Two months before Judge Rakoff ruled in United States v. Heppner that consumer AI conversations are not privileged, the New York City Bar’s Committee on Professional Ethics issued Formal Opinion 2025-6, addressing the ethical questions lawyers face when AI tools are used to record, transcribe, and summarize attorney-client conversations. The opinion was published in December 2025; Heppner came down in February 2026. Neither authority cites the other, but they describe the same structural gap from different institutional vantage points: a regulator looking ex ante at how AI alters the lawyer’s duties, and a court looking ex post at what happens when a client uses AI without the lawyer’s knowledge. Together they expose a problem the existing ethics framework was not designed to address: what to do when the client, not the lawyer, brings AI into the representation.
Most of the commentary on Opinion 2025-6 has focused on Section I, the obligations that arise when the attorney uses AI to record calls. That section applies existing duties under Rules 1.1, 1.4, 1.6, and 8.4 to a specific technology, and the analysis tracks what the NYC Bar said in Formal Opinion 2024-5 and what the ABA addressed in Formal Opinion 512 (Generative Artificial Intelligence Tools, July 29, 2024). Section II is harder, because the existing rules presuppose attorney control of the technology being used, and client-brought AI removes that presupposition.
The problem the opinion identifies
When clients use their own AI tools to record conversations with their attorneys, the attorney loses control over nearly every variable the ethics rules are designed to govern. The attorney may not know which tool the client is using or have reviewed its terms of service. The attorney cannot determine whether the recording is stored locally, in the cloud, or on servers in a jurisdiction with different confidentiality protections. The attorney has no access to the transcript or summary the tool produces, no ability to review it for accuracy, and no way to ensure that the tool does not retain or train on privileged communications.
The opinion states this plainly: client-initiated AI recording puts the attorney “at risk of not being able to carry out the ethical responsibilities outlined above.” The responsibilities in question (informed consent, confidentiality safeguards, competent review, supervisory oversight) all presuppose that the lawyer has some measure of control over the tools being used. When the client brings the tool, that presupposition fails.
This is the same structural gap Heppner exposed, encountered at a different point in the relationship. Heppner used consumer Claude to analyze his legal exposure without his lawyers’ knowledge, and the AI tool processed privileged materials under terms that, as Judge Rakoff found, did not support a reasonable expectation of confidentiality. His attorneys could not have prevented the privilege loss because they did not know it was happening. Opinion 2025-6 addresses a scenario in which the attorney does know the client is using AI: the client’s recording tool announces itself when it joins a Zoom call, or a Teams notification indicates that transcription is active. Knowledge of the problem does not translate into control over it. Heppner is a district court decision and binds no one outside the SDNY, but its reasoning has obvious persuasive purchase, and Opinion 2025-6 reaches a similar diagnosis through a different door.
What the opinion prescribes
The opinion offers three responses to client-initiated AI recording, acknowledging that none is complete. Attorneys may ask that conversations not be recorded. They should include retainer provisions stating that AI-generated recordings, transcripts, or summaries will not be deemed dispositive unless the attorney has reviewed them. And they should advise clients of the risks to confidentiality and privilege. The third recommendation is the duty I described in an earlier post as already embedded in Rules 1.1, 1.4, and 1.6, and the committee is right to make it explicit in the recording context.
All three remedies share a structural feature: they depend on the client’s cooperation. The attorney asks the client not to record; the client may decline. The attorney drafts a retainer provision; the AI tool’s provider is not a party to the retainer and is unaffected by it. The attorney warns the client about privilege risks; the client may disregard the warning. None gives the attorney an enforcement mechanism if the client does neither. Zoom, Teams, and other videoconferencing platforms can be configured to record by default, requiring an affirmative act to disable recording, an act the attorney cannot perform on the client’s system.
