The Kovel Privilege Playbook

Part IThe problem

Millions of people use public AI tools — Claude, ChatGPT, Gemini — to think through legal problems. They draft timelines of workplace incidents. They ask whether a lease clause is enforceable. They rehearse what to say to a prosecutor, a spouse's attorney, an insurance adjuster. They write out settlement scenarios. They process their own worst fears.

In nearly every one of these conversations, the user believes — reasonably — that they are typing into a confidential tool. They are not. Until United States v. Heppner, there was plausible ambiguity about how courts would treat this pattern of use. That ambiguity is now gone.

The Heppner ruling, in brief

Michael Heppner, a defendant in a federal wire-fraud case in the Southern District of New York, used public Claude over roughly three months to draft chronologies, analyze his exposure, rehearse defenses, and work through settlement scenarios. When the FBI executed a cloud-storage warrant, those conversations were produced alongside his other records. Heppner moved to suppress the transcripts as privileged.

“Had counsel directed Heppner to use Claude, Claude might arguably be said to have functioned in a manner akin to a highly trained professional who may act as a lawyer's agent within the protection of the attorney-client privilege.” — Judge Jed S. Rakoff, United States v. Heppner, S.D.N.Y. No. 25-cr-00503-JSR (Feb. 17, 2026)

Judge Rakoff denied the motion. The court did not find that AI conversations are categorically undeserving of privilege; it found that they are not privileged when the following preconditions are missing:

1. No attorney directed the client's use of the AI tool;
2. No engagement letter or record of an attorney-client relationship was in place contemplating that use;
3. The platform's terms of service expressly permitted disclosure under legal process and permitted use of inputs for model training;
4. No fiduciary or confidentiality duty ran from the AI provider to the user;
5. No contemporaneous documentation treated the interactions as legal work product.

Every one of these preconditions is missing for a user signing up to ChatGPT or Claude on a consumer plan and using it to think through a legal situation. That is, effectively, tens of millions of people.

The privilege gap in everyday AI use

To be clear about what is now discoverable when people use public AI tools for legal thinking:

• The full transcript of what they typed and what the model responded, in any civil discovery where those transcripts are relevant;
• The same transcripts, via grand jury subpoena or criminal search warrant, in any criminal investigation;
• The transcripts, via subpoena to the AI provider, where the provider retains them under its terms;
• The transcripts, via subpoena to the user's cloud backup of chat history;
• The user's mental impressions, drafts, strategies, and legal vulnerabilities — effectively an external record of their internal deliberation.

Part IIThe legal framework, in theory

The Heppner opinion is not only a problem — it is also, in its last several paragraphs, an operating manual. Judge Rakoff described exactly what would have been required for the transcripts to be protected. This Part summarizes the doctrines at issue, then assembles them into a theoretical framework that couldprotect a user's AI interactions. Part III describes how Kovel operationalizes that framework.

Attorney-client privilege

Attorney-client privilege protects confidential communications made for the purpose of seeking or rendering legal advice. The classic modern statement is from Upjohn Co. v. United States, 449 U.S. 383 (1981). The core elements, stated here in the form most often applied in federal practice, are:

1. A communication,
2. Made in confidence,
3. Between client and attorney (or their agent),
4. For the purpose of seeking or rendering legal advice,
5. That is not waived.

Each element matters. Privilege does not attach merely because a lawyer is somewhere in the chain. It attaches because the communication was in service of obtaining legal advice, was kept confidential, and involved (directly or through an agent) an attorney-client relationship.

Work-product doctrine

Where privilege protects communications, work product protects materials prepared in anticipation of litigation. Fed. R. Civ. P. 26(b)(3) protects “documents and tangible things” prepared by or for a party or its representative in anticipation of litigation. Opinion work product — mental impressions, conclusions, legal theories, and strategies of a party's attorney or other representative — receives the strongest protection, with the Supreme Court treating it as nearly absolute in Upjohn and Hickman v. Taylor, 329 U.S. 495 (1947).

AI-assisted research conducted at the direction of counsel — chronologies, outlines, analyses of legal options, drafts of possible responses — maps naturally onto the work-product doctrine.

The Kovel doctrine

United States v. Kovel, 296 F.2d 918 (2d Cir. 1961), addressed a narrow but fundamental question: when a lawyer retains a non-lawyer expert to help the lawyer render legal advice, does privilege extend to the expert's communications with the client? Judge Friendly, writing for the Second Circuit, answered yes.

