tax.org.ai / privilege · an Org.AI Foundation program

The four legal bases, the operational checklist, and the two artifacts —
with the limits given equal weight.

Legal bases
4Kovel's counsel-engaged agent doctrine; Heppner's negative-space roadmap; IRC §7525's incorporation by reference; and, optional and last, three text-verified state statutes. Each below, limits first-class.
Courts that have squarely blessed AI-agent Kovel status
0Said on purpose, at the top. Everything on this page is the best-available doctrinal structure, not settled law. Heppner tells you what failure looks like — not what success is guaranteed to look like.
Artifacts
2A Kovel engagement-letter template and an AICPA Rule 1.700.001 compliance memo. Educational, not legal advice, forming no attorney-client relationship. Have your counsel adapt them.

Base one: Kovel

United States v. Kovel, 296 F.2d 918 (2d Cir. 1961) (Friendly, J.): a nonlawyer agent, engaged by counsel to make the legal consultation effective, sits inside the attorney-client privilege.

The facts: an accountant employed by a tax law firm, jailed for contempt for refusing to answer grand-jury questions about a firm client — and held inside the privilege. Judge Friendly's rationale runs through the figure of the translator: "Accounting concepts are a foreign language to some lawyers in almost all cases, and to almost all lawyers in some cases." The privilege extends where the accountant's presence is "necessary, or at least highly useful, for the effective consultation between the client and the lawyer." 296 F.2d at 922.

The limit sits on the same page, and it carries equal weight here: where what is sought is only accounting service — where the advice sought is the accountant's rather than the lawyer's — no privilege exists. Necessity, or at least high usefulness, for the legal consultation; never mere convenience.

Four operating conditions, from Kovel and its progeny. One: engagement by counsel — the retention letter runs from the lawyer, not the client. Two: direction and control by counsel, documented rather than assumed. Three: purpose — making the legal consultation effective, nothing else. Four: confidentiality obligations, and segregation from all non-legal work.

And the narrowing is the Second Circuit's own. United States v. Ackert, 169 F.3d 136 (2d Cir. 1999), confined Kovel to third parties whose "purpose … is to improve the comprehension of the communications between attorney and client," and held that a communication "does not become shielded by the attorney-client privilege solely because the communication proves important to the attorney's ability to represent the client" — the third party there supplied independent information rather than translating the client's. United States v. Frederick, 182 F.3d 496 (7th Cir. 1999) (Posner, J.), adds the channel rule: return-prep information "is furnished for the purpose of enabling the preparation of the return, not the preparation of a brief or an opinion letter. Such information therefore is not privileged" (at 500), and "a dual-purpose document — a document prepared for use in preparing tax returns and for use in litigation — is not privileged" (at 501). The waiver traps follow: Kovel material reused in return prep, or shared with the client's ordinary accountant, waives.

The doctrine admits the agent. Its limits set the design: translator-side work only, one channel, no reuse.

Base two: the Heppner roadmap

United States v. Heppner, No. 25 Cr. 503 (S.D.N.Y. Feb. 17, 2026) (Rakoff, J.) — the first considered AI-privilege ruling — is negative-space guidance. Three failures, each of which inverts into a requirement.

The court did not hold that AI use waives privilege. It denied a pro se defendant's claim over his solo use of a consumer AI platform on three traditional grounds, with a fourth on work product:

One — no attorney was involved: the AI is not an attorney, and none directed its use. Inverted: counsel engagement, documented. Two — the platform's data-retention, training, and disclosure terms defeated any reasonable expectation of confidentiality. Inverted: contractual zero-retention, no-training enterprise terms that override consumer terms of service. Three — no legal advice from counsel was being sought. Inverted: use directed at obtaining legal advice through counsel, recited and real. Four — work product failed because the material was created on the defendant's "own volition," not at attorney direction. Inverted: attorney direction, documented contemporaneously through a logged channel.

One more thing the published analysis reports, and we flag rather than absorb: the court is described as rejecting an analogy between the AI platform and mere software, emphasizing that privileges presuppose a relationship of trust. If the memorandum bears that reading, it is adverse authority — in that district — for any theory that treats the agent as a tool whose use is invisible to privilege. It is one reason this program leads with the Kovel-engagement frame, where the agent is engaged and directed like the accountant in Kovel, rather than with tool theory. The memorandum itself has not yet been retrieved; until it is read, this page describes the ruling only through the published analysis it cites, and both flags stay flags.

The caveat, stated as often as the checklist: no court has squarely held that a supervised AI agent receives Kovel treatment. Heppner identifies the failure modes; it does not hold that the inverted structure succeeds.