The duty the authorities establish
The clearest duty the two authorities establish is the duty to warn. Opinion 2025-6 states that when attorneys know clients are using AI recording tools, they “should advise clients of the risks of the loss of confidentiality and privilege.” Heppner makes those risks concrete: a client who fed privileged materials into a consumer AI platform forfeited the privilege because the platform’s terms did not support a confidentiality claim. The duty to advise clients of AI-related privilege risks follows from existing communication obligations under Rule 1.4 and the confidentiality framework of Rule 1.6, and it applies whether or not the client has yet started using AI in connection with the matter. Heppner sharpens that duty by giving it a concrete foreseeable consequence. Opinion 2025-6 codifies it for one specific scenario.
The duty to warn presupposes the lawyer can warn accurately, and a careful reader will want to ask how far that pulls Rule 1.1 with it. Rule 1.1 has traditionally governed the technology the lawyer uses; Comment [8] frames the competence duty in terms of “the benefits and risks associated with relevant technology,” and the consensus reading addresses lawyers’ adoption of new tools rather than lawyers’ duty to understand the tools their clients independently choose. I do not think the duty to warn requires a lawyer to have read OpenAI’s, Anthropic’s, and Google’s terms of service in detail, and I want to be careful not to conscript Rule 1.1 into doing more than it can bear. The competence required to fulfill the duty to warn is bounded: a lawyer should understand the broad categories of consumer-AI data handling well enough to explain, in plain terms, why a client should not paste privileged material into a public chatbot. That is meaningfully less than mastering the technical features of every tool a client might bring.
The combined effect of these two authorities, then, is a single clear duty supported by a modest competence requirement. The rest of what I want to say in this post should be read as a normative argument about what firms with the resources to do more should consider doing, not as a derivation of rules the authorities have not yet announced.
The case for providing alternatives
A warning that is necessary is not always sufficient. If the client uses consumer AI tools because she wants a quick, accessible summary of her case, telling her not to use those tools without offering a substitute creates a predictable failure mode: she will agree in writing and then revert in practice. Many engagement-letter provisions of this kind are likely to be honored in form and disregarded in substance, the same way advice-of-counsel cautions about email confidentiality were widely disregarded in the early 2000s.
The case for providing firm-controlled alternatives is practical rather than doctrinal. It does not follow from any current rule that a lawyer must offer a privilege-preserving AI environment, and a lawyer who provides only the warning has not violated the Rules of Professional Conduct. But a lawyer who provides only the warning has done less than a lawyer who provides the warning together with a tool the client can use without forfeiting the privilege. The argument is about probability, not duty: the warning is more likely to be observed when the client has somewhere else to go.
The argument therefore has an empirical floor that should be acknowledged. Providing a firm-controlled chatbot does not solve the privilege problem if the client uses ChatGPT anyway. The alternative-provision argument depends on the assumption that some material fraction of clients will use what the firm offers in preference to consumer tools, and that assumption holds only if the firm’s tool is useful, accessible, and perceived by the client as serving the same needs the consumer tool would have served. Where the assumption fails, the alternative does no doctrinal work.
The cost objection should also be taken seriously. Solo practitioners and small firms cannot stand up firm-controlled AI environments on the budgets and timeframes that would make the substitution viable for their clients. Any reading of professional responsibility that required capital expenditure on alternative infrastructure as a condition of compliance would impose costs that fall asymmetrically across the profession. The duty to warn has not expanded to require such infrastructure, and I am not arguing it has. The argument is that firms that can offer alternatives should consider doing so, not that firms that cannot are in violation of the rules.
Judge Rakoff’s discussion of United States v. Kovel, 296 F.2d 918 (2d Cir. 1961), in Heppner offers one doctrinal pathway for firms that build or buy privilege-preserving environments, but the pathway has real limits and should not be oversold. Kovel extended the attorney-client privilege to communications with non-lawyer agents whose assistance is “necessary, or at least highly useful, for the effective consultation between the client and the lawyer.” Rakoff’s gloss, offered as dicta when he distinguished unsupervised client use from attorney-directed use, suggested that an AI tool operating under counsel’s direction might occupy something like the Kovel position. Two limits attach. First, Kovel contemplates a human agent whose role is to facilitate the lawyer’s provision of legal services, often subject to professional duties of their own; an LLM is a service provided by a third-party corporation, not a fiduciary of either client or counsel. Second, even a firm-controlled environment typically gives the provider some technical access to user inputs for purposes of maintenance, debugging, safety review, and legal compliance with subpoenas and other process. Whether that residual access is enough to trigger the third-party waiver logic Rakoff applied in Heppner is an open question, and a court could plausibly come out either way. A firm that offers a privilege-preserving environment is in a better position than a firm that points clients toward consumer tools, but the Kovel analogy does not, on its own, establish that the privilege is preserved.
