A Quiet Redraw of the Map
Every generation of lawyers gets one or two decisions that quietly redraw the map of what it means to protect a client. These are not always the opinions that make headlines. Sometimes they are narrow, almost boring, applying old rules to new facts with mechanical restraint. United States v. Heppner, No. 25 Cr. 503 (JSR), 2026 U.S. Dist. LEXIS 32697 (S.D.N.Y. Feb. 17, 2026), is that kind of case. It is the most important AI-and-law opinion of the decade.
Heppner in One Page
The facts fit on a cocktail napkin. A criminal defendant used a consumer AI system to help prepare legal documents. He shared confidential information with the model provider under terms that permitted training on his data and, in some circumstances, disclosure to third parties. When the government came calling, he argued the documents were protected by attorney-client privilege. Judge Rakoff said no.
That “no” was not a shot at AI. It was not a Luddite gesture. It was a straightforward application of the oldest rule in the privilege book: you do not get to claim you were speaking in confidence if you knowingly looped in a third party that was free to use and share what you said. You cannot click through consumer terms that reserve the right to train on your data and then ask a court to pretend you were whispering in your lawyer’s ear. Some defendants learn this in front of a grand jury. Most learn it in discovery.
The implications are brutal. Every founder who has poured strategy into a chatbot, every in-house lawyer who has worked through litigation posture in a consumer UI, every executive who has used an open-source agent to “just get a sense of our exposure” has created discoverable material. The systems feel intimate. They are not. They are third parties with their own rights and obligations, and the law treats them accordingly.
Warner as the Counterpoint
Heppner is not the whole doctrine. Warner v. Gilbarco, Inc., decided weeks later in the Eastern District of Michigan, looks at the same class of facts and comes out the other way — and the reason is the axis everything in this essay turns on. The litigant in Warner used consumer AI tools the same way the defendant in Heppner did. The difference was that the litigant was himself a licensed attorney, appearing pro se on his own matter. He was both the user and the supervising lawyer, and the court treated the outputs accordingly. Privilege and work-product protection survived because a lawyer was in the loop — the lawyer just happened to be the same person as the client.
Read together, Heppner and Warner describe a single rule. It is not about the sophistication of the tool, the brand on the interface, or the click-through terms. It is about whether a licensed attorney, bound by Rules 1.1, 1.6, 5.1, and 5.3, was supervising the use of the system at the moment the communication was made. In Heppner there was no such attorney. In Warner there was — even though she was representing herself. Privilege followed the lawyer, not the software.
That is the through-line. Attorney supervision is what makes AI an agent of counsel under Kovel rather than an independent third party that defeats confidentiality. Everything Shield does downstream of that — the configuration work, the Slack Connect channel, the audit trail, the no-training posture — is the operational expression of a single principle: a licensed lawyer has to be on the hook for what the machine does.
Kovel as the Path Through
Heppner did not slam the door. It pointed, explicitly, at the doctrine that keeps privilege alive when third parties are involved: Kovel. Under Kovel, communications that loop in accountants, translators, or other agents remain privileged if they are necessary to the legal advice, if counsel engages and directs the work, and if confidentiality is preserved. The agent is folded into the privileged relationship. It does not stand outside it.
Read Heppner through that lens and it stops being a rejection of AI. It is an architectural spec. If you want AI-assisted legal work to be privileged, treat the AI as an agent of the lawyer, not as a parallel advisor. The lawyer has to be in the loop early, not waving a hand after the fact. The underlying terms have to protect confidentiality. The structure has to look like a law firm using a tool, not a user chatting with a product.
That distinction sounds semantic until you build around it.
Shield as Architectural Answer
Shield is one attempt to build around it. It takes Heppner’s constraints as design inputs and asks the only question that matters: what does legal infrastructure look like when it is designed from first principles to live inside privilege instead of orbiting it? The answer is less about any one model or interface and more about the shape of the system.
