Tax Teams and AI Privilege: Why There Is Still No Bright-Line Rule

Artificial intelligence has moved into every corner of the modern law department and accounting firm. Tax professionals use it to research complex issues, draft analysis memoranda, model exposure scenarios, and pressure-test litigation positions. The efficiency gains are real. But a series of early court decisions — most prominently a February 2026 ruling from the Southern District of New York — have put every general counsel, outside tax counsel, and CFO on notice that feeding confidential information into an AI tool can strip away the very protections your team assumed were in place. At the same time, a competing decision from the Eastern District of Michigan issued the same week reached the opposite result on similar facts, proving that there is still no bright-line rule. This post explains the doctrinal landscape, breaks down what the courts have decided and why, and lays out the steps in-house and outside counsel must take today to maximize privilege and work-product protection when AI is in the workflow.

Why Privilege and Work Product Matter for Tax Work

Before getting to the AI wrinkle, it helps to remember why these protections matter so much in a tax context.

Attorney-client privilege protects confidential communications between a client and the client’s attorney that are made for the purpose of obtaining or providing legal advice. In the tax setting, that means analysis of litigation exposure, opinions on the deductibility of a challenged transaction, advice on transfer pricing positions, and communications regarding a government investigation or examination — all potentially protected if the requirements are met.

The work-product doctrine (codified in Federal Rule of Civil Procedure 26(b)(3)) is broader and distinct: it protects documents and tangible things prepared in anticipation of litigation by a party or a party’s representative, including attorneys. Opinion work product — material reflecting an attorney’s mental impressions, conclusions, and legal theories — receives nearly absolute protection.

Both doctrines are creatures of common law, subject to waiver. Anything that breaks confidentiality — voluntarily disclosing a communication to a third party, or preparing material outside the control of counsel — can destroy the protection entirely. That waiver risk is exactly what makes AI tools dangerous if used carelessly.

United States v. Heppner: The First Major AI Privilege Ruling

The most consequential AI privilege decision to date came on February 10, 2026, when Judge Jed Rakoff of the Southern District of New York issued an oral ruling in United States v. Heppner, No. 25 Cr. 503 (JSR) (S.D.N.Y.).

The Facts

Bradley Heppner faced securities fraud, wire fraud, conspiracy, and related charges arising from an alleged scheme to defraud investors in a financial services company. Before retaining or while working with defense counsel, Heppner used a non-enterprise, consumer version of Anthropic’s Claude — a publicly available chatbot — to research legal issues related to the government’s investigation. Without the direction or involvement of his attorneys, Heppner fed information he had learned from counsel into the public AI tool and generated “reports that outlined defense strategy, that outlined what he might argue with respect to the facts and the law.”

The government moved to compel production of the AI-generated documents. Heppner argued that the documents were protected by both attorney-client privilege and the work-product doctrine.

The Court’s Analysis

Judge Rakoff rejected both arguments in short order.

On attorney-client privilege, the court’s reasoning was direct: because Claude is not an attorney, that alone disposes of the privilege claim. Attorney-client privilege protects communications between a client and the client’s attorney. Heppner communicated with an AI tool, not a lawyer. The documents simply do not fit the foundational elements of the privilege.

The court also found that confidentiality was fatally compromised. By communicating with a third-party, public platform, Heppner could have no reasonable expectation that the communications were confidential. The fact that the AI’s outputs were later shared with defense counsel did not retroactively create privilege in documents that were created without the necessary confidentiality.

On work product, the analysis turned on who directed the creation of the documents and for what purpose. The work-product doctrine requires that materials be prepared by or for a party or its representative — typically a lawyer — in anticipation of litigation. Judge Rakoff found that Heppner’s AI queries were not done at the direction of counsel. Heppner acted on his own, without counsel’s involvement or instruction, in creating the documents. The fact that he later shared the outputs with his lawyers was not enough to bring the documents within the doctrine.

Why This Matters for Tax Departments

Heppner is a criminal case, but the doctrinal analysis travels directly into civil and regulatory tax matters. Consider the following scenarios that are now in legal jeopardy:

• An in-house tax attorney enters details of an IRS audit letter and the company’s proposed response into a public AI chatbot to generate a draft analysis.
• A CFO — acting without attorney direction — prompts a consumer AI tool to research the company’s exposure on a transfer pricing dispute and shares the output with outside counsel.
• A tax manager uses a free AI service to model the penalties associated with a disclosed tax position and emails the results to the tax director.