The canonical facts involved an accountant retained by a tax attorney to help the attorney understand the client's records. Friendly analogized the accountant to a translator: if a client speaks a language the lawyer doesn't, the interpreter is within the privilege. So too the accountant who interprets the client's books for the lawyer. The doctrine has since been extended to investigators, economists, jury consultants, public-relations firms in certain cases, and other agents of counsel.

The logic is simple. Legal advice often requires non-legal expertise that the attorney herself does not possess. If the privilege did not extend to the expert, the expert would become the weak link: a mandatory disclosure channel for facts the client shared with the expert in confidence. That would eviscerate the privilege in any matter requiring outside expertise. The Kovel doctrine closes that gap by treating the expert, for privilege purposes, as an extension of counsel.

The application to AI is natural. An AI system used to assist in legal research, when engaged by or at the direction of counsel, functions as an agent of counsel of exactly the type Friendly described. Judge Rakoff, in the Heppner passage quoted above, said this expressly.

What it would take, in theory, to close the gap

Pulling together the elements, a theoretical framework sufficient to extend privilege to AI-assisted legal research requires each of the following:

1. A real attorney-client relationship, established by a formal engagement letter, which contemplates AI-assisted research as within its scope.
2. Express attorney directionof the client's use of the AI platform, given as part of the lawyer's professional judgment about how to render legal services.
3. Confidentiality-preserving infrastructure: no data retention outside what is necessary to serve the request, no use of inputs to train models, no voluntary disclosure to third parties, encryption in transit and at rest.
4. Contemporaneous documentationof the engagement, the direction, and the client's interactions, sufficient to establish the factual predicate of privilege when challenged.
5. A defensible assertion protocol: when a demand for the content of the AI interactions arrives, privilege is asserted by the custodian and the attorney, with a narrow-tailoring objection and a privilege log.

None of these elements is novel. Each is well established in conventional legal practice. The work is to assemble them, at low friction, for a scale and speed of use that individual lawyers cannot reasonably provide.

Part IIIKovel: the done-for-you solution

Kovel is an operational platform that delivers the five-element framework above by default. This Part describes, specifically and without embellishment, what Kovel does. Where Kovel does not do something, we say so.

Architecture

A user who signs up for Kovel creates an account backed by a licensed attorney (“general counsel”) who formally engages the user under a master engagement letter covering general civil legal research and analysis. The user's AI interactions — with frontier models routed through Anthropic's enterprise endpoints — occur at the express written direction of that attorney. The engagement contemplates the platform as an agent of counsel in the Kovelsense. Each separate matter the user is working on gets its own workspace (a “matter” in the Kovel UI), with the general counsel assigned by default and the option to add a specialist attorney for state-specific or scope-specific work.

Nothing on the Kovel platform is used to train AI models. Anthropic's enterprise endpoint (the one Kovel routes to) contractually prohibits training on inputs or outputs. User prompts and AI responses are held only for the duration of the active session, unless the user explicitly saves to the Law Library, in which case the saved documents are encrypted at rest with per-matter keys.

The attorney network

Kovel maintains a network of licensed attorneys who opt in to serve as general counsel and specialists for Kovel users. General counsel are nationwide: because the scope of their engagement is general research and advisory work (not state-specific representation), they are not required to be licensed in the user's state. This matches long-standing multi-jurisdictional advisory practice and is consistent with ABA Model Rule 5.5's treatment of temporary and federal-law practice. Specialist attorneys, by contrast, are matched to the user's state for any matter requiring state-specific advice or representation.

All Kovel network attorneys review and agree to standard engagement terms, maintain active bar status, and accept Kovel's conflicts-checking procedures before being assigned to a user.

The Chain of Privilege

For each user, Kovel maintains a document called the Chain of Privilege. It is available to the user at any time from within the portal and can be reproduced on demand. It is the single factual record most useful when asserting privilege. At a minimum, the Chain of Privilege for any given user includes:

• Account identifiers and creation timestamp;
• A verbatim copy of the master engagement letter, with signing timestamps for both the user and the directing attorney;
• Attorney identity, state of licensure, and bar number;
• For each matter: its title, jurisdiction, description, assigned attorney, any specialist addendum, and its own timestamps;
• Technical attestations from Kovel regarding the infrastructure, zero-retention contractual terms, encryption at rest, and access logs;
• The system prompt used to direct the AI in the user's session, documenting the attorney-of-record and the directive nature of the use.