A roadmap drawn in negative space is still a roadmap. It is not a destination certificate.

Base three: §7525

The federally-authorized-tax-practitioner privilege is a parasite statute, in the useful sense: it incorporates attorney-client common law by reference, so it inherits every win automatically.

With respect to tax advice, the same common law protections of confidentiality which apply to a communication between a taxpayer and an attorney shall also apply to a communication between a taxpayer and any federally authorized tax practitioner to the extent the communication would be considered a privileged communication if it were between a taxpayer and an attorney.26 U.S.C. § 7525(a)(1) — law.cornell.edu

Practitioner means anyone authorized to practice before the IRS under 31 U.S.C. §330 — attorneys, CPAs, enrolled agents, enrolled actuaries — and tax advice means advice within the scope of that authority. If the common law comes to place the lawyer's supervised AI agent inside the attorney-client privilege, §7525 carries that result to the CPA's tax advice by its own text. No separate ask.

The perforations, bluntly. Section 7525(a)(2) makes the privilege assertable only in noncriminal tax matters before the IRS and noncriminal tax proceedings in federal court brought by or against the United States: no criminal matters, no state courts or agencies, no private litigation, no non-tax federal proceedings. Section 7525(b) strips any written communication in connection with the promotion of participation in a tax shelter, broadly construed. And Frederick closes the return-prep door with a sentence aimed at the statute itself: "Nothing in the new statute suggests that these non-lawyer practitioners are entitled to privilege when they are doing other than lawyers' work." 182 F.3d at 501.

§7525 is the propagation mechanism, and only that. It is never the reason a workflow is safe.

Base four: state law, optional

Three states, text-verified, where an accountant privilege already extends to the accountant's helpers. Optional, post-precedent clarifications — the counsel-engaged structure does not depend on them.

Colorado, C.R.S. §13-90-107(1)(f): a certified public accountant "shall not be examined without the consent of his or her client" as to "any communication made by the client to him or her in person or through the media of books of account and financial records or his or her advice, reports, or working papers" — and neither shall "a secretary, stenographer, clerk, or assistant of a certified public accountant." That assistant clause is a one-word-amendment target, someday, if drift in the caselaw ever demands it.

Missouri, RSMo §326.322.2: "A licensee shall not be examined by judicial process or proceedings without the consent of the licensee's client as to any communication made by the client to the licensee … or the licensee's advice, reports or working papers," with the same extension to "a secretary, stenographer, clerk or assistant of a licensee," and an exception where the material is relevant to the defense of an action against the licensee.

Idaho, Rule of Evidence 515 — the one state where the privilege lives in a Supreme-Court-adopted evidence rule, so rule-petition mechanics could port. Its "representative of the accountant" is "one employed by the accountant to assist the accountant in the rendition of professional accounting service" — arguably already wide enough. The client holds the privilege; the accountant may claim it only on the client's behalf; the standard exceptions apply.

Why these are last, and framed as optional: the thesis of this site is that counsel-engaged work needs no rule change anywhere. These state clauses matter chiefly for the CPA-without-counsel slice, and as insurance against personification drift — codes that read "assistant" to mean a person. Only these three states were text-verified for this page; no other state's statute is cited anywhere on this site. And no state accountant privilege is recognized in federal cases at all — Arthur Young, 465 U.S. at 817, citing Couch v. United States, 409 U.S. 322 (1973).

Nothing here is a prerequisite. That is what "the answer already exists" means.

The checklist

Heppner's negative space merged with Kovel's formalities: six conditions, all engagement hygiene, none requiring anyone's permission.

  • Counsel retains the platform — not the client, and not the CPA firm. The retention letter runs from the lawyer.
  • The engagement letter names the supervised agent instance and recites its scope: facilitation of counsel's legal advice, in Kovel's register, with return prep, audit, and independent advice expressly excluded.
  • Zero-retention, no-training contractual terms that describe the vendor's actual architecture, and that override any conflicting consumer terms of service.
  • Counsel's direction is documented as it happens, through a tamper-evident authorization-and-interaction log held as engagement material.
  • One dedicated agent instance per matter, with segregated logs — never the return-prep channel, never another matter, never another client.
  • No Kovel material is reused outside the engagement — not by the client's ordinary accountant, not by the return preparer, not by anyone, except as counsel directs in writing.

Every line is implemented, clause by clause, in the engagement-letter template.

The honest counterarguments

Four ways this fails, stated by us before anyone else states them. The structure above is the best available; it is not settled law.

