AI After Heppner: Ethics, Privilege, and Discovery Strategy
A federal court in New York ruled recently that a criminal defendant's AI interaction records were not privileged. The case, United States v. Heppner, has generated the predictable wave of commentary. Some are declaring the end of AI in legal practice. Some are dismissing it as an obvious result on unusual facts.
Both reactions miss the point.
Heppner is not a revolution in privilege doctrine. It is an illustration of how existing doctrine applies when a client uses consumer AI without attorney direction. The holding is narrow, the facts are specific, and it has no binding effect in Texas courts. But it hands Texas litigators two things worth paying attention to: a reminder of what your ethics rules already require, and a preview of the discovery argument you should be making (and defending against) right now.
What You're Already Required to Do
Before getting to Heppner, let's be direct about the existing obligations. The Texas Disciplinary Rules of Professional Conduct and the Professional Ethics Committee's recent guidance on AI are not aspirational. They are binding.
COMPETENCE: RULE 1.01
Comment 8 to Rule 1.01 requires lawyers to "strive to become and remain proficient and competent in the practice of law, including the benefits and risks associated with relevant technology." The Professional Ethics Committee's Opinion 705 (Feb. 2025) applies this directly to generative AI: if you use an AI tool in your practice, you must have "a reasonable and current understanding of the technology," including its hallucination risks, data handling practices, and limitations.
This is not an invitation to become a software engineer. It is a requirement to understand the tool well enough to supervise its output and protect your clients. Sanctions against attorneys for submitting AI-hallucinated citations, which we see in new cases seemingly every week, are what Rule 1.01 failures look like in practice. Opinion 705 specifically identifies that rule as implicated when a lawyer fails to verify AI output. The Northern District of Texas has already responded with LR 7.2(f), requiring AI disclosure in briefs filed there. Check your local rules and standing orders for every court where you practice.
CONFIDENTIALITY: RULE 1.05
This is where the Heppner case begins to, most directly, implicate the ethics rules. Rule 1.05 prohibits the disclosure of client confidential information. When you input client information into a consumer AI tool, for example ChatGPT; the individual or free tier of Claude; Google Gemini; Grok; or Microsoft Copilot consumer, you are potentially disclosing that information to a third party whose terms of service permit them to store your inputs, train their models on them, and disclose them to government authorities.
Opinion 705 sets the standard: before using any AI tool for client work, you must (1) acquire a general understanding of how the technology works; (2) review and potentially renegotiate the terms of service; (3) assess the data security protections; and (4) train your staff appropriately. The ABA's Formal Opinion 512 (July 2024) goes further, requiring specific informed client consent (not boilerplate engagement letter language) before inputting client information into self-learning tools.
The practical line is not complicated: free consumer tools are not appropriate for client work. Enterprise tools may be, depending on which tools. If your firm is running AI queries about client matters through a personal account on any major consumer platform, that practice needs to stop. Not because of Heppner, but because Rule 1.05 already required it. Opinion 705 analogizes this requirement to cloud based storage, specifically citing to Opinion 680. A cloud based storage solution that didn't protect your data would be as inappropriate a place to store client files as a filing cabinet in your parking lot. Despite that obvious reality, we have seen cloud storage become ubiquitous, which tells us that AI use, with proper controls, certainly can pass muster from an ethics perspective.
Heppner: The Ruling, Its Limits, and What It Actually Decides
WHAT HAPPENED. Bradley Heppner, founder and CEO of a financial services company, was indicted in October 2025 on federal securities fraud, wire fraud, and related charges. Before his arrest, after receiving a grand jury subpoena and while aware he was a target of the investigation, Heppner independently used Anthropic's Claude to run queries about the government's case and his potential defenses. He later shared the AI outputs with his defense counsel at Quinn Emanuel Urquhart & Sullivan.
The government obtained those records through a search warrant executed at Heppner's arrest. When Heppner tried to shield them under attorney-client privilege and the work product doctrine, Judge Jed Rakoff granted the government's motion from the bench on February 10, 2026, and followed with a 12-page written Memorandum on February 17, 2026 (Dkt. 27). It is the most thorough judicial analysis of AI and privilege to date.
