In February, in a federal courtroom in Manhattan, one of the oldest protections in law met an AI chatbot, and lost.
The case is United States v. Heppner. Bradley Heppner, a financial services executive facing fraud charges, used the free consumer version of Claude, Anthropic's chatbot, to work through his legal situation. He generated thirty-one documents and shared them with his defence team. The FBI seized his devices. The government moved to take the documents.
Judge Rakoff let them. Privilege protects confidential communication between a client and a lawyer. Because Claude is not an attorney, the court said, that alone disposed of the claim. And Anthropic's consumer privacy policy reserved the right to retain what he typed, train on it, and disclose it to regulators and other third parties. A man who accepts those terms has no reasonable expectation of confidentiality. He has, in the judge's phrase, disclosed it to a third party (US District Court, 2026).
Privilege is only the most explicit version of a promise every confidence-bound profession makes.
The banker's duty of secrecy. The doctor's duty to the patient. The auditor's duty to the client. All of them rest on one load-bearing wall: the confidence holds only while it stays between named parties who owe the duty. Let a third party in and the structure that protected the information stops existing. Not weakens. Stops.
So here is what I would ask you to carry away: a prompt to public AI is a disclosure to a third party.
The law is not settled, and I will not pretend it is.
On the same day, a court in Michigan reached the opposite result in a civil case, holding that a public chatbot is a tool rather than a person, and a Colorado court agreed in March (Perkins Coie, 2026). But look at what is actually split. Those rulings turn on work product, which is forfeited only by disclosure to an adversary. Attorney-client privilege is forfeited by disclosure to almost anyone (White & Case, 2026). On privilege itself, no court has contradicted Heppner. The chatbot is still not a lawyer.
Judge Rakoff did leave one door open. Had counsel directed the use, he noted, Claude might have functioned as the lawyer's agent, the way a translator or an accountant can sit inside the privilege. The door is there. Walking through it takes deliberate structure, not an executive opening a browser tab. Courts have meanwhile started writing AI into their protective orders, pushing litigants towards closed and secure systems and away from open commercial ones (Sidley Austin, 2026).
So the doctrine is moving.
But notice what is being litigated. No court is asking whether AI use can destroy confidentiality. They are asking when, and under what architecture it does not.
Meanwhile, your people are already doing it.
Around 45% of staff use generative AI, 77% of them paste data into it, and 82% of that pasting happens through personal accounts nobody can see (LayerX, 2025). Only about 17% of organisations have any technical means of stopping it (Kiteworks, 2025). Samsung and JPMorgan tried bans. The bans failed, for a reason I have written about before. You cannot policy your way out of a tool that makes capable people faster.
The way through is architectural, because the problem is architectural.
The confidence dies when a third party can read the material. So the only answer is a system where no third party can. If the AI runs inside your own environment, or inside a sealed enclave that is cryptographically closed to everyone including the operator, then nobody is in a position to read your work, and you can prove nobody was. The disclosure that killed the protection in that Manhattan courtroom never happens, because there is no third party to disclose to.
Let me be precise, I am not giving legal advice, and no vendor, ours included, can promise you a court will uphold privilege in your matter. That will always be your counsel's argument to make. What I am saying is narrower. The architecture determines the facts your counsel has to argue with. A lawyer defending a disclosure to a public chatbot is arguing uphill against Heppner. A lawyer pointing to a sealed environment, with cryptographic evidence that no third party could reach the material, is standing somewhere else entirely. You do not choose the judge. You do choose the facts.
We spend the first 30 minutes with any organisation doing one thing: mapping where its confidential work actually goes today, and what it would take to hold it provably. If you do not like what you find, you have lost half an hour and gained a map.
The professions this is written for are all in the same business.
People bring them the things they cannot afford to have known, and pay for the keeping. That trade has survived every technology since the sealed letter. It will survive this one too, in the organisations that understood early that a prompt is a disclosure, and built accordingly.
Ferdie Pieterse is the Chairman of PrivateBox and the former Chief Executive Officer of Experian Africa.
References
Kiteworks (2025) The 2025 AI Security Gap. Available at: https://www.kiteworks.com/cybersecurity-risk-management/ai-security-gap-2025-organizations-flying-blind/ (Accessed: 12 July 2026).
LayerX (2025) Enterprise AI and SaaS Data Security Report 2025. Available at: https://layerxsecurity.com (Accessed: 12 July 2026).
Perkins Coie (2026) Heppner and Gilbarco: Courts Apply Privilege and Work Product Protection to Generative AI Tools. Available at: https://perkinscoie.com/insights/update/heppner-and-gilbarco-courts-apply-privilege-and-work-product-protection-generative (Accessed: 12 July 2026).
Sidley Austin (2026) Generative AI in Discovery: Protective Orders as an Emerging Point of Dispute. Available at: https://datamatters.sidley.com/2026/04/06/generative-ai-in-discovery-protective-orders-as-an-emerging-point-of-dispute/ (Accessed: 12 July 2026).
United States District Court, Southern District of New York (2026) United States v. Heppner, No. 25-cr-00503 (JSR), bench ruling 10 February 2026, written opinion 17 February 2026, 2026 WL 436479. Available at: https://harvardlawreview.org/blog/2026/03/united-states-v-heppner/ (Accessed: 12 July 2026).
White & Case (2026) Attorney-client privilege and work product in the age of generative AI. Available at: https://www.whitecase.com/insight-alert/attorney-client-privilege-and-work-product-age-generative-ai (Accessed: 12 July 2026).