AI risks to the Sec. 7525 practitioner privilege

Three developments in tax practice are converging that present challenges in protecting the confidentiality of communications between taxpayers and tax practitioners. First, CPAs are rapidly integrating generative AI into their research, drafting, and advisory tasks, outpacing the changes to both the AICPA’s ethical guidelines and traditional legal principles safeguarding client confidences. Second, this use of AI carries implications for Sec. 7525, which addresses tax practitioners’ confidentiality privileges and was enacted in 1998 for a world where the primary third–party exposure was disclosure to colleagues, return preparers, or examining agents. Third, the IRS, drawing on two decades of summons–enforcement litigation, has shown a renewed interest in pursuing practitioner workpapers, drafting memoranda, and contemporaneous communications documenting the analytical history of aggressive return positions.

This article explores the privilege exposure faced by CPAs using generative AI; analyzes the significance of the first federal decision directly addressing AI–related privilege questions, Heppner;¹ and provides practitioners with immediate planning recommendations.

This article argues that the district court’s decision in Heppner, if followed by other courts, would leave CPA–controlled AI work structurally exposed under Sec. 7525 and that prudent practice now requires three correlated responses: routing privilege–sensitive AI work through a Kovel–mediated architecture,² imposing operational discipline at the AI prompt and verification layers, and adopting four engagement–letter provisions.

The CPA’s privilege toolkit

Sec. 7525: A privilege with three structural limitations

Sec. 7525, enacted as part of the IRS Restructuring and Reform Act of 1998, P.L. 105–206, extends the common–law protection of confidentiality to communications between taxpayers and “federally authorized tax practitioners.” This provision was Congress’s partial response to the Supreme Court’s decision in Arthur Young, which had declined to recognize a federal common–law accountant–client privilege.³ However, the protection that Sec. 7525 affords CPAs is not absolute. Three structural limitations expressly exclude from the privilege entire categories of tax advice from nonattorney tax professionals.

Limitation 1. Scope: Sec. 7525(a)(2) applies the privilege only in federal noncriminal tax matters. It does not apply in any criminal investigation or prosecution, state tax proceedings, proceedings before the SEC or other federal regulators, or private civil litigation.

Limitation 2. The tax shelter carveout: Sec. 7525(b) excludes communications “in connection with the promotion of the direct or indirect participation” of any person in a tax shelter as defined in Sec. 6662(d)(2)(C)(ii). The Seventh Circuit interpreted this carveout broadly in BDO Seidman, LLP⁴ and again in Valero Energy Corp.⁵ as encompassing not only formal opinions but also analytical advice and communications encouraging participation. Consequently, a significant portion of modern tax planning falls outside Sec. 7525.

Limitation 3. Inherited limitations: Sec. 7525(a)(1) extends only as far as the common–law attorney–client privilege, inheriting all its limitations. The privilege protects communications, not facts. It ceases to exist once the underlying advice is reflected in a return position. Additionally, it does not shield work performed for return preparation, as shown by the Seventh Circuit’s decision in Frederick,⁶ where the court held that a dual–purpose document, prepared for both return preparation and litigation, lacked privilege.

Some practitioners argue that the work–product doctrine can address gaps in the privilege shield, but in practice, the doctrine is difficult to apply. The work–product doctrine of Federal Rules of Civil Procedure (Fed. R. Civ. P.) Rule 26(b)(3) can prevent the compelled disclosure of materials prepared in anticipation of litigation in civil matters. Even under the Second Circuit’s practitioner–friendly “because of” formulation in Adlman,⁷ however, work product requires anticipation of litigation, which is inherently absent from routine planning and compliance tasks.

Kovel and its modern application

The doctrinal alternative to Sec. 7525 originates from the Second Circuit’s 1961 decision in Kovel. This decision extended attorney–client privilege to communications with nonattorney professionals, such as accountants, valuation experts, and forensic specialists, whose involvement is essential to an attorney’s legal advice.

A valid Kovel arrangement requires (1) that the accountant be engaged by the attorney, not by the client; (2) that the accountant’s services be necessary, or at least highly useful, to the attorney’s provision of legal advice; and (3) that the engagement be properly documented and properly scoped, with the Kovel work segregated from the accountant’s other work for the same client. Kovel has historically been most prominent in criminal tax exposure and in significant civil controversies, although it is also routinely used in sensitive audit–track planning and pre–litigation valuation work. As explained below, the integration of AI tools into the CPA workflow has significantly altered the cost–benefit analysis of using Kovel arrangements.

