AI and Attorney-Client Privilege: A Cautionary Ruling from the Southern District of New York
This week, a judge in the Southern District of New York ruled from the bench that documents generated by a defendant using the AI platform Claude were not protected by the attorney-client privilege or the work product doctrine.
In United States v. Bradley Heppner, the Government moved for a ruling that certain documents the defendant generated through an artificial intelligence tool were not privileged. According to the Government’s motion, after Heppner’s arrest the FBI executed a search warrant and seized numerous electronic devices. Defense counsel later informed prosecutors that, before his arrest, Heppner had input prompts into Claude and received AI-generated responses addressing issues related to the Government’s investigation. Approximately 31 documents reflecting those prompts and responses: the “AI Documents,” were identified among the seized materials.
Defense counsel asserted that the AI Documents were privileged. The Government disagreed. Pursuant to a privilege protocol, the documents were segregated and the issue was presented to the court for resolution.
The defense argued that some of the information input into the AI tool derived from communications with counsel, that the documents were created for the purpose of discussing matters with counsel and obtaining legal advice, and that the AI Documents were in fact shared with counsel. Critically, however, the defense did not claim that counsel directed the defendant to use the AI tool or participated in generating the documents.
The Legal Issues
Two doctrines were at issue.
First, attorney-client privilege, which protects communications (1) between a client and an attorney, (2) intended to be confidential, and (3) made for the purpose of obtaining legal advice. The Government emphasized that the party asserting privilege bears the burden of establishing each element.
Second, the work product doctrine, which provides qualified protection for materials prepared “by or at the behest of counsel” in anticipation of litigation or trial. The doctrine does not protect ordinary business records or materials prepared independently by a party without attorney involvement.
The Government’s Arguments
The Government advanced several arguments for why the AI Documents were not privileged.
Most notably, it argued that the documents were not confidential. Heppner voluntarily shared his prompts with a third-party, publicly available AI platform whose privacy policy disclosed that prompts and outputs could be retained, used for training, and disclosed to governmental authorities or third parties. The Government analogized this to cases finding waiver where clients communicated with counsel through monitored work email systems lacking a reasonable expectation of privacy.
The Government also argued that transmitting the AI Documents to counsel after the fact did not transform them into privileged materials, citing settled authority that preexisting, non-privileged documents do not become privileged merely because they are shared with an attorney. In a footnote, the Government analogized the AI outputs to Google searches or library research conducted by a defendant in preparation for litigation—materials that are not privileged simply because they inform later discussions with counsel.
Finally, the Government attempted to distinguish the AI Documents from a client’s confidential notes, which may be privileged where they memorialize attorney communications or organize a client’s thoughts for communication to counsel and are actually shared with counsel. Here, the Government argued, the documents reflected non-confidential communications with a non-attorney third party, completed before any attorney involvement.
The Ruling and Practical Implications
The court ruled from the bench and granted the Government’s motion. While a written opinion has not yet issued, the ruling itself should serve as a warning to government officials, executives, and individuals under investigation: uploading sensitive or potentially incriminating information to AI platforms can carry serious privilege risks.
At least on the facts presented, the court treated AI tools as third parties, not as neutral extensions of the client, and drew a sharp line between lawyer-directed litigation preparation and a defendant’s independent use of AI.
Takeaway
The hardest (and most important) question raised by this case is where the line should be drawn. Privilege is not waived when a client types notes in Word instead of handwriting them to prepare for a meeting with counsel. Nor does using spellcheck or grammar-correction software destroy privilege. An AI interaction is also not literally a “conversation” in the human sense.
But this ruling suggests that courts may treat substantive AI prompting more like outsourcing thought to a third party than like using a passive tool. Until courts say otherwise, institutional actors should assume that uploading sensitive factual narratives, legal theories, or strategic questions to commercial AI platforms, particularly outside counsel’s direction, creates real risk that those materials will be discoverable in later litigation.
Read the motion filed for the United States here.
For further discussion of AI’s implications in legal systems, see “’AI Arbitrator’ – Landmark Moment as AAA-ICDR to Launch New Technology” on the Airdo Werwas blog.
If you have any questions about risks associated with using AI in your organization, please feel free to contact Michael A. Airdo (mairdo@airdowerwas.com) or Jake A. Leahy (jleahy@airdowerwas.com).