[EDRM Editor’s Note: The opinions and positions are those of Michael Berman.]

In AI Docs Sent By Exec To Attys Not Privileged, Judge Says – Law360 (Feb. 10, 2026), Pete Brush reported a bench ruling holding that “a Texas financial services executive accused of a $150 million fraud cannot claim privilege over documents that he prepared using an artificial intelligence service and sent to his attorneys — but suggested the materials could be problematic if used at trial.”

The article states that: “In 2025, after Heppner knew he was a law enforcement target, he used an unnamed AI tool to prepare 31 documents related to his legal case and shared them with defense counsel from Quinn Emanuel Urquhart & Sullivan LLP, according to filings and statements in court Tuesday.” 

The government challenged privilege and work product assertions and:

Judge Rakoff quickly dispatched the first theory, saying Tuesday, “I’m not seeing remotely any basis for any claim of attorney-client privilege.”

On the work-product theory, defense counsel Benjamin O’Neil then argued that the documents incorporate information that Quinn Emanuel conveyed to Heppner.

“It’s not as if these were documents created during the course of the alleged scheme,” O’Neil said, though he conceded they “were prepared by the defendant of his own volition.”

Prosecutor Alexandra Rothman said the documents do not “reflect the legal strategy” of Heppner’s defense team.

Judge Rakoff agreed, concluding that the AI documents were not prepared by attorneys.

The judge also noted that the tool used by Heppner contains a provision that any information inputted is not confidential — essentially, that a user has no expectation of privacy.

Id. 

However, the article reports that the Judge “said that if prosecutors try to use the AI-generated information at trial, it could give rise to a ‘witness-advocate conflict’ since his law firm would become a witness in such a scenario.”

The decision does not appear on Westlaw. However, the government’s motion is posted.  U.S. v. Heppner, No. 25 Cr. 503 (S.D.N.Y.).

The government asserted that Mr. Heppner used “a commercial artificial intelligence tool.” The output was created prior to arrest and was later shared with counsel.  It argued:

First, the AI Documents fail every element of the attorney-client privilege. They are not communications between a client and attorney—the AI tool is plainly not an attorney, and no attorney was involved when he created the documents. They were not made for the purpose of obtaining legal advice—the AI platform’s terms of service expressly disclaim any attorney-client relationship and state that the tool does not provide legal advice. And they are not confidential— the defendant voluntarily shared his queries with the AI tool, and the AI responses were generated from a third-party commercial platform whose privacy policy permits disclosure to governmental authorities.

Second, the defendant cannot retroactively cloak unprivileged documents with privilege by later transmitting them to counsel. Well-settled law holds that preexisting, non-privileged materials do not become privileged merely because a client eventually shares them with an attorney.

Third, the work product doctrine does not protect these materials. Defense counsel has represented that the defendant created the AI Documents on his own initiative—not at counsel’s behest or direction. The doctrine shields materials prepared by or for a party’s attorney or representative; it does not protect a layperson’s independent internet research.

U.S. v. Heppner, No. 25 Cr. 503 (S.D.N.Y.).

The government stated that the 31 documents and devices were seized pursuant to a search warrant. “Shortly after the search, defense counsel informed the Government that, before his arrest, the defendant had run queries related to the Government’s investigation through an AI tool (Claude) created by a third-party company, Anthropic.”

Defense counsel asserted that the documents were created for the “express purpose of talking to counsel” and obtaining his counsel’s “legal advice,” and were shared with counsel.  However, they were not prepared at counsel’s direction, and counsel was not involved in their creation.

The government argued that: “The defendant appears to have directed legal and factual prompts at an AI tool, not his attorneys. Defense counsel has informed the Government that, once the defendant obtained responses to his AI prompts, he transmitted those responses to counsel. But that act of transmission does not transform the defendant’s non-privileged use of an AI tool into a privileged communication shielded from disclosure.”

The prosecution further asserted that:

The AI-generated documents fail each element of the attorney-client privilege. They are not communications between the defendant and an attorney. They were not made for the purpose of obtaining legal advice. And they are not confidential. Each deficiency independently defeats the defendant’s privilege claim.

Id.

It argued: “The defendant’s use of the AI tool here is no different than if he had asked friends for their input on his legal situation.” The prosecution asserted:

The AI tool that the defendant used has no law degree and is not a member of the bar. It owes no duties of loyalty and confidentiality to its users. It owes no professional duties to courts, regulatory bodies, and professional organizations. The policy balance embodied by the attorney-client privilege cannot be mapped onto a machine that provides what may resemble legal advice.

Id.

The United States quoted Claude documents stating that Claude chooses the “response that least gives the impression of giving specific legal advice’ and ‘instead suggest[s] asking a lawyer.’”

Further, Anthropic’s privacy policy tells users that it gathers prompts and outputs and uses them to train its tool, “and that it may disclose this data to ‘governmental regulatory authorities’ and ‘third parties.’”

Interestingly, the government argued: “Likewise, if the defendant had instead conducted Google searches or checked out certain books from the library to assist with his legal case, the underlying searches or library records would not be protected from disclosure simply because the defendant later discussed what he learned with his attorney.”

Turning from privilege to work product, the government wrote that, “as defense counsel has conceded in its discussions with the Government, the defendant’s AI-research was not prepared at the behest of anyone, including counsel. Rather, as the Government understands, the defendant took these actions himself— without any direction from counsel—and then shared the products of his research with counsel after it was created.”  It added:

Had counsel directed the defendant to run the AI searches, the analysis might be different. But the defendant elected to run his own AI searches and then shared the outputs of those searches with counsel.

Id.

For more information, please see “Against an AI Privilege” – Are Prompts Discoverable?  Is Output? (Jan. 2, 2026).

Assisted by GAI and LLM Technologies per EDRM’s GAI and LLM Policy.