Gen AI in CPA practice

Tools in current use

CPA–deployed AI tools can be broadly categorized into three distinct groups, each presenting unique privilege concerns and challenges. General–purpose large language models such as ChatGPT, Claude, Gemini, and Copilot are accessed through public or commercial interfaces and are commonly used for tasks such as drafting, summarization, and exploratory research. On the other hand, tax–specialized platforms such as Blue J’s tax research platform, Thomson Reuters’s Checkpoint Edge with CoCounsel integration, and Wolters Kluwer’s CCH AnswerConnect AI employ retrieval–augmented generation to analyze curated tax–authority libraries. The third group of AI tools consists of embedded features, which are capabilities integrated into workpaper, audit, and practice–management software, often activated by default and frequently sending prompt content to third–party model providers.

Use cases and the documentary trail

Practitioners employ AI to explore novel research avenues; draft initial memoranda; analyze return positions for substantial–authority and reasonable–basis determinations; prepare audit responses; and generate Forms 8275, Disclosure Statement, and 8275–R, Regulation Disclosure Statement. Each of these tasks generates a documentary trail (prompts, outputs, and chat histories) that was absent when the same work was accomplished using conventional research tools.

Existing professional standards

The professional standards have only recently begun to address AI directly. The AICPA’s revised Statements on Standards for Tax Services (SSTSs), effective Jan. 1, 2024, specifically address technology competence and reliance on tools, particularly in the newly introduced SSTS No. 1, Section 1.4 (Reliance on Tools). While Treasury Circular 230, Regulations Governing Practice Before the Internal Revenue Service (31 C.F.R. Part 10), lacks a dedicated AI provision, the existing duties of diligence regarding accuracy under Section 10.22, competence under Section 10.35, and care in written advice under Section 10.37 clearly extend to AI–assisted work.⁸ Additionally, American Bar Association (ABA) Formal Opinion 512, which addresses the use of generative AI by lawyers, provides analogous guidance for CPAs operating under Kovel arrangements.

Heppner: The first federal decision

The facts and the holding

For most of the relatively brief time that CPAs have been integrating AI into their practice, the privilege analysis has been based on inferences drawn from cases that did not directly address AI. However, a recent district court opinion has started to fill the gap in the legal authorities. In Heppner, the court analyzed whether privilege shielded from compelled disclosure a criminal defendant’s use of AI to research matters related to his legal defense.

The case originated from the federal prosecution of Bradley Heppner, the former CEO of GWG Holdings. Heppner faced charges of securities fraud, wire fraud, conspiracy, false statements to auditors, and falsifying corporate records. After receiving a grand jury subpoena and retaining defense counsel, Heppner used a consumer version of Anthropic’s Claude — without his counsel’s guidance — to research legal matters, develop defense strategies, and draft analyses. He produced 31 prompt–and–response documents and shared them with his counsel. During a search warrant execution, federal agents confiscated the devices containing these documents. The court, addressing a novel question of law, held that the documents were protected by neither attorney–client privilege nor the work–product doctrine.

The court’s reasoning

The court’s privilege holding rested on two independent grounds and a third, closer alternative ground, each of which the court considered sufficient on the facts presented. First, the court ruled that Claude was not an attorney, and therefore communications with the application were not client–attorney communications. The court rejected analogies to other internet–based software, emphasizing that recognized privileges require a confidential bond with a licensed professional bound by fiduciary duties and subject to discipline. This relational predicate, the court found, was not met by an AI platform. Second, the court determined that there was no reasonable expectation of confidentiality. As the court characterized it, Anthropic’s then–current privacy policy reserved the right to retain inputs and outputs; use them to train the model; and disclose them to third parties, including governmental regulatory authorities.⁹ Third, the court held that the communications were not for the purpose of legal advice. Heppner did not communicate with Claude at the direction of counsel. While the court acknowledged that the third ground presented a closer call, it concluded that the later sharing of unprivileged communications with counsel could not retroactively transform them into privileged ones.

