A Manhattan federal judge says attorney client privilege requires a human relationship AI cannot supply, so even sharing the chatbot's answers with your lawyer later does not make the underlying queries confidential.
Attorney-client privilege does not attach to a defendant's AI legal research simply because he later forwards the chatbot's answers to his lawyer, a federal judge in Manhattan has ruled in what Gibson Dunn and O'Melveny are calling the first decision of its kind on consumer AI tools and legal confidentiality.
In US v. Heppner, No. 1:25-cr-00503 (S.D.N.Y.), Chief Judge Jed S. Rakoff held in a written opinion filed February 17, 2026 that a criminal defendant's AI-generated search history was neither protected by the attorney-client privilege nor shielded as attorney work product, and was therefore discoverable by prosecutors in the underlying fraud investigation. The recap of the ruling carried by JD Supra gives the same bottom line: the AI queries could be turned over to the government.
The defendant had argued that the AI queries should be withheld because he later shared the results with his defense counsel. The court rejected that retroactivity theory outright. Privilege, the judge explained, requires a pre-existing trusting relationship with a licensed professional who owes fiduciary duties and is subject to professional discipline, a relationship no AI tool can supply. The privilege protects a relationship, not a content stream, so it cannot be built up after the fact by forwarding an AI's output to a lawyer.
The court applied the same logic to the work-product doctrine, which protects materials prepared in anticipation of litigation. Because the AI searches were not directed by counsel and were not conducted for the purpose of obtaining legal advice (an act that, by definition, only a human attorney can perform), the materials did not qualify as work product either. Both prongs of the defendant's confidentiality argument failed at the structural level.
The practical consequence for lawyers and clients is uncomfortable but concrete. From now on, the privilege analysis turns on the moment of the AI query, not the moment of disclosure. A client who runs legal questions through a chatbot before talking to a lawyer has, in the court's framing, done something closer to a Google search than a confidential consultation, and the resulting record is fair game in discovery.
That makes the order of operations matter. If a lawyer had directed the search under a pre-existing attorney-client relationship, the analysis might have come out differently, because the foundational human relationship would already exist. The ruling's reach, however, stops at the facts presented: an individual defendant running consumer AI tools on his own, without a lawyer in the loop at the time of the query.
Both Gibson Dunn and O'Melveny have described the holding as a first-of-its-kind ruling on consumer AI outputs in criminal discovery. The Harvard Law Review blog is treating it as a precedent-setting development for AI's place in legal proceedings. The underlying case has been posted by the SDNY U.S. Attorney's Office and tracked on PACER, with the controlling opinion text available through the CourtListener recap PDF.
The boundaries are worth marking. Heppner is a district-court opinion, so it is persuasive rather than binding outside the Southern District of New York, and other judges may distinguish it as AI-in-discovery questions multiply. The reasoning also centers on consumer-facing tools; bespoke AI workflows run inside a law firm, or queries a defense attorney directs in the course of representing a client, are likely to be analyzed under a different framework.
The watch item is whether other courts follow the same human-relationship logic, and whether the next cases push on the timing question: at what point does a defendant's pre-existing attorney-client relationship cover the AI work done under the lawyer's direction?