You paste a case summary into ChatGPT to organize your thoughts before a client call, the way you would scribble on a legal pad. A federal judge has now told you that pad is not protected. In United States v. Heppner, the U.S. District Court for the Southern District of New York held that a defendant's written exchanges with a consumer generative-AI tool (here, Anthropic's Claude) are not covered by attorney-client privilege. The chat log is fair game in discovery, and the FBI already seized roughly 31 of those documents in this case.
Most coverage frames this as a flat rule: AI chats are never privileged. That is too simple, and getting it wrong could cost a client. The same month Heppner came down, a different federal court reached the opposite result on a related question. The line between protected and exposed is not the AI. It is who you are, what the terms of service say, and whether your lawyer told you to use it.
The ruling: a consumer AI is not your lawyer
Judge Jed Rakoff issued the written Heppner opinion on February 17, 2026, calling it a question of first impression nationwide. The defendant had fed materials from his counsel into a consumer version of Claude, Anthropic's assistant, to consolidate his thoughts and prepare for future talks with his lawyer. He did this on his own, without counsel telling him to. The court held the resulting documents were not privileged. The reasoning matters more than the headline.
Rakoff found the communications failed at least the first two of privilege's three required elements. First, the exchange was not between a client and an attorney. As he put it, because the AI is not an attorney, that alone disposes of the privilege claim. Second, the platform's own terms stated that submitted information was not confidential and could be disclosed to regulators or used to train the model, so there was no reasonable expectation of confidentiality. Third, the defendant acted independently, without his lawyer's direction.
The bot is not an attorney, so the privilege never attaches in the first place. And when the terms say your input is not confidential, there is nothing left to argue about.
The contrast most lawyers miss: Warner v. Gilbarco
A week before Rakoff's written opinion, on February 10, 2026, Magistrate Judge Anthony Patti in the U.S. District Court for the Eastern District of Michigan went the other way on work product. In Warner v. Gilbarco, the court denied a motion to compel documents a self-represented litigant had drafted using ChatGPT, holding that work-product protection applied. The court's logic: generative-AI platforms are tools, not persons, so feeding material to one is not disclosure to an adversary.
That difference is doctrinal, not contradictory. Attorney-client privilege can be waived by voluntary disclosure to almost any third party outside the circle of confidence. Work-product protection is narrower to waive: it generally falls only on disclosure to an adversary or in a way likely to reach one. So the same act, typing into a chatbot, can blow privilege while leaving work product intact. Heppner was a privilege case. Gilbarco was a work-product case. Both can be right at once.
The information-gain takeaway: do not tell a client AI chats are never protected. Privilege and work product have different waiver rules. The AI is not your lawyer, but it is also not automatically your adversary.
Why ChatGPT specifically fails the confidentiality test
The Heppner facts involved Claude, but the holding turns on a feature common to consumer chatbots, including ChatGPT Free and Plus and the consumer Gemini app. The confidentiality prong of privilege asks whether the communication was made in confidence. When the terms of service let the provider disclose your input or train on it, a court can find you never had a reasonable expectation of confidentiality in the first place. There is nothing to waive because there was nothing protected.
This is also why pasting your chatbot output into an email to your attorney does not heal the problem. Once the original communication lacked confidentiality, sharing the result with counsel after the fact does not retroactively wrap it in privilege. The defect is at the input, not the handoff. Waiver, where it happens, runs forward and is hard to claw back.
There is a deeper trap for criminal defendants specifically. Heppner generated roughly 31 documents to outline defense strategy and prepare to consult counsel, after he had received a grand jury subpoena, and the government got to argue about all of them. Narrate your case to a chatbot and you create a contemporaneous, time-stamped account of what you knew and when, in your own words, sitting on a server outside your control. That is a discovery surface that did not exist before consumer AI. Heppner is the first court to treat it as one.
What the ABA already told you in 2024
None of this should be a shock. The American Bar Association issued Formal Opinion 512 on July 29, 2024, its first ethics guidance on generative AI, and it made the duty plain. A lawyer's obligation to protect confidential client information under Model Rule 1.6 applies fully to AI use. The opinion singled out self-learning tools: a client's informed consent is required before their confidential information goes into a model that trains on inputs, and informed consent means an actual explanation of the risk, not boilerplate buried in an engagement letter.
Heppner is the litigation consequence of ignoring that duty. The ethics rule said know how the tool handles data and put safeguards in place. The court showed what happens to a record built without them.
Consumer AI versus enterprise tools at counsel's direction
The protective path runs through two things the consumer chatbot lacks: a confidentiality term that does not let the provider disclose or train on your data, and use directed by counsel so the tool functions as an agent of the legal team. Under the Kovel doctrine, a lawyer's agent, such as an accountant retained to help render legal advice, can sit inside the privilege. A properly governed enterprise AI used at counsel's direction has a far better claim to that footing than a free chatbot a client opened alone.
