the citations, and applies judgment. That review reinforces the agent-of-counsel posture and catches the errors that have sanctioned lawyers who filed AI output unchecked.

Ritesh Patel, Chief Legal Officer at Viant Technology, runs that lawyer-in-the-loop pattern as his default:

I use it for research and issue spotting. If there’s an HR or privacy question, I’ll run it through GC AI first. Before, I’d call outside counsel and pay by the hour for a generic answer. Now, I can analyze it myself, see where it gets me, and call outside counsel if I’m truly out of depth.

The first pass happens inside a platform built for legal work. The judgment stays with the lawyer.

None of this waits for a policy overhaul. A legal team can close the gap inside one quarter:

1. This week: inventory which AI tools the team uses and on what tier, so the consumer-tier exposure is visible.

2. This month: move legal-adjacent work onto one platform the legal department selects and supervises.

3. This quarter: get the no-training, no-disclosure, delete-on-request terms into the contract and keep the executed copy.

Waiver Traps and the Consumer-Tier Discoverability Problem

A ruling like Heppner can make AI feel like a liability to keep at arm’s length. Danielle Sheer, Chief Trust, Legal and Compliance Officer at Commvault, named that fear directly on CZ and Friends, GC AI’s podcast hosted by CEO Cecilia Ziniti:

I was scared of AI. I was scared of what it meant for our profession… Just take that fear head on.

For a legal department, taking it head-on starts with knowing where the privilege leaks.

The fastest way to lose privilege is to never have it. Consumer AI tiers are the most common trap, because the terms of service do the waiving before a single prompt is typed. When a privacy policy permits training on prompts or disclosure to third parties, there is no confidential channel for the privilege to protect, which is precisely the reasoning in Heppner’s second track. Pasting information that is already privileged into a consumer tool runs the same risk in the other direction, because sharing it with a party outside the attorney-client relationship can waive the protection it had. And the waiver cannot be undone by routing: forwarding a chatbot exchange to a lawyer after the fact does not make it privileged, because the disclosure has already happened.

Discoverability is the consequence. AI chat logs are records, and records get subpoenaed. A defendant’s self-directed Claude history became a government exhibit in Heppner.

A business user pasting deal terms into a free chatbot is creating the same kind of record, sitting on a third-party server, governed by terms that may permit disclosure. For a regulated company, that is an evidentiary exposure that has nothing to do with whether the AI gave good advice.

Two habits keep the traps closed. First, route legal-adjacent AI work through the legal department’s approved platform.

Shadow AI use by sales, HR, or finance, in whatever tab they happen to have open, is where the privilege leaks.

Second, treat the question “is ChatGPT privileged” as a question about the account tier and the contract, because that is what the court treated it as. The deciding variable is the terms and the tier, the same analysis that decides whether ChatGPT is confidential in the first place.

How GC AI Is Built for the Rakoff Test

GC AI is a legal AI platform purpose-built for in-house counsel, used by 2100+ legal teams across 53 countries, including legal departments at TIME, Liquid Death, Snyk, and Columbia Sportswear, plus 200+ public companies and 25 unicorns. The platform’s posture was designed around the same questions the Heppner court asked, which is why the ruling reads like a build specification.

Ziniti designed it that way deliberately. Having sat in the general counsel seat three times, she built the confidentiality controls around the question every in-house lawyer asks before a tool touches a privileged matter. Where does my data go, and who can read it?

On the confidentiality track, the controls are contractual and specific. GC AI is SOC 2 Type II and SOC 3 certified, GDPR compliant, and AES-256 encryption. We maintain zero-data-retention agreements with our LLM providers wherever feasible. The platform does not train on customer inputs, and customer data sits in segregated databases. That is the difference between a consumer policy that reserves training rights and an enterprise posture that contractually forecloses them. The GC AI security page cites Heppner directly for this reason.

On the counsel-directed track, GC AI is deployed by the legal department for legal workflows: contract review, research, drafting, issue spotting. It is the legal team’s own platform, selected by counsel and run for legal advice, which is the agent-of-counsel posture the Kovel doctrine rewards. Playbooks, GC AI’s reusable review standards that capture how a team wants contracts handled, and verifiable citations keep a lawyer in the loop by design.

KT Farley, Chief Privacy Officer and Associate General Counsel at Helix, frames the fit for a privacy-first legal department in one line:

It’s cost-effective, fine-tuned for attorneys, and the cost of a license is a couple of hours of outside counsel time.

For a lawyer whose whole job is data handling, a platform that handles data the way the privilege requires is the baseline, and the productivity is the bonus.

GC AI also teaches the discipline that keeps privilege intact. Our free legal AI classes, taught by former general counsels and California CLE-eligible, cover the prompting, supervision, and verification habits that satisfy both the ethics duties and the privilege test.

More than 6,000 lawyers have completed them. The same habits carry over to everyday tools like ChatGPT for lawyers and Claude legal AI, and the Heppner ruling analysis breaks down the opinion in full.

Start With the Three Questions That Decide Privilege

Before the next deal closes or the next strategy memo gets drafted with AI, run your stack through the Rakoff Privilege Test: Is the AI deployed at the direction of counsel? Does the contract guarantee confidentiality and bar training on your inputs? Is a lawyer reviewing the output? A platform built for in-house legal work answers all three by design.

See how GC AI handles privileged legal work on your own matters, no credit card required.