THE FOUR ATTORNEY-CLIENT PRIVILEGE FAILURES. The court held that the attorney-client privilege failed on every element:
- No attorney was involved. The AI tool is not a lawyer, and as the court put it, "that alone disposes of Heppner's claim of privilege." The court rejected the argument that AI inputs are analogous to using cloud-based word processors, reasoning that cloud applications "are not intrinsically privileged in any case" and that all recognized privileges require "a trusting human relationship" with "a licensed professional who owes fiduciary duties and is subject to discipline." See Ira P. Robbins, Against an AI Privilege, JOLT Dig., Harvard L. Sch. (Nov. 7, 2025). The Kovel doctrine (which permits privilege to extend to non-attorney third parties retained by counsel to facilitate legal advice) was unavailable because defense counsel expressly admitted it did not direct the AI use. But the court left a door open: had counsel directed Heppner to use Claude, "Claude might arguably be said to have functioned in a manner akin to a highly trained professional who may act as a lawyer's agent within the protection of the attorney-client privilege." Kovel requires attorney direction. Where the client acts entirely on his own initiative, Kovel is off the table. But the pathway for attorney directed AI use remains.
- No confidential purpose. Anthropic's published terms expressly state that Claude is not providing legal advice and that users should consult a qualified attorney. A defendant cannot claim he used a tool for the purpose of obtaining legal advice when the tool itself disclaimed that purpose in writing.
- No confidentiality. Anthropic's Privacy Policy in effect at the time of Heppner's searches permitted collection of prompts, training on inputs, and disclosure to governmental authorities. The court noted this directly: the defendant "disclosed it to a third-party, in effect, AI, which had an express provision that what was submitted was not confidential." Confidentiality is an element of the privilege, not an optional add-on.
- No retroactive privilege from transmittal to counsel. Sharing pre-existing, non-privileged documents with your attorney does not make them privileged. This is settled law the court applied without hesitation.
THE WORK PRODUCT RULING. On work product, the court focused on the policy rationale of the doctrine: its purpose is to protect the mental strategies of counsel in anticipation of litigation. The court's key distinction, and the most analytically useful piece of the ruling, was the difference between documents that reflect counsel's strategy at the time of creation versus documents that merely affected counsel's strategy after the fact. Independent client-side AI research does the latter, not the former. Defense counsel conceded that the use of AI was not at their direction.
The written memorandum resolved two questions the bench ruling left open. First, the court addressed defense counsel's reliance on Shih v. Petal Card, 565 F. Supp. 3d 557 (S.D.N.Y. 2021), which held that attorney direction is not required for work product protection. Judge Rakoff "respectfully disagrees," creating an intra-district split that may eventually reach the Second Circuit. Second, the court found Federal Rule of Criminal Procedure 16(b)(2)(A) inapplicable because the AI Documents were seized via search warrant, not produced in pretrial discovery. In civil litigation, where AI records would be obtained through discovery requests rather than a warrant, analogous arguments to the Rule 16 argument may be more persuasive.
THE LIMITS OF THE RULING. Three cautions before you overread Heppner:
- First, while the written memorandum gives Heppner substantially more persuasive weight than a bare bench ruling, it remains a single district court opinion. It is not controlling anywhere, including in Texas. It is the most detailed judicial treatment of AI and privilege to date, but it is one judge's analysis of one set of facts.
- Second, the facts are specific to client-only, consumer-tool, no-attorney-direction use. The court expressly stated that had counsel directed Heppner to use Claude, the AI tool "might arguably be said to have functioned in a manner akin to a highly trained professional who may act as a lawyer's agent." Attorney-directed AI use is a different question, and Heppner does not answer it.
