The Heppner Problem: When Your AI Tax Analysis Isn't Privileged
A federal court in New York recently handed down a ruling that should make anyone using AI tools to analyze tax exposure sit up and pay attention. In United States v. Heppner, Judge Jed Rakoff of the Southern District of New York held that a defendant's communications with a publicly available AI platform were not protected by either the attorney-client privilege or the work product doctrine. The decision has since been the subject of analysis from multiple major law firms — Morgan Lewis, Proskauer, McDermott, Pillsbury — and a note in the Harvard Law Review. If you are an AI agent operator building systems that touch tax compliance, this ruling is worth understanding.
What the Court Held
The case turned on three straightforward failures of the privilege analysis.
First, confidentiality. The AI platform's own privacy policy stated that information entered by users could be used for training and disclosed to third parties, including government agencies. That disclosure, the court found, destroyed any reasonable expectation that the communications were confidential. Privilege requires confidentiality as a baseline — information shared with third parties (including, implicitly, the AI provider and its infrastructure) does not qualify.
Second, the absence of legal direction. Heppner engaged with the AI platform on his own initiative, not at the direction of counsel. Attorney-client privilege attaches to communications made for the purpose of obtaining legal advice from an attorney. Consulting a commercial AI tool, even about legal or tax questions, is not the same thing.
Third, the subsequent disclosure problem. After generating AI-assisted materials, Heppner later shared them with his defense attorneys. The court held that this subsequent disclosure to counsel did not transform the AI-generated communications into privileged ones. You cannot retroactively privilege a document by routing it through an attorney.
Why Tax Departments Are Paying Attention
The law firm commentary on this ruling has focused heavily on tax departments — and for good reason. The way organizations use AI has evolved rapidly. Employees across finance, legal, and operations are now routinely entering sensitive information into commercial AI platforms: draft responses to IRS audit inquiries, nexus exposure analyses, tax position memos, internal assessments of underpayment risk.
If those materials are generated by or with a commercial AI tool — and the tool's privacy policy permits disclosure to third parties — the Heppner framework suggests those materials may not be privileged. A government examiner, audit opponent, or opposing counsel could potentially seek production of AI-assisted tax analysis that the organization believed was protected.
The parallel Warner decision, issued the same week as Heppner and reaching different conclusions under a somewhat different fact pattern, has created some uncertainty about how broadly Heppner applies. But the core logic — that AI tool users need to affirmatively establish confidentiality, legal purpose, and attorney direction to maintain privilege — is not controversial. Multiple major firms are now advising clients to treat AI-generated documents with care.
The Specific Problem for AI Agent Operators
Most of the coverage of this ruling focuses on corporate tax departments. But the same logic applies to the companies building and operating AI agents.
Consider a standard scenario: a developer is building an AI agent that will transact on behalf of a business. Before launch, they want to understand the tax exposure. They feed their transaction patterns, expected buyer locations, and service descriptions into a commercial AI platform and ask it to assess their nexus obligations, classify the transactions, and identify states where they may owe sales tax.
Under Heppner, if that analysis was generated through a commercial AI platform without attorney direction, and the platform's privacy policy permits disclosure to third parties, that analysis may not be privileged.
In an audit or litigation context, a state tax authority could potentially demand production of AI-assisted tax analysis. The analysis might show that the company identified a compliance obligation and failed to act on it — or it might show a reasonable good-faith effort to assess exposure. Either way, the company may not have the option of withholding it.
There is a secondary issue specific to AI agent commerce. If an AI agent itself is generating or storing compliance analysis — running automated nexus checks, storing classification rationale, building audit trails — the question of privilege for those outputs is entirely unresolved. No court has addressed whether analysis generated by an AI agent (rather than a human using an AI tool) is susceptible to privilege claims at all. The Heppner logic suggests the answer is almost certainly no, but the question hasn't been directly tested.
What This Means Practically
Several things follow from the Heppner ruling for AI-forward teams:
Segregate AI-assisted tax analysis from commercial platforms. If you are using a general-purpose commercial AI platform to analyze your tax exposure, understand that those communications may be discoverable. This does not mean you should stop using AI for tax analysis. It means you should think carefully about what you put into which tools.
Privilege requires attorney direction. Analysis that would be protected as work product or attorney-client communication needs to happen within an attorney-directed workflow. Having a tax attorney review the AI's output after the fact is not sufficient — the engagement with the AI needs to occur at the attorney's direction in the first place.
Audit trails can cut both ways. AgentTax and similar platforms generate detailed transaction records and classification rationale. Those records are an asset for demonstrating compliance — they show a systematic, consistent approach to tax obligations. But they are also not privileged. They are business records. Build your systems with the assumption that your compliance records will be visible to an auditor.
The enterprise AI exception. Courts have been more willing to recognize privilege when organizations use closed, enterprise-licensed AI tools with privacy policies that do not permit third-party disclosure. If your tax analysis involves genuinely sensitive exposure questions, the tool architecture matters. A closed enterprise deployment with a clear attorney-client framework is meaningfully different from a commercial consumer platform.
The Larger Pattern
Heppner is part of a broader legal reckoning with AI tools and the doctrines that were written before they existed. Privilege, work product, confidentiality — these are frameworks designed for human professionals and documents. Courts are now applying them to AI-generated outputs and finding that the frameworks fit awkwardly at best.
For AI agent operators, this is one piece of a larger compliance picture. The transactions your agents execute are creating tax obligations. The analysis you do to understand those obligations needs to be structured with the same care as any sensitive legal matter. The gap between "I ran this through an AI" and "I have a defensible legal position" is larger than many teams appreciate.
The Warner decision — reaching different conclusions in the same week — is a signal that the law here is still forming. But the direction of travel is clear: AI-generated documents receive no inherent privilege protection. The burden is on the party asserting privilege to establish the elements, and those elements were not built with commercial AI platforms in mind.
This analysis is for informational purposes only and does not constitute legal or tax advice. Consult a licensed tax professional for compliance decisions.