Heppner Ruling Explained: What Law Firms Must Know About AI

On February 10, 2026, Judge Jed Rakoff of the Southern District of New York ruled from the bench that documents a criminal defendant generated using Anthropic's Claude were not protected by attorney-client privilege or the work product doctrine. A week later, on February 17, he issued the written opinion in United States v. Heppner. It is the first written federal opinion in the U.S. directly addressing AI-generated materials and legal privilege. The answer was no.

The ruling is being read across the legal industry as a wake-up call. Most analyses, though, stop at the headline. Rakoff's reasoning is more useful than his conclusion, because it tells you what conditions would change the outcome. Firms that understand those conditions can keep using AI without losing privilege. Firms that do not will learn this lesson on a real matter, expensively.

This guide walks through what happened, what the court actually held, and what architectural choices follow from the reasoning.

What happened in United States v. Heppner

 Bradley Heppner, former CEO of Beneficient Company Group, was indicted in October 2025 on securities fraud, wire fraud, and related charges in an alleged $150 million investor fraud scheme. After receiving a grand jury subpoena and retaining defense counsel at Quinn Emanuel, but before his November 2025 arrest, Heppner used the free public version of Anthropic's Claude to generate 31 documents analyzing his legal exposure, potential defenses, and possible arguments. He later shared those documents with his attorneys. 

When the FBI executed a search warrant, agents seized his electronic devices, including the AI-generated documents and the prompt logs. The government moved for a ruling that the materials were not privileged. Heppner's defense team asserted attorney-client privilege and work product protection. Rakoff granted the government's motion.

The facts that matter for everyone else: Heppner used a consumer-grade AI tool, not an enterprise legal AI platform. He used it on his own initiative, not at his attorneys' direction. The platform's terms permitted data collection, training on user inputs, and third-party disclosure. He shared his prompts and outputs with his lawyers only after he had already shared them with the AI vendor.

How the Court's Three-Part Privilege Test Failed in Heppner

Attorney-client privilege protects a communication only when three elements line up:

1. The communication is between a client and an attorney
2. It is made in confidence
3. It is made to obtain or provide legal advice

Rakoff found Heppner's AI documents failed at least two of the three, possibly all three. Here is how each element fell apart.

Claude is not an attorney

Per the court's reasoning, privilege requires "a trusting human relationship with a licensed professional who owes fiduciary duties and is subject to discipline." An AI tool, however capable, does not meet that bar. This alone disposed of the privilege claim.

The communications were not confidential

Anthropic's privacy policy permitted the company to collect user inputs and outputs, use them to train its models, and disclose them to third parties including governmental regulatory authorities. Under those terms, Heppner had no reasonable expectation of confidentiality, and the privilege analysis failed on this element independently.

The use was not for obtaining legal advice from counsel

Heppner's attorneys did not direct him to use Claude. The platform itself disclaims providing legal advice. Sharing the AI outputs with counsel after the fact did not retroactively transform unprivileged communications into privileged ones.

Work product protection failed for the same kind of reason

The work product doctrine protects materials prepared by counsel, or at counsel's direction, in anticipation of litigation. Heppner generated the documents on his own without his attorneys' knowledge, so they did not reflect counsel's mental processes. The doctrine could not attach.

The Kovel opening Rakoff left behind

One detail in the ruling deserves more attention than it has gotten. Rakoff noted the outcome might have been different if Heppner's attorneys had directed him to use the AI tool, treating it as a Kovel-style agent. United States v. Kovel (2d Cir. 1961) extended attorney-client privilege to non-lawyer agents like accountants, investigators, and consultants working under attorney direction. The Heppner court left the same doctrinal door open for AI, conditional on proper supervision and confidentiality controls.

That opening is where the practical conversation about law firm AI use begins.

