In United States v. Heppner, No. 25 CR. 503 (JSR) (S.D.N.Y. Feb. 17, 2026), Judge Jed Rakoff held that documents generated using a consumer AI platform were not protected by attorney-client privilege or the work-product doctrine. The court identified two independent grounds: (1) An AI platform is not an attorney and cannot form an attorney-client relationship; (2) there was no reasonable expectation of confidentiality because Anthropic's privacy policy expressly permits data use for model training and disclosure to government authorities. The court noted that enterprise tools with contractual confidentiality protections may present a different analysis — and on-premise deployment, where no third party ever receives the data, resolves the concern entirely at the architectural level.

The holding arose in a criminal context, but the underlying privilege analysis — that disclosing information to a consumer AI platform destroys confidentiality — applies equally in civil litigation and regulatory matters. Multiple state bars have issued guidance cautioning lawyers about using consumer AI with client data, citing confidentiality obligations under Model Rule 1.6. The Heppner decision is the first federal court ruling on this issue but will be broadly cited as persuasive authority. Practitioners should assume the privilege risk exists in any context.

Enterprise agreements change the contractual landscape — vendors agree not to train on your data and provide stronger confidentiality terms. The Heppner court explicitly noted these tools may present a different privilege analysis. However, even with enterprise contracts: (1) client data still travels to the vendor's servers; (2) you are dependent on the vendor's security posture and compliance; (3) the vendor can still be served with legal process. On-premise eliminates all three risks simultaneously. For the highest-sensitivity client matters, on-premise is the only architecture where confidentiality is guaranteed by physics, not contract.

Model Rule 1.1 Comment 8 requires attorneys to understand "the benefits and risks associated with relevant technology." Using consumer AI with client data — now that Heppner has confirmed the privilege risk — creates a competence issue if attorneys proceed without appropriate safeguards. An on-premise AI server directly satisfies the confidentiality preservation obligation: there is no third-party transmission, no training risk, and no exposure to government process through the AI vendor. Several state bar associations have issued guidance specifically recommending attorney-directed, non-consumer AI tools for sensitive client work.

Yes — and this is an important nuance. The Heppner court noted that if counsel had directed the client to use the AI tool for the research, the work-product analysis might have differed. On an eRacks firm server, all AI use is under the firm's infrastructure and effectively under the direction of the supervising attorneys. This strengthens work-product arguments significantly compared to clients using consumer tools on their own initiative. For formal work-product protection, document that AI use is attorney-directed by building it into your matter intake and retainer documentation.