- Third, Texas work product doctrine is categorically stronger than the federal standard applied in Heppner. Texas has no compelling need exception. Riggs v. Sentry Ins., 821 S.W.2d 701, 710 (Tex. App.—Houston [14th Dist.] 1991, writ denied). The crime-fraud exception in Texas requires document-by-document nexus between each privileged document and the alleged fraud. In re Tex. Health Res., 472 S.W.3d 895, 904 (Tex. App.—Dallas 2015, no pet.). A blanket demand for all AI records fails the nexus requirement regardless of what Heppner says.
WHAT HEPPER DOES NOT THREATEN, AND WHY KOVEL MATTERS. When an attorney uses AI as part of their own legal work (prompting for research strategy, drafting arguments, analyzing case theory) those interactions are the attorney's mental impressions and legal theories, squarely within the near-absolute protection afforded opinion work product. Hickman v. Taylor, 329 U.S. 495, 510-11 (1947). The "affect vs. reflect" distinction that Heppner used against the defendant actually cuts in the attorney's favor: an attorney's prompts reflect legal strategy at the moment of creation. They are the paradigm case of protected work product. The key is using the right tools (business grade, with confidentiality protections) so the confidentiality element is not undermined before the privilege question is ever reached.
But there is a broader framework here that Heppner points to without resolving: United States v. Kovel, 296 F.2d 918 (2d Cir. 1961). Kovel is the foundational case holding that attorney-client privilege can extend to communications with non-lawyer agents (accountants, consultants, interpreters) when the non-lawyer's participation is necessary for the attorney to provide effective legal advice. Judge Friendly's reasoning was straightforward: an accountant translating complex financial information into terms the lawyer can use to advise the client is functionally identical to a foreign-language interpreter. The privilege covers the communication because the intermediary is necessary for the attorney-client relationship to function.
The Kovel requirements are: (1) the non-lawyer must be acting as the lawyer's agent; (2) the communication must be made in confidence; (3) the purpose must be to facilitate the lawyer's provision of legal advice; and (4) the lawyer must have directed or authorized the engagement. If what the client seeks is the non-lawyer's own advice, rather than using the non-lawyer to help the lawyer, no privilege exists.
Heppner failed every Kovel requirement. The client acted without attorney direction, used a consumer platform with no confidentiality protections, and sought the AI's advice rather than using it as a conduit to counsel. But Judge Rakoff's written opinion explicitly acknowledged that had counsel directed the AI use, the Kovel pathway would be viable. That matters, because it tells you what to build toward.
The Kovel framework arguably fits the AI context. Theoretically an attorney could direct a client to use an appropriate AI tool to organize facts, prepare a chronology, or develop a narrative for counsel's review and invoke the protections Kovel contemplates: using a non-lawyer intermediary to help the lawyer do their job. Whether this qualifies will come down to whether the court in that case believes that an AI tool can qualify as something that can in fact hold the privilege. In order for the privilege to follow, the three structural requirements of Kovel must be met: attorney direction, legal purpose, and confidentiality. Additionally, Kovel has some limitations in the Fifth Circuit and has historically been applied to people whom the attorney works with, which could preclude the application of Kovel in this context. The attorney's use of AI doesn't have this same concern as attorney use of AI doesn't have the same concern about how the use is classified as an attorney's use is protected if AI is treated as a notepad, software, or an agent under Kovel.
The more conservative choice would be to inform your clients of the risk of their use of AI and then encourage them to provide you the relevant information so that you and your staff, the people with whom the privilege certainly extends, use the AI tool.
What This Means for Your Practice
WHAT YOU SHOULD BE TELLING YOUR CLIENTS. Have the AI conversation at intake, not after the first discovery response lands on your desk. Make sure they understand the risk of their use of AI and decide what risk level you and the client are willing to accept as the representation progresses.
Ask every new client, and every existing client in active litigation, whether they have used any AI tool in connection with the matter. Find out what tool, what platform, when they used the tool, and what they entered. Understanding what is out there early in the representation will be better for both you and your client.