In each case under Heppner‘s reasoning, the AI-generated output may not be privileged, and the underlying data fed to the public tool may have been disclosed to a third party, creating a waiver problem that extends beyond the AI document itself.

Warner v. Gilbarco: The Competing Ruling

The very same day Heppner was decided — February 10, 2026 — the United States District Court for the Eastern District of Michigan reached a different result in Warner v. Gilbarco, Inc. The court denied a motion to compel production of documents that a self-represented litigant had prepared using a public AI chatbot, finding that work-product protection applied.

The full written opinion was not yet widely available at the time of this writing, but the divergent outcome illustrates a point that practitioners must internalize: courts are approaching AI privilege questions on a fact-specific basis. There is no circuit court guidance yet. There is no statute. The analysis turns on particular facts — who directed the work, what platform was used, what data was entered, whether the material was intended for litigation — and different judges applying similar facts may reach opposite conclusions.

The Three Foundational Problems AI Creates for Privilege

Drawing from Heppner and the broader doctrinal framework, AI creates three distinct privilege problems that tax teams must understand.

1. The Third-Party Disclosure Problem

When a user submits a prompt to a public AI chatbot, the user’s input is transmitted to and processed by the AI service provider’s servers. Most consumer-facing AI products retain prompt data for model improvement unless the user affirmatively opts out or pays for an enterprise subscription with specific data-handling commitments. Under traditional privilege doctrine, voluntarily disclosing a communication to a third party who has no legal duty of confidentiality destroys the privilege. A public AI platform is almost certainly such a third party.

This is not a hypothetical concern. Courts have consistently held that disclosure to a third party — even inadvertent or negligent disclosure — can waive privilege. Feeding confidential client communications or attorney mental impressions into a public AI tool fits squarely within that framework.

2. The “Prepared by Counsel” Problem

Work-product doctrine requires that the material be prepared by or for a party or its counsel in anticipation of litigation. When a lay employee or a client — without counsel’s direction — generates AI output analyzing legal exposure, two elements are potentially missing: the “by or for counsel” element and, depending on the circumstances, the “anticipation of litigation” element. Heppner crystallizes this: the documents failed work-product protection not only because the platform was public but because counsel did not direct their creation.

This creates a compliance challenge inside organizations where tax professionals regularly use AI to pre-screen issues before escalating to counsel. The pre-screening outputs themselves may not be protected, and the data in them may be discoverable.

3. The Temporal and Causal Nexus Problem

Even if counsel is involved, privilege requires that the communication be made for the purpose of obtaining legal advice, and work product requires preparation in anticipation of litigation. If AI-generated documents are created for routine business planning — optimizing tax positions for business reasons, not because litigation is anticipated — they may fall outside work-product protection even if a lawyer reviews them afterward. Post-hoc involvement of counsel does not automatically cloak pre-existing documents.

What In-House and Outside Counsel Must Do Today

Given the current state of the law — unsettled, fact-specific, and trending toward stricter scrutiny — counsel and clients must take concrete steps to maximize the protections they can claim.

Step 1: Audit Your AI Tools

Know exactly what AI tools your tax team is using. Categorize them into three buckets:

• Public consumer tools (ChatGPT free tier, Claude.ai free tier, Gemini, Copilot via browser): These carry the highest risk under Heppner. Confidential client data should not go into these tools without a clear understanding that the input may not be protected.
• Enterprise tools with data-processing agreements: If your organization has entered a Business Associate Agreement (BAA), Data Processing Addendum (DPA), or comparable agreement that prohibits the vendor from using your data for training, the third-party disclosure problem may be addressed. You still have the “prepared by counsel” problem to navigate.
• On-premises or air-gapped deployments: AI models deployed within your organization’s own infrastructure, where data does not leave your network, present the strongest case that no third-party disclosure occurred.

Step 2: Implement Counsel-Direction Protocols

To maximize work-product protection, AI-generated tax analysis should be created at the express direction of counsel and documented as such. This means:

• Counsel should initiate or authorize the AI task in writing (even a simple email instruction suffices as documentation).
• The resulting output should be marked confidential and directed back to counsel.
• Business personnel should not independently generate AI tax analysis without counsel’s involvement.

This protocol mirrors the approach courts have approved for traditional work product: counsel directs third-party consultants, and the resulting work is within the doctrine. The same logic applies to AI.