At the outermost layer, Shield insists the relationship is attorney–client, not user–product. A client subscribes to a service explicitly provided by a law firm, not by a software company with counsel on retainer. There is a Slack Connect channel, not a login. There is an understanding, baked into onboarding, that questions asked in this environment are directed to counsel, even when the first draft of the answer comes from a machine. That sounds like a small framing choice. It is not. It is the difference between “I told ChatGPT about my problem” and “I told my lawyer about my problem, and she used tools to answer.”
Inside that relationship, Shield constrains how AI behaves. The models do not have carte blanche to emit whatever they want directly to clients. Attorneys configure them to do specific tasks — extract terms, flag issues, suggest negotiation positions. Their outputs route through workflows where a human attorney is the final authority for what leaves the system. The AI does not give advice on its own. It does the labor-intensive parts of analysis so that human judgment can focus on the hard calls.
That configuration work is not an afterthought. It is the architecture. Each decision about when to require human review, which questions get answered automatically, which model is acceptable for which class of task, is a bet about risk and responsibility. Lawyers place those bets in their professional capacity. The prompts and policies they produce are, in a meaningful sense, legal work product.
From the outside, the distinction looks technical. On one screen, “AI legal advice” with a footnote that says “not actually legal advice.” On another, AI-accelerated responses from a firm that is very much on the hook. The interfaces converge. The doctrinal reality does not. Heppner is clear: product-first, privilege is an uphill climb. Lawyer-first, with AI as a genuine agent, privilege is the default.
The ABS Enabling Environment
Arizona’s ABS framework is the enabling environment. Without the ability to take outside capital and grant engineers equity, you get a fractured ecosystem: tech companies that build the infrastructure but cannot carry privilege, and law firms that carry privilege but cannot practically build infrastructure at modern scale. The ABS model stitches those capabilities into a single entity that builds like a startup and answers like a firm. One house. One license. One duty.
Not every ABS will use AI well. Not every AI-native firm will get Heppner right. At least one jurisdiction now has the incentives lined up to try. A firm that owns its own infrastructure and is licensed to practice across borders treats privilege as a product feature, not a cost center — something designed in on day one, not sprinkled on in a risk section.
A Field Report from the Channel
Having run the first Slack Connect channel that sits between Shield and a client matter, I can report the doctrinal work is not abstract. Every setting inside that channel — who sees what, where the transcript lives, which AI agent has permission to read prior messages, what happens when the client forwards a message to their accountant — is a privilege decision made in code. Misconfigure the forwarding rule and Kovel is gone. Configure it right and the channel is as privileged as a partner’s office. The product and the doctrine meet inside those toggles. There is no separation.
Beyond Privilege: Architectural Law
The pattern here extends beyond privilege. As AI systems become more capable, the law will draw distinctions between architectures that look similar on the surface but behave differently at the level of responsibility. Two companies ship near-identical interfaces. One is a glorified search engine with no one accountable for what comes back. The other is a structured channel into a professional relationship. Heppner is the first example of a court saying those structures matter when there is no lawyer in the loop; Warner is the first example of a court saying they matter when the lawyer and the client are the same person. Either way, the axis is supervision.
AI will intermediate more of our professional interactions — that is not a prediction, it is already happening. Architectural law will become a dominant mode of regulation. Courts will spend less time asking whether a given model output is “legal advice” in the abstract and more time asking who configured the system, who stands behind it, and what the terms of the relationship were when it was used. In that world, the difference between a consumer AI and a Shield-style system is not technical. It is constitutional. It is about who owes what to whom.
Most consumer AI products cannot cross that line without becoming something else. They are built to serve millions of users at arm’s length, not to enter into fiduciary relationships with them. That is fine. Not every interaction needs privilege. In the slice of the world where it does — high-stakes strategy, criminal exposure, existential business decisions — Heppner has raised the bar.
Which Path the Profession Takes
One version of the future has lawyers treating Heppner as a warning and retreating from AI to preserve privilege by refusing to engage. Another version has them treating it as a spec, building architectures that satisfy it, and extending privilege into places it has never reached. The first path buys a few years of false comfort. The second path forces the profession to grow up alongside its tools.
Shield lives in the second path. It treats AI not as a threat to privilege but as a thing that, designed correctly, depends on privilege to matter at all. That is not an implementation detail. That is the whole point.