The In re OpenAI predicate

The diminished–privacy–interest premise of the second ground did not originate in Heppner. The Heppner court drew that premise from the reasoning of In re OpenAI, Inc., Copyright Infringement Litigation, in which a district court affirmed the magistrate judge’s order requiring OpenAI to produce a sample of consumer ChatGPT logs that the company would otherwise have deleted, on the theory that users lacked substantial privacy interests in conversations voluntarily disclosed to a publicly accessible platform that retains those conversations in the ordinary course of its business.¹⁰ Heppner applies that holding to the privilege analysis itself. The doctrinal pedigree is significant. A rule that defeats privilege in Heppner is characterized as not a novel one–judge innovation but rather the incorporation into the privilege doctrine of a rule already established in a different context in earlier civil litigation against an AI vendor. Practitioners evaluating whether Heppner will be followed in other districts should consider the strength of that pedigree in light of the framing of the work–product cases discussed below.

Work product also rejected

The court in Heppner further ruled that the AI documents were not prepared by or at the direction of counsel, as the work–product doctrine mandates. These documents did not represent counsel’s strategy at the time of their creation but only influenced counsel’s strategy after Heppner shared them. The court found this insufficient for the purpose of applying the work–product doctrine.

The Kovel implication

For CPAs, the most significant part of Heppner is its discussion of Kovel, where the court rejects the privilege claim based on the fact that Heppner had not been directed by counsel.

Had counsel directed Heppner to use Claude, Claude might arguably be said to have functioned in a manner akin to a highly trained professional who may act as a lawyer’s agent within the protection of the attorney–client privilege. Cf. United States v. Adlman, 68 F.3d 1495, 1498–99 (2d Cir. 1995) (citing United States v. Kovel, 296 F.2d 918 (2d Cir. 1961)).¹¹

The court refrained from determining whether such a counsel–directed arrangement would indeed safeguard privilege over AI–mediated communications. However, the explicit reference to Adlman and Kovel is significant. It places the privilege analysis for AI tools within the same doctrinal framework that has historically extended privilege protection to accountants and other agents whose involvement is indispensable in providing legal advice.

The Robbins position and the ordinary-rules approach

In the most–cited academic treatment, “Against an AI Privilege,” law professor Ira P. Robbins argues that no new AI–specific privilege is necessary because the ordinary rules of privilege, agency, and work product are adequate to handle AI–mediated communications.¹²

If ordinary privilege rules continue to govern AI–assisted tax work, then practitioners must structure that work to satisfy those rules. In the tax–advisory context, that means using Kovel arrangements where appropriate and taking other steps that will be discussed below.

Caveats and two counter-decisions

Three caveats limit the weight that should be given to this single district court opinion. First, Heppner is a criminal case, and Sec. 7525 does not apply in criminal proceedings. Second, the AI user was a nonlawyer client, not a CPA. Third, the AI platform was a consumer–tier deployment governed by terms of service that explicitly contemplated training use and third–party disclosure.

Two near–contemporaneous decisions reach different outcomes based on similar facts. On the same day the court issued its bench ruling in Heppner, a district court reached the opposite work–product conclusion in Warner v. Gilbarco, Inc., that ChatGPT and similar tools function as instrumentalities rather than as persons. This framing is more favorable to treating AI use as analogous to other instrumentalities of legal work.¹³

The next month, on March 30, 2026, in Morgan v. V2X, Inc., another district court held that a pro se litigant’s AI–assisted litigation materials in a civil case qualified for work–product protection under Fed. R. Civ. P. Rule 26(b)(3), distinguishing Heppner on the ground that, unlike in a criminal case, work–product protection in a civil case extends to materials prepared by parties, not just by counsel.¹⁴ The court also noted that virtually all modern communications data, from smart phone activity to search–engine queries, passes through third–party systems, citing precedent holding that email subscribers retain a reasonable expectation of privacy in emails stored by internet service providers.¹⁵

When considered together, these three decisions suggest that the privilege analysis hinges on three case–specific variables: who initiated the AI use, in what capacity, and through which platform tier.

Shealy: The first court to cite Heppner

Four months after Heppner, a Massachusetts state trial court became the first court to cite it. In Shealy v. Seaside Investments, LLC, the court compelled production of emails containing documents that the plaintiff’s romantic partner had generated with ChatGPT.¹⁶ Notably, no attorney was involved. Declaring the question one of first impression, the court held that neither the queries nor the output was protected by the work–product doctrine unless they were performed at the direction of counsel.

