On February 17, 2026, the U.S. District Court for the Southern District of New York issued a significant ruling in United States v. Heppner, No. 25 Cr. 503 (S.D.N.Y.). In this case, the court held that written exchanges between a criminal defendant and a publicly available generative AI platform (Anthropic’s Claude tool) were not protected by the attorney‑client privilege or the work product doctrine.
The court’s decision reinforces several key principles:
- Communications with a generative AI platform are not communications with an attorney and therefore do not satisfy the requirements of attorney‑client privilege.
- Use of a publicly available AI tool constitutes disclosure to a third party, eliminating any reasonable expectation of confidentiality.
- Materials generated using AI independently by a user—and later shared with counsel—do not become privileged retroactively.
This ruling is one of the first federal decisions to directly address how long‑standing privilege doctrines apply to modern generative AI tools. It highlights the legal risks associated with entering sensitive, strategic, or confidential information into publicly available AI platforms.
Why This Matters for Regulated Entities
For organizations subject to regulatory oversight, enforcement actions, audits, or investigations, this ruling reinforces a critical risk consideration: AI prompts, inputs, and outputs may be discoverable records.
Use of generative AI tools—especially public or third‑party platforms—may implicate:
- Confidential supervisory information
- Protected health, safety, or financial data
- Compliance analyses or investigative materials
- Litigation strategy or regulatory response planning
Without appropriate safeguards, such information may be exposed in ways inconsistent with regulatory expectations or internal compliance frameworks.
What You Should Do Now
Regulated organizations should consider the following actions in response to this ruling:
- Evaluate AI use through a compliance lens. Identify whether generative AI tools are being used in legal, regulatory, compliance, audit, incident response, or investigative contexts.
- Restrict use of public AI tools for sensitive matters. Treat generative AI platforms as third‑party service providers when assessing confidentiality, data handling, and disclosure risks.
- Update policies and training. Ensure employees understand that AI‑generated content may not be privileged and may be subject to discovery, record‑retention, or regulatory review.
- Coordinate with legal and compliance leadership. Align AI governance with existing regulatory obligations, including documentation, escalation, and oversight requirements.
- Strengthen governance and controls. Consider whether current AI policies adequately address risk classification, approval workflows, monitoring, and auditability.
EHS Support’s Approach to AI
At EHS Support, this ruling reinforces our conservative, compliance‑aligned approach to artificial intelligence:
- AI is not used in client work product. Its use is limited to internal purposes such as data analysis, process automation, and quality assurance.
- Confidentiality, accountability, and trust are foundational. Our AI usage policy is designed to mitigate legal, regulatory, privacy, and security risks.
- Governance and oversight are integral. Any internal AI use is subject to structured review, risk assessment, and ongoing monitoring.
Looking Ahead
As regulators and courts increasingly examine how emerging technologies intersect with established legal and compliance frameworks, organizations—particularly those in regulated sectors—should reassess AI usage with care.
We will continue to monitor developments in this area and align our practices to responsibly support innovation while protecting our clients’ regulatory and compliance interests.
Please contact us if you would like to discuss how this ruling may affect your organization or AI governance practices.
Regulatory Disclaimer
This advisory is provided for general informational purposes only and does not constitute legal advice, regulatory advice, or a legal opinion. It is not intended to create, and should not be relied upon as creating, an attorney‑client relationship. Organizations should consult with qualified legal counsel or compliance professionals regarding the application of this information to their specific facts, regulatory obligations, or risk profiles. Regulatory requirements and legal interpretations may vary by jurisdiction and are subject to change.