Rakoff hinted at this himself. He noted the result could have been different if counsel had directed Heppner to use the tool, in which case it might have functioned as the lawyer's highly trained agent and fallen inside the privilege. That single sentence is the whole ballgame for firms deciding how to deploy AI. Direction by counsel is not a formality. It is the fact that can move your AI output from the consumer column to the protected one.
| Dimension | Consumer AI (ChatGPT Free/Plus, Gemini app) | Enterprise AI at counsel's direction |
|---|---|---|
| Attorney-client relationship | None: the AI is not an attorney and the client uses it alone | Tool acts as counsel's agent under Kovel-style logic |
| Confidentiality terms | Provider may disclose inputs and train on them | Contractual no-disclosure, no-training terms negotiated |
| Privilege likely? | No (Heppner: failed at least two of three elements) | Stronger claim, fact-dependent, not guaranteed |
| Work product? | Possible but fragile, depends on adversary-disclosure analysis | Strongest when created for litigation at counsel's direction |
| Discoverable? | Yes, the chat log can be compelled | Defensible against compulsion if protection is preserved |
Read that table as a workflow, not a product endorsement. The column on the right is not a single app you buy. It is a posture: vetted terms, documented direction from counsel, and a record that shows the tool was part of the legal team's work, not a client's solo experiment.
What to do Monday morning
The practical fixes are not exotic. They are the same diligence the ABA described, applied before a court forces the question. Start by separating two buckets in your own head: anything that touches a specific client's confidences, and everything else. The first bucket should never go into a consumer chatbot, full stop. The second bucket is where AI can genuinely speed you up without putting privilege at risk.
- Tell clients in writing not to discuss their case with consumer AI. A client's solo ChatGPT session, like Heppner's, can manufacture discoverable material you never see coming.
- Read the data-handling terms of any AI tool before it touches case facts. If the provider can disclose inputs or train on them, treat the confidentiality prong as already lost.
- If you want AI in the matter, direct it explicitly and document that direction, so the tool can be argued as an agent of the legal team rather than a stray third party.
- Get informed consent the way Formal Opinion 512 means it: a real explanation of the disclosure and training risk, not a line buried in the engagement letter.
- Preserve and review AI logs the same way you preserve email. If they exist, opposing counsel may ask for them, and you do not want to learn what they say during a deposition.
The split between Heppner and Gilbarco will keep moving as more districts weigh in, and one April 2026 commentary already counts three federal courts with no consensus. Until an appellate court or rule settles it, the safe assumption for client work is the strict one: treat the consumer chat as exposed and build confidential material somewhere a court will recognize as protected.
A narrow note on private memory tools like MemX
To be unambiguous: no consumer memory layer, MemX included, creates legal privilege, immunity from discovery, or anything subpoena-proof. Privilege is a legal status set by courts and ethics rules, and software cannot confer it. For client-confidential work you must use the appropriate privileged channels and a compliant, counsel-directed enterprise legal-AI tool. Nothing here substitutes for that.
Where a private store does help is narrow and worth naming. A lawyer keeps plenty of non-privileged reference material: cleaned-up doctrine notes, CLE outlines, personal research, the running context you want an assistant to remember across sessions. MemX is private by architecture, with per-user isolation, encryption at rest, and data that is not used for training. For that non-privileged organizational layer, controlling where the data lives reduces the third-party-disclosure surface that sank Heppner. It changes who holds the data. It does not change the law, and it never touches the client-confidential channel.
Frequently asked questions
01Are ChatGPT conversations protected by attorney-client privilege?
Generally no. In United States v. Heppner (S.D.N.Y., February 17, 2026), the court held a consumer AI is not an attorney and its terms negate confidentiality, so the chats were not privileged. The reasoning applies to consumer ChatGPT, Claude, and Gemini.
02Does using AI automatically waive privilege?
Not automatically. Privilege requires a confidential attorney-client communication to exist first. Consumer AI usually fails that test, so often there is nothing to waive. Work-product protection is separate and harder to waive, since it generally falls only on disclosure to an adversary.
03Can I fix it by sending the AI output to my lawyer afterward?
No. If the original input was not confidential, forwarding the result to counsel later does not create privilege retroactively. The defect sits at the moment of input. Build confidential material in a protected channel from the start, not after.
04What did ABA Formal Opinion 512 say about AI?
Issued July 29, 2024, it was the ABA's first ethics guidance on generative AI. It confirmed that Model Rule 1.6 confidentiality applies to AI use and that clients must give informed consent, an actual risk explanation, before their confidential data enters a self-learning tool.
05Is an enterprise AI tool safe for client-confidential work?
Safer, not automatically safe. Enterprise tools with no-disclosure, no-training terms used at counsel's direction have a stronger privilege claim under Kovel-style reasoning. Protection is still fact-dependent. Document the direction and confirm the contract terms before relying on it.
The takeaway
A federal court has now said the quiet part out loud: your consumer AI legal chats are not privileged, because the bot is not your lawyer and its terms strip confidentiality before you ever hit enter. Warner v. Gilbarco shows work product may survive, so the rule is not absolute, but you should never tell a client to count on it. Keep client-confidential work in privileged, counsel-directed channels. Keep your non-privileged notes wherever you control the data. And treat every consumer chatbot prompt as a document you may one day have to produce.