Critically, the court read Warner and Morgan narrowly, treating both as resting on the litigants’ pro se status and the leveling function AI serves for a party who must act as both party and advocate.¹⁷ Neither decision, on that reading, protects AI work performed for a client who has counsel — the ordinary posture of a CPA Kovel engagement.

The court’s holding regarding opinion work product cuts the same way. AI is a tool and not a person, the court reasoned, so its output cannot reveal the mental impressions or legal theories of an attorney or a party’s representative.¹⁸ That is the mirror image of Warner’s instrumentality framing: The characterization that made AI use unremarkable in Warner is what denies the output the higher tier of protection in Shealy. Heavier reliance on the model does not yield more strongly protected material.

Two limits temper Shealy’s weight. First, it is an unreviewed state trial court decision construing Massachusetts Rules of Civil Procedure Rule 26(b)(3). Second, it never reached any waiver or terms–of–service theory — leaving the In re OpenAI premise underlying Heppner’s second ground untested outside Heppner itself.

Privilege risks specific to CPA-conducted AI work

Third-party disclosure

The fundamental rule (for the attorney–client privilege, Sec. 7525, and the Kovel–derived privileges that build upon both) is that voluntarily disclosing a privileged communication to a third party automatically waives the privilege. In Heppner, this rule was applied to AI vendors with terms of service that allowed training use and third–party disclosure.

Confidentiality vs. privilege

Practitioners often confuse CPA confidentiality obligations with evidentiary privilege. CPAs are bound by confidentiality obligations under the AICPA Code of Professional Conduct’s “Confidential Client Information Rule” (ET sec. 1.700.001) and, for return–preparation information, under Sec. 7216 and its regulations. Compliance with both fulfills professional and statutory duties owed to the client. However, neither creates an evidentiary privilege nor prevents a court from compelling production or the IRS from issuing a Sec. 7602 summons for otherwise discoverable material. The foundational principle established by Couch¹⁹ in 1973 states that information transferred to an accountant for return preparation is not protected by a federal accountant–client privilege. AI deployment that complies with confidentiality may not, and usually does not, satisfy privilege.

Discoverability of prompts and outputs

The treatment of practitioner workpapers during IRS examinations is primarily governed by Sec. 7602 and Arthur Young. Arthur Young held that no federal common–law accountant–client privilege shields tax–accrual workpapers from a Sec. 7602 summons. It left the work–product question open, and the circuits remain split on it. The Second Circuit’s “because of” test in Adlman protects dual–purpose documents unless they would have been prepared in substantially the same form without the prospect of litigation. The First Circuit’s decision in Textron required that documents be prepared “for use in” litigation and on that basis denied protection to tax–accrual workpapers.²⁰ AI prompts, outputs, and chat histories function as workpapers and typically serve several purposes at once, which makes the choice of formulation outcome–determinative.

Heppner supplies an independent rationale that, if followed elsewhere, would render the Adlman/Textron split less consequential in the AI context. Voluntary disclosure to a vendor whose terms of service contemplate training use and third–party disclosure would waive any protection the documents might otherwise have enjoyed, regardless of whether they were prepared “because of” or “for use in” litigation. Thus, Arthur Young defeats any residual accountant–client privilege argument; Heppner’s waiver theory defeats the work–product argument independently of the Adlman/Textron divide. Either path would allow discoverability of AI prompts and outputs in criminal proceedings, and the civil extension is substantially likely — if Heppner is followed by other courts beyond the court inShealy.

The smoking-gun problem

AI tools are particularly effective at identifying weaknesses. Upon request, they can pinpoint the most compelling counterarguments to a position, the factual gaps that an examiner would likely investigate, and the policy considerations that undermine the taxpayer’s preferred interpretation of an authority. Practitioners deliberately utilize this capability as a form of structured devil’s advocacy. As a result, they maintain a contemporaneous written record of their specific awareness of the position’s vulnerabilities in their engagement file. This record can be significantly more detrimental than the absence of any analysis in a Sec. 6664 reasonable–cause proceeding or a Sec. 6694 preparer–penalty defense.

