The Kovel engagement letter

Why this document is shaped the way it is

United States v. Kovel, 296 F.2d 918 (2d Cir. 1961) (Friendly, J.), held that an accountant employed by a tax law firm sat inside the attorney-client privilege because "[a]ccounting concepts are a foreign language to some lawyers in almost all cases, and to almost all lawyers in some cases," and the privilege extends where the third party's presence is "necessary, or at least highly useful, for the effective consultation between the client and the lawyer." Id. at 922. The limit sits on the same page: where what is sought is only accounting service — where the advice sought is the accountant's rather than the lawyer's — no privilege exists.

From Kovel and its progeny, four operating conditions:

1. Engagement by counsel — the retention letter runs from the lawyer, not the client.
2. Direction and control by counsel — documented, not assumed.
3. Purpose — making the legal consultation effective; nothing else.
4. Confidentiality obligations and segregation from all non-legal work.

United States v. Heppner, No. 25 Cr. 503 (S.D.N.Y. Feb. 17, 2026) (Rakoff, J.) — the first considered ruling on AI use and privilege — is negative-space guidance only. The court did not hold that AI use waives privilege; it denied a pro se defendant's claim over solo consumer-AI use because (1) no attorney was involved, (2) the platform's data-retention and training terms defeated any reasonable expectation of confidentiality, and (3) no legal advice from counsel was being sought; work product failed because the material was created on the defendant's "own volition," not at attorney direction. (As of this writing, the memorandum is described here through published analysis of the ruling; the ruling tells you what failure looks like, not what success is guaranteed to look like.) Each Heppner failure, inverted, is a drafting requirement in this template:

Two boundaries this template refuses to cross:

• Never the return-prep channel. United States v. Frederick, 182 F.3d 496, 500–01 (7th Cir. 1999) (Posner, J.): return-prep information "is furnished for the purpose of enabling the preparation of the return, not the preparation of a brief or an opinion letter. Such information therefore is not privileged," and "a dual-purpose document — a document prepared for use in preparing tax returns and for use in litigation — is not privileged." The engaged agent instance must never also prepare returns. §§ 3 and 7.
• Never the audit side. United States v. Arthur Young & Co., 465 U.S. 805, 817–18 (1984): the independent auditor's "public watchdog" function "demands that the accountant maintain total independence from the client at all times." Audit-side confidentiality is contrary to declared federal policy; this template is for advice-side and controversy work only. § 3.

One honest risk to carry, not bury: United States v. Ackert, 169 F.3d 136 (2d Cir. 1999), narrowed Kovel in its home circuit to third parties whose "purpose … is to improve the comprehension of the communications between attorney and client"; a third party who supplies independent information is outside. An agent that generates independent analysis sits on the Ackert side of the line in translator-only readings — a real, circuit-dependent risk. The scope clause (§ 3) and the recitals are drafted to keep the engagement on the translator/facilitation side; your counsel must judge how your circuit reads Kovel.

Bracketed text [LIKE THIS] requires adaptation. Bracketed notes [Note: …] explain a drafting choice and should be deleted from the executed letter.

The template

[LAW FIRM LETTERHEAD]
[DATE]
[PLATFORM PROVIDER LEGAL NAME]
[ADDRESS]

Re: Engagement of supervised AI agent services in aid of legal representation — [CLIENT MATTER NUMBER / CODENAME]

[Note: use a matter codename if the client's identity is itself sensitive. This letter is from counsel to the provider. The client is not a party to it. That is the Kovel structure: retention by the lawyer, not the client.]

Dear [PROVIDER]:

1. Engagement by counsel

[LAW FIRM] ("Counsel") represents a client (the "Client") in connection with [DESCRIBE LEGAL MATTER — e.g., "a federal tax controversy," "requests for legal advice regarding the tax treatment of certain transactions"] (the "Matter"). Counsel — not the Client — hereby engages [PROVIDER] ("Provider") to furnish the services of a supervised AI agent instance, as configured and identified in Schedule A (the "Agent"), solely as an agent of Counsel and solely to assist Counsel in rendering legal advice to the Client in the Matter.

Provider and the Agent act at Counsel's sole direction. Nothing in this engagement creates any relationship between Provider and the Client, and Provider shall take no direction from the Client.

[Note: Kovel condition 1 (engagement by counsel) and condition 2 (direction and control). This also answers Heppner's first failure — an attorney is the principal from the first line.]