Step 3: Segregate Legal from Business Analysis

Not every tax analysis is legal advice. Routine modeling of tax efficiency, rate optimization for business planning, or tax provision work is primarily business function, not attorney-client communication. Privilege does not attach simply because a lawyer is copied on a distribution. Train your team to understand the distinction and to clearly label documents that are created specifically for purposes of obtaining legal advice or in anticipation of litigation.

Step 4: Adopt AI Use Policies

Written AI governance policies that address attorney-client privilege and work product protection are no longer optional for law departments and law firms. Effective policies should specify:

• Which AI platforms are approved for use with sensitive legal or tax matters.
• What data classifications may be entered into each approved platform.
• The requirement that counsel direct AI tasks that may produce work product.
• Procedures for logging and retaining AI-generated documents that counsel intends to assert as privileged.
• Prohibition on using public, consumer AI tools for any communication that the organization intends to keep confidential.

Step 5: Assess Existing Documents

If your tax team has already generated AI analysis using public tools, assess those documents now — before the government issues an information document request, before civil discovery begins, or before an examination reaches the point of document demands. Identify what was entered into public AI tools, what the outputs said, and what sensitive information was disclosed in the process. In some cases, the analysis may already have been compromised; in others, the facts may be distinguishable from Heppner. Outside counsel should be involved in this assessment.

Step 6: Document the Litigation Nexus

When AI tools are used to generate analysis in connection with anticipated or actual litigation, document the nexus clearly. Counsel should state in writing that the analysis is being prepared in anticipation of litigation and that it contains counsel’s mental impressions or strategic thinking. Timestamped documentation of when litigation became reasonably anticipated strengthens the work-product claim.

The Enterprise AI Exception: A Path Forward

Many organizations have purchased enterprise subscriptions to AI platforms that include contractual commitments not to use customer data for model training, not to share data with third parties, and to store and process data within defined security parameters. These arrangements address the third-party disclosure problem to a meaningful degree — though not perfectly, since some courts may still find that the service provider is a “third party” for waiver purposes.

The emerging best practice, for organizations that intend to use AI heavily in tax and legal work, is to move to enterprise deployments with strong data-handling agreements, implement counsel-direction protocols for work-product-eligible tasks, and obtain written legal analysis from qualified attorneys before deploying AI in high-stakes matters.

What Courts Have Not Yet Decided

Several important questions remain unanswered:

Does it matter if the AI output is substantially transformed by a lawyer? If a lawyer uses AI to generate a first draft and then substantially rewrites it, incorporating their own analysis and mental impressions, is the final document work product? Most privilege scholars would say yes — but no court has squarely held it.

Does enterprise-tier AI use satisfy the confidentiality requirement? The courts have not analyzed whether a contractual DPA with an AI vendor adequately substitutes for the traditional third-party confidentiality duty (as attorneys, accountants, and other professionals owe to their clients).

What about AI embedded in legal and tax platforms? Tools like tax research platforms and e-discovery platforms increasingly incorporate AI engines. Courts will need to decide whether AI embedded in software that lawyers already use for privileged work receives different treatment than a standalone chatbot.

Does jurisdiction matter? Heppner is a district court opinion in the Second Circuit. District courts in other circuits may analyze these facts differently, and appellate courts have not yet spoken. The Warner outcome on the same day illustrates that even within the same timeframe, district courts can diverge.

Practical Takeaways for Tax Teams

The bottom line for tax directors, general counsel, and outside tax advisors is this:

1. Assume nothing. AI-generated documents are not automatically privileged. The tools, the workflow, and the oversight structure all matter.
2. Counsel must be in the chain. If tax analysis generated by AI is intended to be work product, counsel must direct its creation — not ratify it after the fact.
3. Public AI platforms are a red flag. Consumer-facing AI tools present the highest risk of waiver. Move to enterprise deployments for anything sensitive.
4. Document, document, document. The strength of a privilege or work-product claim will often come down to documentation showing that counsel directed the work, the work was done in anticipation of litigation, and the tool used maintained confidentiality.
5. Monitor the case law. This area is developing fast. Heppner is a first-of-its-kind ruling; there will be others. Organizations that track developments and adjust policies accordingly will be better positioned than those waiting for a bright-line rule that may not come for years.

The use of AI in tax and legal work is not going to slow down. The courts are going to keep wrestling with the doctrine. The teams that build their workflows thoughtfully — with counsel at the center and confidentiality protections in place — are the ones who will be able to claim protection when the government or opposing counsel comes looking.

This post is for general informational purposes only and does not constitute legal advice. Reading this post does not create an attorney-client relationship. If you have questions about your specific situation, consult a qualified attorney.