The reasonable–cause defense typically rewards demonstrated diligence. An AI–generated weakness analysis, paradoxically, can support this defense if the practitioner has documented a reasoned response to each identified weakness. However, the analysis is double–edged and should be conducted within a privileged structure rather than an open engagement file.

Three hypotheticals

Consider the following three hypothetical scenarios based on prevailing practice patterns.

Hypothetical 1. The reorganization memo: A CPA at a midmarket firm is tasked with evaluating the Sec. 368(a)(1)(F) qualification for a proposed cross–border reorganization. Faced with a tight deadline, the CPA resorts to using a public–tier ChatGPT session. The CPA provides a five–paragraph description, including entity names, jurisdictions, and contemplated considerations, and requests an analysis. The CPA then refines the output, incorporating it into a memo. Two years later, the IRS initiates a civil examination that develops sufficient evidence of fraud to support a criminal referral. Sec. 7525 is structurally unavailable in any subsequent criminal proceeding, and Heppner supplies persuasive federal authority that the disclosure to the AI vendor waives any other applicable privilege protections.

Hypothetical 2. The reasonable-cause file: A taxpayer faces a substantial–understatement penalty under Sec. 6662 and asserts a reasonable–cause defense based on reliance on a CPA firm’s tax advice. The taxpayer’s counsel requests the firm’s contemporaneous file, which includes a formal memorandum, a series of AI chat sessions where the engagement partner asked the model to identify the position’s weaknesses, and an annotated draft where the partner responded to each weakness. However, the reasonable–cause defense is contradictory. The same file that establishes diligence also demonstrates contemporaneous awareness of the position’s vulnerabilities, in language and detail that would be more beneficial to the IRS, were it to obtain it, than the formal memo alone.

Hypothetical 3. The subpoenaed vendor: Counsel has appropriately retained an accountant under a Kovel engagement, and the accountant utilizes an enterprise AI platform with a zero–retention commitment. In an unrelated matter, a grand jury investigating the AI vendor issues a sweeping subpoena for the vendor’s logs. Despite the zero–retention commitment, the vendor identifies relevant logs in transient storage and produces them. This incident highlights the importance of contractual protections. These protections operate at the discretion of the contracting party and may not align with their interests in litigation. Kovel’s relational architecture treats the practitioner’s communications, as a matter of agency law, as falling within the attorney–client privilege — though the court’s discussion in Heppner, however suggestive, leaves the AI–mediated extension of this theory unresolved as of the date of this article.

Risk mitigation for CPA firms

The doctrinal analysis presented above ought not discourage the use of AI in tax practice. Instead, it advises against the informal deployment of AI tools and suggests a need for a deliberate approach organized around three key considerations.

Architecture: Necessary but not sufficient

The first one is to use zero–retention enterprise deployments, on–premises installations, and contractually robust no–training commitments because they significantly enhance the likelihood of being able to assert privilege. However, they do not eliminate the third–party nature of the vendor; the contractual nature of the protections; or the potential for subpoena, breach, and amendment of the underlying terms. Practitioners who view enterprise architecture as the sole determinant of whether privilege can be successfully asserted are mistakenly conflating risk reduction with risk elimination.

Kovel-mediated AI workflow

The most structurally protective approach is to route AI–assisted tax work through counsel under a Kovel engagement. In this arrangement, the law firm, rather than the accounting firm, controls the deployment of the AI. This setup strengthens the privilege case significantly. The agency relationship is clearly documented, and the necessity of the AI tool for legal advice is explicitly stated. Moreover, the Kovel doctrine’s traditional protections extend to the resulting communications. The Heppner court’s explicit reference to the Adlman/Kovel line is the closest judicial endorsement this architecture has yet received.

Operational discipline at the prompt layer

Architectural protections must be complemented by operational discipline at two additional points: the prompt itself, where fabrication can be suppressed at the instruction layer, and the verification of every output before it leaves the firm. While most professional commentary focuses on verification — checking citations, verifying quotations, and recomputing calculations — the prompt is the more cost–effective place to prevent errors. A structured tax–research prompt should clearly define the practitioner’s role and the scope of the matter. It should also establish an authority hierarchy that instructs the model on which sources are considered authoritative, in what order, and which sources should be excluded. Additionally, the prompt should impose an existence constraint, prohibiting the model from fabricating, approximating, or combining citations that cannot be confirmed. Furthermore, the model should be required to disclose every factual, legal, and computational assumption. Finally, each citation, quotation, and calculation that necessitates human verification should be marked before the model uses it.

