Artificial intelligence tools are now a fixture of daily practice, for tax attorneys, CPAs, and the clients they share. But two federal rulings issued in February 2026 reached opposite conclusions about whether using those tools destroys the legal protections that shield a client’s work from disclosure. Neither case arose in a tax matter. Both should change how tax and accounting professionals structure AI-assisted engagements.
Two February Decisions, Different Results
In United States v. Heppner, No. 25-cr-00503 (JSR), 2026 WL 436479 (S.D.N.Y. Feb. 17, 2026), Judge Jed Rakoff held that a criminal defendant’s own communications with a public, consumer version of a generative AI chatbot were protected by neither attorney-client privilege nor the work product doctrine. The defendant had used the tool on his own initiative, without counsel’s direction, after receiving a grand jury subpoena.
The court’s reasoning was blunt: the tool is not an attorney, so the privilege never attached, and disclosing the substance of the matter to a public AI platform — whose own terms of use gave the operator access to the exchange — was a disclosure to a third party.
In Warner v. Gilbarco, Inc., No. 2:24-cv-12333, 2026 WL 373043 (E.D. Mich. Feb. 10, 2026), a federal magistrate in Michigan reached the opposite result on different facts. A pro se civil plaintiff had used a consumer chatbot to help prepare her own filings. The court denied a motion to compel her AI-related materials, reasoning that the tool was “a tool, not a person,” and that routing draft work through it did not hand the material to an adversary — the touchstone for waiving work product protection.
The decisions arise from materially different facts, procedural settings, and asserted protections. Heppner rejected privilege and work-product claims over a defendant’s use of a public AI platform outside counsel’s direction. Warner treated AI-assisted litigation materials as potentially protected where use of the tool did not amount to disclosure to an adversary or otherwise defeat the claimed protection.
Attorney-client privilege is waived by disclosure to any third party outside the protected relationship. Work-product protection is not automatically waived by every third-party disclosure. The central question is whether the disclosure is inconsistent with preserving the material from adversaries—often because it reaches, or materially increases the prospect that it will reach, an opposing party.
An AI platform can be a disqualifying third party for the first purpose without being one for the second. Every tax and accounting practice needs to internalize that distinction.
The Missing Link: United States v. Kovel
Sixty-five years before Heppner and Warner, the Second Circuit faced the accountant version of the same problem in United States v. Kovel, 296 F.2d 918 (2d Cir. 1961). Kovel, a former IRS agent working for a tax law firm, was held in contempt for refusing to answer grand jury questions about a client, on the theory that a non-lawyer accountant could never fall within the attorney-client privilege.
The Second Circuit disagreed. It held that privilege can extend to a non-lawyer, including an accountant, when three conditions are met: the accountant is engaged by, or at the direction of, the attorney rather than the client directly; the accountant’s role is to help the attorney render legal advice, not to provide independent accounting services; and the communication stays confidential.
The court famously likened the accountant to a translator, helping a lawyer who finds accounting concepts “a foreign language” understand a client’s affairs well enough to give legal advice.
Heppner failed every element of that test. There was no attorney directing the AI use, no purpose of facilitating legal advice, and no confidentiality, given the platform’s own privacy terms. Warner survived on work product only because the doctrine’s narrower waiver standard does not require any of those three things — it asks only whether the material reached an adversary.
That gap matters enormously for a tax and accounting practice, because most of the work a CPA or tax attorney does is advisory, not litigation. Work product only protects material prepared in anticipation of litigation; it is rarely available for day-to-day return preparation, tax structuring, or planning advice.
For that work, attorney-client privilege, or its narrower statutory cousin for accountants, the federally authorized tax practitioner privilege under 26 U.S.C. § 7525, is doing essentially all of the protective work. Both are exactly as vulnerable to Heppner’s third-party disclosure reasoning as the accountant arrangement the framework was designed around.
Circular 230 Has Already Caught Up
The IRS Office of Professional Responsibility did not wait for a tax case to weigh in. On June 24, 2026, OPR issued Alert 2026-19, Introductory Guidelines for Responsible AI Use in Federal Tax Practice, mapping existing Circular 230 duties directly onto AI-assisted work. The core points for practitioners:
- Due diligence (§ 10.22): Practitioners must independently verify every fact, citation, and calculation an AI tool produces before it reaches a client or the IRS. AI output is a starting point, not a finished product.
- Competence (§ 10.35): Now includes understanding the AI tools in use, how they generate content, and where errors or bias can arise. A lack of technological competence is itself treated as a professional-responsibility gap.
- Fees (§ 10.27(a)): Efficiencies gained from AI use should be reflected in what is billed, not padded, to avoid an “unconscionable fee” before the IRS.
- Real consequences, already documented: The alert points to filings undone by fabricated, “hallucinated” citations, and to Deloitte Australia’s July 2025 government report, which shipped with invented quotations and nonexistent sources before anyone caught the errors.
The message is consistent with Heppner and Warner: the practitioner, not the platform, remains fully responsible for what leaves the office.
Building an AI-Safe Engagement Structure
None of this counsels against using AI tools. It counsels using them the way the profession has used outside specialists for sixty years, with the same discipline Kovel already requires. A few concrete steps:
- Route sensitive AI-assisted analysis through counsel, Kovel-style. Where privilege matters, the CPA or the AI-assisted work product should be engaged by, or performed at the direction of, the attorney, for the specific purpose of helping the attorney render legal advice, with the engagement letter saying so in writing.
- Use enterprise or business-tier AI tools with a negotiated data protection addendum, not free consumer versions. Heppner turned in part on the fact that the tool’s standard privacy policy gave the operator access to the conversation; enterprise agreements should be built to override that default and preserve confidentiality.
- Do not rely on work product as a backstop. It exists only once litigation is reasonably anticipated, and most planning, compliance, and advisory engagements never reach that point.
- Document an AI-use policy in the firm: which tools are approved, who may use them, and what gets independently verified before it reaches a client or the government.
- Train staff that querying an AI tool is not the same as consulting a colleague. Every output needs a documented human review before it moves toward a client or a filing.
- Talk to clients about what they paste into consumer chatbots before they ever call you. Warner preserved protection for a self-represented litigant’s own ChatGPT use, but that is a low bar. Clients discussing sensitive tax positions with a public chatbot on their own should not assume the same result.
Heppner and Warner will not be the last word on AI and privilege, and neither one binds the tax court. Together, these decisions provide early and fact-specific federal guidance on how courts may analyze AI use, confidentiality, privilege, and work-product protection. The underlying law is not new. Kovel has managed the problem of a third party in the room for more than sixty years. The task now is to apply that same discipline to the newest third party at the table.
===-
Saidin M. Hernandez, Esq., LL.M. is the Principal Attorney at BridgePointe Global Counsel, a boutique international tax and cross-border law firm based in Coral Gables, Florida, serving high-net-worth individuals, foreign nationals, and globally situated families across Latin America, the Caribbean, and Europe. Learn more at www.bridgepointeglobal.com.
Sign in to get access to this free resource, and all of our whitepapers and reports.
Download this content today!
Register Now Already registered? Click here to Log In