2. Purpose

The sole purpose of this engagement is to make Counsel's consultation with the Client effective — to assist Counsel in understanding, analyzing, and communicating about [accounting, financial, tax-computational, and documentary] matters that bear on the legal advice Counsel renders in the Matter. Cf. United States v. Kovel, 296 F.2d 918, 922 (2d Cir. 1961).

[Note: recite the purpose in Kovel's own register — facilitating the lawyer-client consultation — and keep it recited, because purpose is the condition courts police hardest.]

3. Scope; express exclusions

The Agent's services under this engagement are limited to facilitation of Counsel's legal advice in the Matter, including [ADAPT: e.g., analysis of financial records supplied by Counsel; computations supporting Counsel's advice; organization and summarization of Matter documents at Counsel's direction; drafting assistance on documents prepared for Counsel's review and adoption].

The following are expressly excluded from this engagement, and Provider shall configure the Agent so that it does not perform them within this engagement:

(a) Tax return preparation or any assistance in preparing any tax return of the Client, and any dual-purpose work usable for return preparation.

[Note: the Frederick channel-separation rule, 182 F.3d at 500–01. If the Client needs return prep, it happens in a different engagement, on a different agent instance, with separate logs — never this one.]

(b) Audit, attest, review, or other assurance services, or any assistance to any independent auditor.

[Note: Arthur Young, 465 U.S. at 817–18 — the attest function is defined by non-confidentiality and is out of scope as a matter of policy, not drafting.]

(c) Advice rendered in the Agent's or Provider's own right. All analysis and output of the Agent is furnished to Counsel as an input to Counsel's legal advice; no output of the Agent shall be furnished to the Client except by Counsel, as adopted into Counsel's own advice.

[Note: the Ackert mitigation — keep the Agent a facilitator of Counsel's advice, never an independent advisor whose advice is "the accountant's rather than the lawyer's," Kovel, 296 F.2d at 922.]

(d) Any services for any matter other than the Matter, and any pre-existing or ongoing non-legal work for the Client.

[Note: segregation — Kovel condition 4.]

4. Confidentiality; zero retention; no training

(a) Provider shall hold all information received, generated, or processed by the Agent in connection with the Matter ("Engagement Information") in strict confidence, and shall not disclose it to any person other than Counsel and Counsel's designated personnel.

(b) Zero retention. Provider shall not retain Engagement Information beyond [the duration of the active session / N days as required for service operation], after which it shall be irretrievably deleted. Provider shall have no capability to reconstruct deleted Engagement Information. [ADAPT to the provider's actual, contractually binding retention architecture — this clause must describe reality, not aspiration.]

(c) No training. Provider shall not use Engagement Information to train, fine-tune, evaluate, or improve any model or system, and shall not permit any subprocessor to do so.

(d) Provider represents that the terms of service and data-processing terms applicable to the Agent instance identified in Schedule A do not conflict with this Section 4, and that this letter controls over any conflicting standard terms.

[Note: this section is the direct answer to Heppner's second failure — the consumer platform's retention/training/disclosure terms defeated any reasonable expectation of confidentiality. Enterprise contractual terms are what distinguish this engagement from that record. It also converts a vendor-subpoena problem into a nothing-to-produce fact: what is not retained cannot be compelled.]

(e) Subpoena and compelled disclosure. If Provider receives any subpoena, summons, or other demand relating to Engagement Information, Provider shall (to the extent lawful) notify Counsel promptly and before any disclosure, and shall cooperate with Counsel's assertion of any applicable privilege or protection. Provider shall not voluntarily disclose Engagement Information.

5. Direction and control; supervision

(a) The Agent operates under Counsel's direction and control. Counsel shall designate the attorneys authorized to direct the Agent (Schedule B), and only their instructions are authorized instructions.

(b) All substantive tasks performed by the Agent in the Matter shall be initiated by, and the Agent's output reviewed by, a designated attorney. Counsel's directions shall be given through the logged channel described in Section 6, so that attorney direction is documented contemporaneously.

[Note: Heppner's work-product failure — material created "on his own volition," not at attorney direction. Documented direction is what makes the work product claim, and it costs nothing when the channel itself is the log.]

