On February 10, 2026, Judge Jed S. Rakoff of the Southern District of New York ruled from the bench that materials generated through a consumer AI tool were not protected by attorney-client privilege or the work product doctrine.
The case was United States v. Heppner. The defendant used a publicly available AI platform to organize information he believed relevant to his defense, without direction from counsel. The FBI seized the devices. The government moved to have the AI-generated documents declared unprivileged. Judge Rakoff agreed.
The written opinion, issued February 17, 2026, described the issue as a nationwide matter of first impression: whether communications with a publicly available AI platform during a pending criminal investigation are protected by privilege or work product.
The answer was no.
Why the decision matters beyond its facts
Gibson Dunn's analysis of the ruling was careful to note its narrow holding. The decision was fact-specific. The defendant acted without counsel's direction. The platform's privacy policy disclosed that user inputs could be used for model training and disclosed to third parties. The court applied traditional privilege principles, not new AI-specific rules.
But the implications are broad.
The court established that AI platform terms of service directly determine whether privilege attaches. A user's reasonable expectation of confidentiality is defeated by a privacy policy that permits data collection and third-party disclosure. That is not a ruling about AI. It is a ruling about what enters the permanent record when AI is used without careful attention to the infrastructure governing it.
Duane Morris summarized the core exposure: sharing otherwise privileged information with a consumer AI tool may waive privilege over the underlying communications. The AI output is not the only thing at risk. The privileged information that went into the prompt may itself be compromised.
The workflow architecture question
Judge Rakoff's opinion included a significant footnote. It noted that had counsel directed the defendant to use the AI tool, the tool might arguably have functioned in a manner akin to a professional agent within the protection of privilege.
That is an architectural signal, not just a legal one.
The difference between a privileged AI interaction and an unprivileged one is not the content. It is the workflow. Who directed the use. What platform governed it. What the platform's terms permit. Whether the interaction was structured as part of a professional engagement or conducted independently.
Organizations running AI in legal workflows need to treat every AI interaction as a potential record. Not because every interaction will be subpoenaed. Because the ones that matter will be, and the architecture that governed them at the time of use will determine whether privilege attaches.
The question is not whether your attorneys are using AI. They are. The question is whether the infrastructure governing that use is documented, controlled, and structured in a way that survives legal scrutiny.
What the permanent record now includes
Heppner established something that will compound across every subsequent AI privilege dispute: AI outputs are evidence. They enter the record. They can be seized, subpoenaed, and used.
That changes the calculus for every organization running AI on legal content. The output of an AI review is not a draft that disappears when the session ends. It is a document. It has a timestamp. It reflects what the AI was told and what it produced. And depending on the platform and the workflow, it may or may not be privileged.
The firms and legal departments that treat AI governance with the same rigor as cybersecurity and conflicts management are building infrastructure for this reality. The ones that treat it as a policy exercise are not.
The permanent record is not a future problem. Heppner is from February 2026. It is already here.
Sources
Gibson Dunn client alert (February 2026). https://www.gibsondunn.com/ai-privilege-waivers-sdny-rules-against-privilege-protection-for-consumer-ai-outputs/
Duane Morris client alert (March 2026). https://www.duanemorris.com/alerts/perils_privilege_waivers_through_ai_0326.html
