Paste sensitive work into consumer AI and you're not talking to your lawyer — you're talking to a vendor whose privacy policy says the quiet part out loud.
Via U.S. District Court, SDNY: United States v. Heppner — Memorandum and Order (S.D.N.Y.)
On February 17, 2026, Judge Jed S. Rakoff of the U.S. District Court for the Southern District of New York ruled that written exchanges a defendant had with Anthropic's Claude platform were not protected by attorney-client privilege or the work-product doctrine. The case is United States v. Heppner, 25 Cr. 503 (JSR) — and the Court described the question as one of first impression nationwide.
The short version for business owners: if your people paste client data, strategy notes, or anything you'd normally keep between you and your lawyer into a consumer AI chatbot, do not assume a judge will treat that as confidential. Rakoff's reasoning applies far beyond criminal defendants. It is a blunt reminder that "private chat window" and "legally privileged" are not the same thing.
The defendant had used Claude after receiving a grand jury subpoena, generating reports he later shared with counsel. His lawyers argued privilege. The Court said no — on multiple independent grounds. Claude is not an attorney. The communications were not confidential under Anthropic's own privacy policy. And counsel had not directed the defendant to use the tool in the first place.
If that last detail sounds familiar, it should. That is exactly how shadow AI works in most firms: someone opens a browser tab, asks a question, and nobody in leadership signed off on it.
Rakoff's memorandum is methodical, which makes it more useful — and more uncomfortable — for regulated SMEs.
Claude is not counsel. Full stop. The Court noted that Claude itself disclaims providing legal advice, telling users to consult a qualified attorney. Privilege requires a communication between client and attorney for the purpose of legal advice. A chatbot operated by a private company does not qualify, any more than a cloud word processor magically becomes your law firm because you typed a memo into it.
Confidentiality was never reasonable. The defendant had agreed to Anthropic's privacy policy, which — as cited in the ruling — allows collection of user inputs and model outputs, use of that data to train the system, and disclosure to third parties including government regulators. Rakoff cited prior SDNY precedent that AI users lack substantial privacy interests in conversations voluntarily disclosed to publicly accessible platforms that retain them in the normal course of business. Sharing privileged information with a third party waives privilege. Sharing it with a platform whose policy contemplates disclosure to regulators is worse.
Work product did not save it either. The documents were prepared by the defendant on his own initiative — not at counsel's direction — and did not reflect counsel's strategy at the time they were created. The Court rejected arguments that sharing non-privileged material with a lawyer somehow transforms it. As the Second Circuit has put it: materials that would not be privileged in the client's hands do not acquire protection merely because they were transferred to counsel.
The ruling is about a criminal case in Manhattan. But the logic travels. Law firms, accounting practices, healthcare administrators, and any information-heavy SME operating under New York rules should read it as a warning label on the "help me draft this" prompt box.
Most businesses still treat AI acceptable use as an IT checkbox. After Heppner, that is negligent optimism dressed up as policy.
None of this requires banning AI. It requires deciding — deliberately — where it runs, what it touches, and who owns the risk when someone gets it wrong.
"Heppner could have had no reasonable expectation of confidentiality in his communications with Claude." — Judge Jed S. Rakoff, U.S. District Court, S.D.N.Y., February 17, 2026
The Heppner ruling will not stop employees from using AI. It should stop owners from pretending those chats are private, privileged, or "just brainstorming."
This is the work AgentsROI.ai does.
AgentsROI.ai does not sell chatbots. It sells judgment, governance, and ongoing operations — so AI pays for itself instead of quietly becoming your next discovery problem.
Judge Rakoff did not outlaw AI. He refused to pretend a consumer platform is counsel, or that a privacy policy full of training and disclosure carve-outs creates confidentiality where none exists.
For owner-led firms in New York and everywhere else, the takeaway is simple: if the work is sensitive, the tool choice is a legal and business decision — not a personal productivity hack.
Book a Shadow-AI Risk Assessment and find out what your team is pasting into AI today — before a judge, auditor, or opposing counsel finds out for you.
This article summarizes publicly reported information from a February 17, 2026 memorandum by Judge Jed S. Rakoff in United States v. Heppner, 25 Cr. 503 (JSR), S.D.N.Y., available via Davis Wright Tremaine. It is for general informational purposes only and does not constitute legal, tax, financial, investment, security, or compliance advice. AgentsROI.ai is not a law firm, accounting firm, or registered investment adviser. The ruling addresses a specific criminal matter; its application to other contexts depends on facts, jurisdiction, and professional obligations. Readers should verify current information independently and consult qualified attorneys regarding obligations specific to their industry and circumstances — including applicable New York State and New York City requirements. Nothing in this article is an endorsement of any specific AI product, model, or provider.