6. Audit trail

Provider shall maintain, and furnish to Counsel on request, a complete, tamper-evident log of the Agent's activity in the Matter, recording for each session: the identity of the directing attorney, the authorization under which the Agent acted, the instructions given, the actions taken, and the outputs produced. The log is Engagement Information, is maintained for Counsel's benefit, and [is retained by Counsel, not Provider / is delivered to Counsel and deleted by Provider on the schedule in Section 4(b)].

[Note: an authorization-and-interaction audit trail of this kind is the evidentiary artifact for supervision and direction — it proves Kovel condition 2 and the Heppner direction requirement without relying on anyone's memory. Note the retention interplay: the log proves supervision, the substrate retains nothing — decide deliberately where the log lives.]

7. Dedicated instance; segregation of channels

The Agent shall be a dedicated instance provisioned solely for this engagement and the Matter. It shall not be used for any other matter, any other client, or any excluded service under Section 3, and its logs, memory, context, and any working storage shall be segregated from every other instance — including any instance performing return preparation or other accountants'-work services for the Client under any separate engagement.

[Note: Frederick dual-purpose hygiene made provable. For software this separation is trivially cheap: one matter, one instance, one log.]

8. Waiver avoidance

(a) No Engagement Information, and no output of the Agent, shall be disclosed to, shared with, or reused by any person outside this engagement — including the Client's ordinary accountant or return preparer — except as Counsel directs in writing after considering the privilege consequences.

(b) Output of the Agent shall be labeled: "Privileged and Confidential — Prepared at the direction of counsel in aid of legal advice — [MATTER]."

[Note: labels do not create privilege, but they evidence purpose and prevent inadvertent reuse.]

(c) On termination, Provider shall [deliver to Counsel and/or destroy] all Engagement Information per Section 4(b) and certify destruction in writing.

9. Fees; term; miscellaneous

[FEES]

[Note: Counsel pays Provider and bills the Client as a disbursement; do not have the Client pay Provider directly, which muddies the engagement-by-counsel structure.]

[TERM AND TERMINATION.] [GOVERNING LAW.] [Standard provisions: no assignment; subprocessors only with Counsel's written consent and flow-down of Sections 4, 6, and 8; survival of Sections 4, 6, and 8.]

Please confirm Provider's agreement by countersigning below.

Very truly yours,
[ATTORNEY NAME]
[LAW FIRM]

Agreed and accepted:
[PROVIDER LEGAL NAME]
By: ____________________ Date: ____________

Schedule A — Agent instance identification: [instance identifier; model/version; configuration; the contractual data-processing terms incorporated by reference]
Schedule B — Designated directing attorneys: [names]

Drafting checklist (map before you sign)

• Letter runs from counsel to provider; client is not a party and does not pay provider directly (Kovel condition 1; Heppner failure 1)
• Purpose recited as making the legal consultation effective (Kovel condition 3)
• Direction and control by counsel, documented through a logged channel (Kovel condition 2; Heppner work-product failure)
• Zero-retention and no-training terms that describe the provider's actual architecture; standard ToS overridden (Heppner failure 2)
• Return prep and all dual-purpose work excluded; dedicated instance per matter with segregated logs (Frederick, 182 F.3d at 500–01)
• Audit, attest, and assurance work excluded (Arthur Young, 465 U.S. at 817–18)
• Agent output flows only through counsel; no independent advice to the client (Ackert, 169 F.3d 136; Kovel, 296 F.2d at 922)
• Subpoena-notice and no-voluntary-disclosure covenants in place
• No reuse of engagement material outside the engagement (waiver traps)
• Your counsel has adapted every bracket to your jurisdiction and circuit

Sources

Every legal proposition above traces to the primary sources cited in text and to the Org.AI Foundation research brief, The Accounting Analog: CPA Confidentiality, Privilege, and the Supervised AI Agent (2026-08-01):

• United States v. Kovel, 296 F.2d 918 (2d Cir. 1961)
• United States v. Ackert, 169 F.3d 136 (2d Cir. 1999)
• United States v. Frederick, 182 F.3d 496 (7th Cir. 1999)
• United States v. Arthur Young & Co., 465 U.S. 805 (1984)
• United States v. Heppner, No. 25 Cr. 503 (S.D.N.Y. Feb. 17, 2026), described through published analysis of the ruling; the memorandum should be read directly before reliance

Educational template. Not legal advice. No attorney-client relationship. Have your counsel adapt this.