Four engagement-letter provisions

This article has identified the architectural and operational factors that materially reduce privilege exposure. To increase the chance of preserving privilege, as well as comply with other applicable requirements for AI use, this section recommends four concrete engagement–letter provisions. For any federally authorized tax practitioner who uses AI tools on client matters, these four provisions are crucial.²¹

Provision 1. AI–use disclosure and consent: The engagement letter may disclose that the practice utilizes AI tools in specific work categories, such as research, drafting assistance, citation verification, and document review. It may also identify the procurement tier, which could be either an enterprise or a zero–retention configuration with vendor terms that prohibit training on submitted content and limit retention. Additionally, the engagement letter may either document the client’s consent to the use of AI tools or note that matter–specific consent will be sought if the use of AI tools becomes material to the representation. Be aware that ABA Formal Opinion 512 generally holds boilerplate consent inadequate. Some state bar authorities have adopted their own positions on when matter–specific consent is needed.²² Therefore, the engagement letter should be drafted to satisfy the most restrictive applicable rule.

Provision 2. Sec. 7216 consent for return-information uses: Sec. 7216 prescribes a criminal penalty for return preparers who knowingly or recklessly misuse information or disclose it without authorization. Where a practitioner prepares a client’s tax returns and AI tools are used to process or analyze “tax return information,” the engagement letter can include the client’s consent to such use. This consent can be specific to the particular engagement and the anticipated AI uses. It is important to note that this consent is not a generic form; Sec. 7216’s regulations specify the exact form and content requirements that the engagement letter or a separate consent document must meet.²³ Unfortunately, this provision is often overlooked in practice. Firms that utilize enterprise AI tools in return–preparation workflows but fail to obtain a Sec. 7216 consent meeting the regulation’s requirements may be subject to penalties under Sec. 7216(a) and the related Sec. 6713 civil penalty, regardless of the privilege status.

Provision 3. Confidentiality and pseudonymization: The engagement letter may outline the confidentiality discipline that governs the handling of client information within the AI tool. The key points are as follows: The practice adheres to the AICPA Code of Professional Conduct’s “Confidential Client Information Rule” and applicable state regulations to maintain confidentiality. When utilizing AI tools, the practice removes or anonymizes identifiable client information before submission, to the extent permitted by the prompt’s purpose. Additionally, the practice refrains from submitting client information to consumer–level AI tools. This provision goes beyond mere declaration; it commits the practice to a documented, supervised, and auditable pseudonymization protocol.

Provision 4. Kovel engagement language where applicable: In a Kovel engagement, the engagement letter is between counsel and the practitioner, not between the practitioner and the client directly. It should clearly state the agency relationship and the purpose of providing legal advice. Additionally, it may specifically address the use of AI tools. The language in a Kovel engagement letter can mandate that any AI use in the Kovel work must be done using enterprise–tier tooling; that the work must be directed by counsel; and that the practitioner’s work product, files, and communications generated under the Kovel engagement must be procedurally and physically segregated from any independent engagement between the practitioner and the same client. Mixing these two types of engagements undermines the agency relationship that the doctrine requires.

Representation baseline for the new technology

The emergence of generative AI in tax practice has not changed the law of privilege. Instead, it has significantly expanded the range of communications, workpapers, and analytical artifacts that existing privilege doctrine must apply to, and the likely application is largely unfavorable. CPAs cannot rely on Sec. 7525 to protect AI–assisted tax work in any matter that may lead to criminal evidence, involve a state authority, or become relevant to a nontax civil proceeding. The privilege is structurally unavailable in those scenarios, and AI–generated artifacts will be discoverable. Even within Sec. 7525’s narrower scope, the use of AI through public or minimally protected commercial platforms substantially increases the risk of waiver through the third–party–disclosure doctrine, a risk that Heppner has now confirmed exists at the federal trial court level.

Prudent practice demands a combination of three essential elements: a Kovel–mediated architecture overseen by counsel, structured operational discipline at both the prompt and verification layers, and the four engagement–letter provisions above. These steps are not reserved for high–end practices; they are baseline components of competent representation now that technology has outpaced doctrine.