The case for redesigning communication
The third response is the most contestable, and I want to be candid about how contestable it is. No authority has yet held that Rule 1.4 reaches the design of the channels through which advice is delivered. Rule 1.4 has been read to address the substance of communication, the frequency of updates, and the manner of consultation, but not the technical architecture of how a firm communicates with its clients. To read Rule 1.4 as imposing channel-design obligations is to argue for an expansion of the rule that no court or ethics opinion has yet endorsed.
The argument for considering that expansion rests on foreseeability. Comment [5] to Model Rule 1.4 explains that the depth and manner of consultation should be calibrated to the client’s sophistication and the circumstances of the representation, and what counts as “reasonably necessary” has always been adjusted to the foreseeable consequences of inadequate communication. Before Heppner, a failure of client comprehension might produce a suboptimal decision. After Heppner, a failure of client comprehension can produce a forfeiture of the privilege if the client turns to consumer AI to fill the gap. That change in foreseeable consequences could, in principle, raise what the duty of communication requires.
This is an argument about how the duty of communication ought to develop, not a description of how it currently stands. A firm that communicates only through formal memoranda and scheduled phone calls is not in violation of Rule 1.4 today. The argument is that firms with the resources to do more should consider doing more, both because better communication serves the client and because better communication reduces the probability that the client will look to consumer AI to fill the gaps. Plain-language summaries reviewed by counsel before delivery, structured case-status updates, secure messaging channels for follow-up questions: each can be built or enhanced with AI tools operating under the firm’s commercial terms, and each addresses, in some measure, the foreseeable risk that the client will otherwise turn elsewhere. None is required. All are worth considering.
Where this leaves the profession
The clearest takeaway from Heppner and Opinion 2025-6 is the duty to warn. Engagement-letter language, CLE programming, and model retainer clauses are the appropriate responses to that duty, and the profession is likely to produce them. They are necessary, and they are not sufficient, in the sense that warnings reduce attorney exposure to discipline at a faster rate than they change client behavior.
The two further responses I have described, providing alternatives and redesigning communication channels, are not currently obligations. Reading them into the rules would expand the duties of competence and communication in ways neither the NYC Bar nor any court has yet endorsed, and a lawyer who confines herself to the duty to warn is not in violation of the Rules of Professional Conduct. I think the foreseeability shift Heppner introduces makes both responses worth taking seriously as policy, particularly for firms with the resources to implement them, and I expect future ethics opinions and case law may move in that direction. They have not done so yet, and lawyers who tell themselves the rules require more than the rules currently require are misreading the authorities in the other direction.
December 2025 and February 2026: an ethics committee and a federal court reached the same structural problem within ten weeks of each other, neither aware of the other. The convergence does not, by itself, make alternatives or channel design into duties. It does suggest that the conditions under which the duty to warn is performed are changing fast enough that a firm focused only on warning is responding to a smaller problem than the one in front of it.
This post draws on the New York City Bar’s Formal Opinion 2025-6 and Formal Opinion 2024-5; Judge Rakoff’s written opinion in United States v. Heppner; ABA Formal Opinion 512 (July 29, 2024); Comment [8] to Model Rule 1.1 and Comment [5] to Model Rule 1.4; United States v. Kovel, 296 F.2d 918 (2d Cir. 1961); and prior posts on the Heppner decision, the duty to inform clients about AI privilege risks, the disclosure patchwork, and compliance architecture after Sullivan & Cromwell.