Prospectively, your engagement letter needs a specific AI counseling clause. Not a boilerplate "we may use technology tools" provision, but a specific clause regarding the risks of client use of AI, and the terms under which you will use AI. Personally, I explain to clients that this area of law is rapidly evolving and that their use of AI carries with it significant risks of disclosure. I also let them know up front that their use of AI is unlikely to save them money as I will need to check it, which could take as long or longer than it would for me to have done the work in the first place. I also explain my use of AI and why, and under what circumstances, I would do so.
The two problems that cost clients the most money are ones they create without realizing it. First, clients who vent to AI after an incident create a timestamped written record of their immediate emotional processing, including admissions, expressions of uncertainty about fault, or statements inconsistent with what they'll say at deposition. This is the same issue with a diary, just that AI talks back and encourages your client to keep talking. Second, clients who research their case through AI before meeting with you come in having decided what matters based on AI's generic assessment of relevance. You are then working from an AI-filtered account of the facts rather than an unfiltered one. This has the obvious risks and is just the newest version of the "I asked my friend" or "I Googled it" issues of the past. Both problems are fixable with early, direct counseling.
DISCOVERY: THE OPPORTUNITY YOU MAY BE LEAVING ON THE TABLE. Heppner confirms what privilege doctrine already told us: client-only AI use on consumer tools is not protected. For a Texas civil litigator, that means interrogatories now routinely belong in your written discovery and requesting the prompts isn't outside the realm of reason (the other rules and limitations of discovery not withstanding).
The pre-litigation AI use is the richest discovery target. A plaintiff who used AI in the weeks after an incident to research their exposure, explore theories of liability, or discuss their claimed "trauma" may have generated records that contain prior inconsistent statements, acknowledgments of contributing fault, or an analysis of damages that differs substantially from the damages theory presented at trial. Those records are not privileged. They predate any attorney-client relationship, they were entered into consumer tools with permissive disclosure terms, and they fall squarely within Heppner's analysis.
One important tactical note: Texas courts have strict rules regarding discovery of ESI, which would almost certainly include AI input and output. Further, AI output is almost de facto irrelevant except as res gestae of the user's own inputs. The user doesn't control that output and can't/shouldn't be held to that standard, but their input is fair game the same way their diary entry for the day of the incident would be. Targeted requests for specific time periods and subject matters are far more likely to be successful than a general demand for "all AI conversations" the party ever had. The requests will also be more effective if seeking relevant information. Seeking communications with AI made by a plaintiff related to the plaintiff's mental state is certainly relevant in a case where the plaintiff is arguing mental anguish. The same cannot be said for a defendant who is making no claim for those damages.
The Bottom Line
Heppner did not change the law. It isn't revolutionary. It illustrated the law, applied to a set of facts where the outcome was never in serious doubt. The more useful thing it did was put a concrete courthouse story behind what ethics opinions and privilege doctrine have been saying for years: consumer AI tools are not confidential, client-only AI use is not privileged, and the records exist whether you asked for them or not.
Utilize appropriate AI tools, supervise your staff, communicate with your clients, and think critically about their use of AI. The lawyers who build this into their standard practice now will be ahead of the ones who figure it out after their client's AI records show up in a document request.
DISCLAIMER: This post reflects Mark Altman's analysis of the Texas Disciplinary Rules of Professional Conduct and related authority as of the date of publication. It is intended for informational purposes for Texas-licensed attorneys and does not constitute legal advice or a formal ethics opinion. If you are facing a disciplinary matter, consult counsel.
Mark Altman is an attorney at Naman, Howell, Smith & Lee, PLLC in Waco, Texas. His practice focuses on personal injury litigation in Texas state and federal courts. He is also a reserve Navy JAGC officer. To learn more about Mark Altman, please visit his website bio HERE.
For more information about Naman Howell legal capabilities, please visit HERE.
About Naman Howell
Since 1917, Naman Howell Smith & Lee has provided individuals and businesses throughout Texas with the personal attentiveness and expertise they need on their legal matters when they need it most. We pride ourselves on our heritage, vision, and exceptional results. For more information about Naman Howell, please visit namanhowell.com.