---

Footnotes

¹ Heppner, No. 25-cr-00503-JSR (S.D.N.Y. 2/17/26).

² Kovel, 296 F.2d 918 (2d Cir. 1961).

³ Arthur Young & Co., 465 U.S. 805 (1984).

⁴ BDO Seidman, LLP, 492 F.3d 806 (7th Cir. 2007).

⁵ Valero Energy Corp., 569 F.3d 626 (7th Cir. 2009).

⁶ Frederick, 182 F.3d 496, 502 (7th Cir. 1999).

⁷ Adlman, 134 F.3d 1194 (2d Cir. 1998) (Adlman II); see also Adlman, 68 F.3d 1495 (2d Cir. 1995) (Adlman I) (on remand from which the 1998 opinion issued).

⁸ Moreover, the IRS’s June 24, 2026, bulletin (Issue No. 2026-19) from the Office of Professional Responsibility, “Introductory Guidelines for Responsible AI Use in Federal Tax Practice,” analyzes and alerts practitioners to the applicability of these and other Circular 230 sections.

⁹ Anthropic’s consumer terms have evolved since Heppner’s underlying conduct; practitioners should verify the version applicable to any specific use.

¹⁰ In re OpenAI, Inc., Copyright Infringement Litig., No. 25-MD-3143 (SHS) (OTW) (S.D.N.Y. 1/5/26) (affirming magistrate judge’s preservation and production orders).

¹¹ Heppner, at *4.

¹² Robbins, “Against an AI Privilege,” JOLT Digest, Harvard J. of Law & Technology (Nov. 7, 2025) (“Where AI assists counsel, ordinary rules already apply. No new AI privilege is needed”).

¹³ Warner v. Gilbarco, Inc., 820 F. Supp. 3d 629 (E.D. Mich. 2026).

¹⁴ Morgan v. V2X, Inc., No. 25-cv-01991-SKC-MDB (D. Colo. 3/30/26).

¹⁵ Id., at *8–9, citing Carpenter, 585 U.S. 296, 310–16 (2018), and Warshak, 631 F.3d 283 (6th Cir. 2010).

¹⁶ Shealy, No. 2684CV00799-BLS2 (Mass. Sup. Ct. 6/16/26, decision and order on motion to compel).

¹⁷ Shealy, at *4–5.

¹⁸ Shealy, at *5–6.

¹⁹ Couch, 409 U.S. 322 (1973).

²⁰ Textron, 577 F.3d 21 (1st Cir. 2009) (en banc), cert. denied, 560 U.S. 924 (2010).

²¹ For a comprehensive analysis and practitioner recommendations, see Werfel, “A Risk Framework for AI Use in Tax Administration and Preparation,” 57-8 The Tax Adviser 54 (August 2026).

²² ABA Comm. on Ethics & Pro. Resp., Formal Op. 512 (July 29, 2024); see Fla. Bar Op. 24-1 (Jan. 19, 2024) (recommending informed consent before using third-party generative AI where the use would involve disclosure of confidential client information). For the broader post-Heppner practitioner commentary, see Dale et al., “Recent Federal Privilege Ruling Related to AI Tools Has Implications for Routine Tax Advisor Arrangements,” Proskauer Tax Talks (Feb. 20, 2026); Siva, “Don’t Trust AI, Always Verify. Tax Law Still Needs Humans — Pt. 1 and Pt. 2,” Bloomberg Tax (April—May 2026) (developing the “Kovel gap” framing for tax-AI practice).

²³ See Regs. Secs. 301.7216-1 through 301.7216-3.

---

Contributor

Michael B. Coverstone, J.D., is a tax controversy and litigation attorney with Kostelanetz LLP in Atlanta and principal with Coverstone Law PLLC in Sarasota, Fla. He is also cofounder of Docket.tax, an artificial intelligence–powered tool for tracking U.S. Tax Court cases.For more information about this article, contact thetaxadviser@aicpa.org.

---

MEMBER RESOURCES

Article

Dellinger, “Protecting a Taxpayer’s Privileges,” 53-8 The Tax Adviser 36 (August 2022)

Tax Section resources

AICPA insights: Introductory guidelines for responsible AI use in federal tax practice

Artificial Intelligence (AI) Tax Resource Center