Karsten Wenzlaff, Advisor
August 26th, 2025
February 17 2026 | Market Insight | Artificial Intelligence Governance

Image: Freepik
On February 17 2026, a New York federal court ruled in United States v. Heppner that written exchanges between a defendant and Anthropic’s Claude are not protected by attorney client privilege or the work product doctrine.
The case centred on about 31 documents that recorded the defendant’s interactions with Claude. Investigators collected the files during a search after the defendant received a grand jury subpoena and understood he was under investigation. He used Claude to generate reports that outlined possible defence strategy and potential legal and factual arguments. He did this on his own rather than at the direction of his lawyer.
The court applied standard privilege rules and found the documents fell outside protection. Judge Jed S. Rakoff explained that discussions between non-lawyers were not privileged and that privilege depended on a confidential relationship with licensed counsel. The court also found the Claude conversations were not confidential because they involved a third party platform and the platform’s privacy policy alerted users that data could be collected and disclosed.
HSF Kramer’s analysis of the ruling explains how client side use of public generative AI tools could weaken privilege claims. The defendant argued that he created the Claude reports to prepare for conversations with his lawyer and later shared them with counsel. The court rejected that argument. Because the defendant used the tool independently and Claude disclaimed providing legal advice, the documents did not become privileged simply because counsel received them later.
The court reached the same result under the work product doctrine. That doctrine protects materials prepared by or at a lawyer’s direction to safeguard legal strategy. Since the defendant created the documents himself, the court found they did not reflect counsel’s mental impressions or strategy.
The defendant’s approach reflected a workflow many teams now follow. People often use generative AI to organize facts, test arguments, or prepare notes before speaking with a lawyer. In practice, AI can feel like a private drafting space. The Heppner ruling shows that this assumption creates risk because privilege depends on lawyer involvement and confidentiality at the time material is created, not later.
This decision shows how everyday AI use can create governance risk. Fintech teams often rely on generative AI to draft internal notes, explore regulatory interpretations, test legal arguments, and shape product thinking.
When teams create prompts and outputs outside privileged workflows, those materials may be treated like ordinary internal documents and may surface in litigation, investigations, or regulatory reviews.
The Heppner outcome also challenges a common assumption that AI drafts become privileged once shared with a lawyer. Timing and intent matter. If teams generate strategy or legal framing before counsel becomes involved, privilege arguments may already weaken. Enterprise AI environments may offer stronger confidentiality controls, but the decision shows privilege still depends on lawyer involvement and clear intent to obtain legal advice.
If generative AI captures early legal and strategic thinking, should fintech governance treat AI prompts with the same care as internal legal memos and executive communications?
Privilege depends on how and when material is created, not what you do with it later.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
Feb 25, 2026 | NCFA Fintech Market Activity | Identity Privacy And Data Governance

Image: Freepik
On February 24 2026, SLC Digital and Tracer Labs announced a partnership that links SIM or eSIM backed device proof with portable digital identity and consent credentials.
The goal is to reduce account takeover exposure and strengthen approvals for high risk actions by proving the authorized device is present and the right person approves the action. SLC Digital says it anchors device trust to the SIM or eSIM and mobile network signals. Tracer Labs says its Trust ID layer supports identity verification, consent, and authorization workflows without repeatedly exposing personal data.
The FBI Internet Crime Complaint Center says that since January 2025 it has received more than 5,100 complaints reporting account takeover fraud, with losses exceeding $262 million
It's an interesting partnership because many platforms still separate identity from authorization. Identity checks often happen at onboarding while authorization often relies on an in app prompt or an SMS one time code. The solution describes a combined workflow that ties a sensitive action to a trusted device and a verified identity and consent credential, so the platform can show stronger evidence that the real user approved the change.
It fits best where one compromised session creates immediate damage. Think bank account changes, payout destination edits, payroll modifications, admin role changes, high value transfers, and merchant settlement rerouting. Those flows also create regulatory and audit exposure when firms cannot clearly prove who approved what and from which trusted endpoint.
Travis McGregor, CEO, SLC Digital:
“This partnership strengthens how organizations defend against modern digital fraud,”
Pete Hayes, CEO, Tracer Labs:
“Digital ecosystems can’t rely on one-time authentication in a world of autonomous agents and sophisticated threats,”
The companies will begin with a joint pilot and expand into enterprise deployments. It also lists SLC Digital partnerships and affiliations that signal an infrastructure grade route to market, including work with GSMA, IDEMIA, and Monogoto, plus membership in the NVIDIA Inception program.
If account takeover losses keep climbing, do banks and fintechs start treating device rooted authorization plus portable consent credentials as a baseline requirement for high risk actions, not an optional upgrade?
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
February 23, 2026 | NCFA Market Activity | Artificial Intelligence And Data