The purpose of this document is to meet, in advance, the evidentiary predicate that a challenging party can demand in privilege litigation: proof that the attorney-client relationship existed, that the attorney directed the use, and that confidentiality-preserving infrastructure was in place.

What Kovel commits to — and what it does not

Kovel is a custodian of user materials, not a law firm. Our commitments are commitments a custodian can keep. They are:

• Notice. When Kovel receives any legal process (subpoena, search warrant, civil investigative demand, or equivalent) related to a user, Kovel notifies the user and their directing attorney within 48 hours, subject to any court-ordered non-disclosure obligations.
• Process formality. Kovel does not voluntarily disclose user materials to any third party, including law enforcement, except in response to valid court-ordered process.
• Custodial privilege objection. When served with a demand for user materials, Kovel, as custodian, formally asserts attorney-client privilege and work-product protection on the record, and produces, in advance, the applicable Chain of Privilege and infrastructure attestations. This requires the demanding party to overcome the burden of privilege before production of content.
• Narrow-tailoring push-back. Where a demand is overbroad or unspecific, Kovel objects on that basis and requires the demanding party to narrow the request to what is actually relevant and proportionate.
• Transparency reporting. Kovel publishes an annual transparency report summarizing the volume and categories of legal process received and the outcomes.

Kovel explicitly does not commit to the following:

• Paying for the user's or the attorney's substantive legal defense of the privilege, beyond the custodial objection above.
• Filing motions on the user's behalf in the user's underlying matter.
• Funding amicus briefs or interventions as a standing practice.

The substantive privilege fight belongs to the user and to counsel — and Kovel arms them to fight it.

Criminal matters

Kovel supports criminal matters, but with a sharper delineation of scope. The Kovel doctrine itself originated in a criminal prosecution — United States v. Kovel was a tax-fraud case, and the case most directly in point for Kovel today, Heppner, is a federal wire-fraud prosecution. The need for a privileged research environment is arguably greater in criminal matters than civil ones.

Kovel's scope in criminal contexts is:

• Pre-charge(investigation, grand jury, target letter, subpoena, exposure assessment): general counsel's master engagement covers this directly. This is a research-and-thinking environment, not a representation.
• Post-charge (arraigned, indicted, in active defense): the client engages a criminal defense attorney as a Kovel specialist on that matter. That attorney directs AI research under the specialist addendum. Kovel is the research infrastructure; the defense attorney runs the defense.
• Post-conviction (appeals, habeas, post-conviction relief): appellate or post-conviction counsel serves as the specialist.

What Kovel does not do in criminal contexts:

• Replace defense counsel of record.
• Cover courtroom representation under the master engagement.
• Hold client funds or manage bail/retainer funds with potential forfeiture implications.

The portal's AI is instructed to recognize charging language — indictment, arraignment, plea, grand jury, target letter, and related terms — and to prompt the client, on-screen, to request attorney review and match to a criminal defense specialist. The prompt does not cut off the conversation; it flags that the matter is approaching representation rather than pure research.

The subpoena response flow, step by step

When a user calls, emails, or clicks the “I received legal process” button in the portal, or when Kovel itself is served, the following sequence runs:

1. Kovel confirms the nature of the process, its issuing authority, and any non-disclosure requirement.
2. Kovel notifies the user and the directing attorney within 48 hours where permitted.
3. Kovel generates the user's current Chain of Privilege and delivers it to the directing attorney, along with the relevant Infrastructure Attestation.
4. Kovel's custodial counsel drafts a response letter asserting privilege on the record, with citations to Kovel doctrine, work-product, and narrow-tailoring objections.
5. The directing attorney (or the specialist assigned to the matter) prepares and files the substantive motion — the materials in Part IV of this playbook are designed to minimize that work.
6. The matter proceeds on its own schedule. Kovel does not produce user content while privilege is being litigated.

Part IVAppendices

Appendix A — Sample motion to quash

The following is a skeleton. It is not legal advice and should be adapted by counsel to the facts of the matter and the relevant jurisdiction's rules.

Appendix B — Sample declaration of directing attorney

Appendix C — Sample Chain of Privilege

The Chain of Privilege is a system-generated, read-only record maintained for each Kovel user. A reproduction follows, with sample values.

Appendix D — Case law reference

Appendix E — Infrastructure attestations

Kovel attests to the following infrastructure characteristics as of the date of this playbook. These characteristics are independently verifiable through the contracts and technical documentation referenced in each row and will be provided to counsel upon request in the context of privilege litigation.