Ackert. In translator-only readings of Kovel — including the Second Circuit's own — an agent that generates independent analysis sits on the wrong side of the line. Mitigation, not cure: scope the engagement to facilitation, route every output through counsel's adoption, and accept that this is a real, circuit-dependent risk your counsel must weigh for your circuit.

Frederick. Dual-purpose material is stripped, and channel-crossing is the everyday failure mode of tax practice. Mitigation: for software the separation is finally cheap — one matter, one dedicated instance, one segregated log, and the return-prep engagement lives elsewhere.

Personification drift. Some privilege codes read "assistant" or "representative" as a person, and Heppner's reported software-analogy language shows a court reasoning about trust between humans. Mitigation: the Kovel frame does not require the agent to be a person — it requires the agent to be counsel's — and, if drift hardens, the Colorado/Missouri/Idaho clauses above are the one-word amendments waiting.

The vendor subpoena. The privilege can hold and the platform still be served. Mitigation: zero retention converts a waiver problem into a nothing-to-produce fact; subpoena-notice and no-voluntary-disclosure covenants handle the rest. What is not retained cannot be compelled.

If a court rejects the structure, this page will say so, in the same type size as everything else.

Out of scope: audit

The deep page repeats the wall, verbatim, because the deep page is where someone might be tempted to look for a way around it.

By certifying the public reports that collectively depict a corporation's financial status, the independent auditor assumes a public responsibility transcending any employment relationship with the client. … This "public watchdog" function demands that the accountant maintain total independence from the client at all times and requires complete fidelity to the public trust.United States v. Arthur Young & Co., 465 U.S. 805, 817–18 (1984)

The Court refused work-product protection for auditors' tax accrual workpapers and enforced the summons. The audit function is defined by non-confidentiality: the auditor's loyalty runs to the investing public. No confidentiality or privilege structure on this page — human or AI — applies to attest work, and none ever will here. Advice side only: tax advice, controversy representation, litigation support.

The wall is right. We are building on our side of it.

The artifacts

Two educational templates that implement everything above. Not legal advice; no attorney-client relationship; have your counsel adapt every clause.

The Kovel engagement letter — counsel-to-provider, agent-scoped, with the Heppner failure table mapped to drafting requirements, zero-retention and no-training terms, a subpoena-notice covenant, documented direction, a tamper-evident audit-trail clause, one dedicated instance per matter, and waiver-avoidance mechanics. Human face: tax.org.ai/kovel-letter. Machine face, the adaptable text itself: /kovel-letter.md.

The AICPA Rule 1.700.001 compliance memo — the confidentiality rule and its explicit no-evidentiary-privilege disclaimer, Interpretation 1.700.040's two service-provider paths with a six-element enterprise-terms floor, client-consent mechanics, the honest §7525 posture, the Kovel cross-reference, the Arthur Young wall, and the three verified state statutes. Human face: tax.org.ai/confidentiality-memo. Machine face: /confidentiality-memo.md.

Both open with the same notice: educational artifacts of a Foundation program; not legal advice; no attorney-client or accountant-client relationship; no court has squarely blessed AI-agent Kovel status; nothing solicits clients or sells anything.

Templates are positions made testable. That is why we publish them instead of claims.

Where it comes from

Every claim on this page names a primary source we actually fetched. Where we could not fetch one, we say so instead of citing it.

law.cornell.edu·law.resource.org·isc.idaho.gov revisor.mo.gov·codes.findlaw.com·venable.com

26 U.S.C. §7525 and Arthur Young, verbatim from law.cornell.edu. Ackert and Frederick, full text with pin cites from law.resource.org. Idaho Rule of Evidence 515 from isc.idaho.gov; RSMo §326.322 from revisor.mo.gov; C.R.S. §13-90-107(1)(f) from codes.findlaw.com. AICPA Rule 1.700.001 and Interpretation 1.700.040 as published by the profession's own journals. Kovel's mirrors refused our fetch, so its quoted passages are cross-verified through full-text secondary sources. The Heppner memorandum has not yet been retrieved; this page describes the ruling only through the published analysis of counsel who read it, and says so wherever Heppner appears.

Nothing that merely felt like evidence is in the room.

What this is

This page is the doctrinal case behind the position on the front page, published with its limits at the same volume as its claims.

Nothing here is legal advice, tax advice, or an accounting service; no attorney-client or accountant-client relationship is formed; the artifacts are educational templates for your own counsel to adapt; no client is solicited and nothing is for sale.

No court has squarely held that a supervised AI agent receives Kovel treatment. When one rules either way, this page changes to match.