On February 21, 2026, B.C.’s premier says police are pursuing preservation orders for potential evidence held by digital services companies, including social media platforms and AI companies, after media reports tied OpenAI to the case. This isn't a new fintech policy just yet, but it puts evidence readiness into the open. If a partner asks what you can preserve and produce under lawful process, you can’t appear like a 'deer in headlights'. You need a working path.
BC Government, Office of the Premier, Media Relations:
“Reports that allege OpenAI had related intelligence before the shootings in Tumbler Ridge took place are profoundly disturbing for the victims’ families and all British Columbians. We will use all powers of government to ensure that police have the tools they need to investigate every aspect of this horrific tragedy.”
RCMP report said that the active shooter call came in at about 1:20 p.m. on February 10 and the public alert ended at 5:45 p.m. Six victims were found deceased inside the school, two victims were airlifted with serious or life threatening injuries, a third victim died during transport, and about 25 others were assessed for non life threatening injuries. RCMP also reports two additional victims were found deceased at a connected residence.
On February 13, RCMP reports more than 80 interviews took place with students, educators, and first responders, while forensic teams continued processing two scenes and a vehicle connected to the suspect. The investigative update also reported digital evidence work including witness images and videos, CCTV, and body worn camera video, and it says RCMP launched an online portal to collect more evidence, including phone footage captured inside the school.
In a BBC report, OpenAI spokesperson said that they didn't alert authorities about the account because its usage didn't meet its threshold of credible or imminent plan for serious physical harm to others...
"In June 2025, we proactively identified an account associated with this individual [Jesse Van Rootselaar] via our abuse detection and enforcement efforts, which include automated tools and human investigations to identify misuses of our models in furtherance of violent activities."
Evan Solomon, Minister of Artificial Intelligence and Digital Innovation per Globe and Mail reporting:
"Canadians expect online platforms, including OpenAI, to have robust safety protocols and escalation practices in place to protect online safety and ensure law enforcement are warned about potential violence,"
This story turns AI governance into an evidence workflow. If your product runs AI in onboarding, fraud triage, collections, or support, partners need clear answers on what the system records, what it retains, who can access it, and how the team preserves and produces records under lawful process without breaking integrity. A stakeholder may accept model error but they won’t accept uncertainty about records, access, and escalation ownership when scrutiny rises.
Financial technology companies should define escalation triggers in plain language. Name an accountable owner and a backup. Restrict log access. Set retention windows you can defend. Test a short runbook for preservation and production so the team can execute it without debate when the question lands, an be sure to provide suitable ongoing training.
If preservation orders become a more common tool when AI enters an incident, does Canada need a shared baseline for AI logging, retention, and escalation handoffs so every regulated buyer does not rebuild the same checklist from scratch?
Reuters reported that OpenAI reps have been summoned to Ottawa urgently to discuss AI safety.
Update per CTV article: Following the meeting in Ottawa with OpenAI safety leaders, federal officials said they were “deeply disturbed” and ultimately “disappointed” that warning signals tied to the Tumbler Ridge shooter were not escalated to police earlier, with AI Minister Evan Solomon stressing Canadians expect platforms to maintain “robust safety protocols and escalation practices.” OpenAI is cooperating with the RCMP but produced no immediate new safeguards, leaving ministers to seek concrete follow-up proposals.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |