Beyond AI Policy: What to Tell Your Clients After Heppner

Each enterprise ought to have a shopper AI coverage, however understanding the intersection of AI and attorney-client privilege is now a essential requirement for authorized safety.

Key Takeaways:

Shopper-grade AI instruments like free Claude, Geminia and ChatGPT platforms don’t assure the confidentiality required to take care of privilege.

Courts might rule that purchasers utilizing AI with out particular path from authorized counsel waive legal professional work-product protections.

For attorneys, coming into confidential consumer data right into a shopper AI software can violate ABA Mannequin Rule 1.6(c).

To guard attorney-client privilege within the age of AI, corporations should counsel purchasers on the dangers of utilizing commercial-grade AI instruments.

Defending Lawyer-Shopper Privilege After the Heppner Ruling

A written prohibition on the usage of shopper AI instruments is a sticky notice on an unlocked door. It doesn’t forestall entry. Contracts, technical controls, coaching and enforcement should reinforce the coverage—or it stays paper.

In United States v. Heppner, No. 25 Cr. 503 (S.D.N.Y. Feb. 17, 2026), a financial-services CEO charged with securities fraud used the free shopper model of Anthropic’s Claude to investigate his authorized publicity. He acted on his personal, with out his legal professionals’ path. A few of his prompts included data he had obtained from counsel. When prosecutors sought the AI-generated paperwork, the court docket ordered them produced, rejecting each privilege and work-product safety. Claude just isn’t an legal professional. Anthropic’s shopper phrases disclaimed confidentiality. And the supplies weren’t ready at counsel’s path.

However the court docket left room for a special final result: had counsel directed the defendant to make use of Claude by a platform with correct confidentiality phrases, the consequence might need been totally different. That distinction, shopper versus enterprise AI, frames the recommendation that follows.

The Danger Extends Past Privilege and Work Product

Shopper AI platforms might, underneath their default phrases, retain consumer inputs, practice on them, and disclose information to 3rd events. The patron phrases that helped defeat privilege in Heppner can even compromise commerce secrets and techniques, breach NDA obligations, or expose regulated private information. For legal professionals, the priority runs deeper: coming into confidential consumer data right into a shopper AI software might violate ABA Mannequin Rule 1.6(c), which requires cheap efforts to stop unauthorized disclosure of data referring to the illustration.

In case your purchasers use AI for something involving confidential or delicate data, a coverage marks solely the start line. Here’s what to inform them.

Determine the info going into the software. Shopper staff could also be coming into deal phrases, private data, litigation technique, monetary projections, or regulatory supplies, every carrying totally different authorized obligations. Assist purchasers classify what their persons are placing into AI instruments.

Assessment the AI platform phrases. Provide to overview the phrases with the consumer. Look particularly at provisions on information retention, coaching on inputs, human overview, and third-party disclosure. The phrases ought to bar coaching on buyer information, limit supplier entry, and impose confidentiality commitments. Look ahead to carve-outs that might weaken a confidentiality argument, together with provisions for anonymized information, security overview, or service enchancment.

Use enterprise-grade AI for confidential and authorized work. Advise purchasers that consumer-tier plans might lack essential protections. Shopper phrases usually allow information retention and supplier entry that enterprise agreements prohibit. Enterprise plans usually add audit logs, customized data-retention controls, and negotiated business phrases.

Deploy technical controls. Suggest that purchasers work with IT to dam shopper AI domains on firm networks and managed gadgets and so as to add data-loss-prevention instruments that scan for delicate information despatched to AI platforms. No single management is hermetic. Workers on private gadgets or off-network connections can bypass company gateways. However layered defenses cut back publicity.

Make authorized instruments straightforward to make use of. Comfort is gravity. If the enterprise software requires three logins and a VPN, staff will probably flip as an alternative to the patron various.

Practice the individuals who deal with confidential data. Coaching ought to attain past the authorized crew. Each worker who handles confidential data ought to perceive the road between enterprise and shopper AI and know that what they kind into an AI software might later be produced in discovery.

Ask about prior AI use. On the outset of any authorized, regulatory, or compliance matter, ask whether or not anybody used AI instruments to investigate or talk about the problem. Prior consumer-AI use might have compromised privilege earlier than the matter reached you. Make this query as routine because the litigation-hold discover.

Replace litigation-hold and preservation protocols. AI interactions are ESI topic to preservation obligations and discovery requests. Chat logs, uploaded paperwork, exported information, and AI-generated summaries ought to all be coated by litigation-hold notices and retention insurance policies.

Closing the Hole to Hold Confidential Shopper Data Secure

AI use raises challenges effectively past information safety, from hallucinations to the dangers of agentic instruments. The steps above concentrate on one side of AI danger: preserving confidential and delicate data out of the improper platforms.

AI use can fall outdoors the authorized protections many customers assume exist. Firms that shut that hole can be ready when confidential data is challenged, data are demanded, or regulators come calling. People who wait might confront the results in discovery, in a disciplinary continuing — or each.

Frequent Questions About Utilizing AI and Authorized Privilege

Featured Picture © iStockPhoto.com