In February, the Southern District of New York decided United States v. Heppner. If you haven't read it yet, you need to. It's not a technology case. It's a competence case, and it's going to reshape how every litigator in the country thinks about the tools sitting open on their desktop.

The holding: communications between a litigant and a consumer-facing AI tool — ChatGPT, Claude, whatever your client or your team is using — fall outside attorney-client privilege and may be discoverable in civil and criminal proceedings. Not "might be." The court walked through three reasons. The AI is not an attorney, so privilege never attached in the first place. There is no reasonable expectation of confidentiality, because consumer terms of service permit retention, training, and disclosure. And the material wasn't prepared under counsel's direction, so work product protection doesn't apply either.

Sit with that for a second. Every time a client pastes a deposition transcript into a general-purpose AI tool to get help drafting a response, every time an associate runs a strategy memo through ChatGPT to tighten the language, that material may now be fair game for the other side.

This is not a hypothetical anymore

I've spent 25 years trying high-conflict cases. I've watched good lawyers lose credibility — not because their legal position was weak, but because their process couldn't survive a judge asking a simple question: how was this built, and who verified it? Heppner just added a new version of that question, and it applies whether or not you personally use AI. Your clients are using it. Your associates are using it. If nobody in the room understands the architecture, the exposure exists regardless of intent.

The practical implication is that Model Rule 1.1, competence, and Model Rule 1.6, confidentiality, now require lawyers to understand the data architecture of any tool that touches client information — not just whether the output is accurate, but where the input goes, who can see it, and whether it's being used to train someone else's model.

What "walled garden" actually means

This is the phrase you're going to hear a lot over the next year, and it's worth understanding precisely instead of taking it on faith. A walled-garden architecture means client data entered into a system stays contained to that matter, under attorney control, and is never used to train the underlying model or exposed to third parties. It's the difference between handing your client's evidence to a public utility and keeping it inside a system that behaves like an extension of your file room.

Before you or your team runs anything client-related through an AI tool, ask three questions. Is the workflow attorney-controlled? Is the data protected, contractually and architecturally, from third-party access and model training? Is it built in a way you could actually explain to a judge if asked? If you can't answer all three with confidence, treat every output as if it just became discoverable, because after Heppner, it may well be.

Where this leaves your practice

I built SLAY AI because I kept watching lawyers get exposed in court for things that had nothing to do with the merits of their case — disorganized records, unclear timelines, and now, increasingly, AI used without guardrails. The privilege-preserving architecture isn't a feature I added on. It's the reason the product exists in its current form.

Courts aren't afraid of AI. They're afraid of lawyers who don't understand the tools sitting in front of them. Heppner is the clearest signal yet that "I didn't realize" stopped being a defense the moment the ruling came down.

Rebecca Zung is a 25-year trial attorney and the founder of SLAY AI, a privilege-preserving legal leverage platform built for high-conflict litigation.