What Heppner does not say

Most of the alarm overstates the ruling. The case does not:

• Ban lawyer use of AI tools generally
• Strip privilege from counsel using AI as a research or drafting aid
• Apply to enterprise legal AI with contractual confidentiality and zero data retention
• Address attorney-supervised AI functioning as a Kovel-style agent
• Change the law of privilege; it applies existing law to a new fact pattern

Heppner is a narrow ruling on specific facts: a represented client, acting alone, using a free public AI tool whose terms permitted data disclosure, without his attorneys' knowledge or direction. The reasoning is broad enough to inform how other AI-and-privilege questions will be analyzed, but the holding itself is contained. For the wider ethical framework lawyers should pair with the Heppner reasoning, ABA Formal Opinion 512 on generative AI sets the baseline duties of competence and confidentiality.

What Heppner means for law firms in 2026

The practical implications break into three layers.

Consumer AI is out for client work

Free public versions of ChatGPT, Claude, and Gemini are not appropriate for any client matter. The privilege analysis is unfavorable and the platform terms make it worse. The replacement is an enterprise AI platform with controlled deployment and proper compliance posture. 

Enterprise SaaS legal AI is in a better position, but not automatically safe

Harvey, Spellbook, CoCounsel, and similar tools have contractually-enforced zero data retention, SOC 2 Type II certification, and audit logs. Under Heppner's reasoning, they are substantially stronger than consumer AI. The residual exposure: the firm depends on the vendor's terms remaining favorable, and a privacy policy is determinative of confidentiality under Rakoff's logic. For firms in this category, pre-upload redaction is the standard compensating control.

In-firm AI removes most of Heppner's exposure

When the AI runs inside the firm's environment, the third party is gone. The firm controls data residency, access policies, retention rules, and the audit trail. The Kovel analogy is cleaner because the AI is functioning as an agent inside the firm's supervision, not a third-party service the client interacted with separately. VIDIZMO Intelligence Hub is built for this category, with on-premises, private cloud, or air-gapped deployment so client data never leaves the firm's network. 

This is the architectural answer to Heppner that most coverage has not connected. The cleanest privilege posture in 2026 is not better contracts with third-party AI vendors; it is keeping the AI inside the firm with a platform like Intelligence Hub.

How Intelligence Hub Solves the Heppner Problem

VIDIZMO Intelligence Hub is built for the in-firm path. It deploys on-premises, in a private cloud the firm controls, or in an air-gapped environment. Client data never leaves the firm's network, so no third-party privacy policy can be invoked the way Anthropic's was in Heppner.

Four capabilities matter for the Heppner analysis:

• Data stays inside the firm. No external transmission, no vendor-controlled retention. The court's concern about disclosure to "governmental regulatory authorities" does not apply because there is no third party in the loop.
• Multi-modal coverage. Documents, video, audio, images, and scanned exhibits in one query. Document-only AI leaves the rest of the case record unindexed.
• Source-cited answers. Every response ties back to the exact frame, second, or page. The reviewer verifies in one click, which is the audit trail Heppner's reasoning requires.
• Compliance built in. ISO 27001, HIPAA, CJIS, FedRAMP, SOC 2 Type II, FIPS 140-2 native to the platform.

The capability set does not replace attorney judgment. It removes the third party from the privilege analysis, which is what Heppner made expensive.

Don't wait for the next ruling to expose your firm. Book a 20-minute walkthrough of VIDIZMO Intelligence Hub and see exactly how in-firm legal AI keeps privileged matters off third-party infrastructure.

5 Steps Law Firms Must Take After Heppner

• Audit current AI use. Identify what tools attorneys and staff are using on client work. Replace consumer AI immediately.
• Document attorney direction. Every AI-touched matter should show counsel directed the use. Rakoff's Kovel opening only applies to firms that can prove direction and supervision under ABA Model Rule 1.6.
• Review vendor terms of service. Read what your AI platform's privacy policy actually permits. ZDR with model providers is not the same as a commitment to keep data inside your control.
• Maintain redaction logs for SaaS AI use. Pre-upload redaction with full audit logging is the standard compensating control for firms staying with enterprise SaaS.
• Move regulated practice work to in-firm AI. Healthcare, government, defense, and matters touching CJIS or classified data should not sit on third-party SaaS at all. VIDIZMO Intelligence Hub handles this category with on-premises, private cloud, or air-gapped deployment.