Warner v. Gilbarco Softens the Heppner Problem, and Not Where Agent Operators Need It

Two federal courts ruled a week apart in February on whether feeding material into a public AI chatbot destroys legal protection. They reached opposite-sounding results, and a piece in CPA Practice Advisor on August 11 put them side by side for tax professionals and concluded that the answer is to route sensitive analysis through counsel. That conclusion is right. The reasoning that gets there matters more than the split does, because the part that binds an AI agent operator is a limit neither case had occasion to reach.

First, a correction. We covered United States v. Heppner on March 28 and treated it as the whole story. It was not. Warner v. Gilbarco, Inc. had been decided in the Eastern District of Michigan a week earlier, on February 10, and we missed it.

The two cases

In Heppner, No. 25-cr-00503 (JSR), 2026 WL 436479 (S.D.N.Y. Feb. 17, 2026), Judge Rakoff held that a criminal defendant's exchanges with a public consumer AI platform were protected by neither the attorney-client privilege nor the work product doctrine. The platform was not an attorney, the engagement was not at the direction of counsel, and the platform's own terms contemplated disclosure of user input to third parties. Three independent failures, any one of which would have been enough.

In Warner v. Gilbarco, Inc., No. 2:24-cv-12333, 2026 WL 373043 (E.D. Mich. Feb. 10, 2026), a self-represented plaintiff in an employment case used a consumer chatbot while preparing her filings. The defendants moved to compel everything connected to that use, arguing that entering material into an AI platform waived protection. The court refused. Generative AI programs, the opinion says as quoted across the subsequent firm commentary, "are tools, not persons," and treating mere use of one as a waiver "would nullify work-product protection in nearly every modern drafting environment."

Read as a split, this is confusing. Read as doctrine, it is not a split at all. Heppner is mostly a privilege case, and privilege requires confidentiality against the world, which a public platform's terms of service can destroy on their own. Warner is a work product case, and work product only requires that the material not be handed to an adversary. A drafting tool is not an adversary. Two different doctrines with two different confidentiality thresholds, applied correctly, produce two different answers on similar facts. Nothing needs reconciling.

The limit that actually binds an operator

Both litigants were preparing for litigation. That is the entire predicate of the doctrine that saved the plaintiff in Warner, and it is where the analogy to an AI agent operator breaks.

Work product under Federal Rule of Civil Procedure 26(b)(3) reaches documents prepared "in anticipation of litigation or for trial." Hickman v. Taylor, 329 U.S. 495 (1947), which is where the doctrine comes from, protects the lawyer's preparation of a case, not a company's ordinary paperwork. The broadest common formulation, the "because of" test from United States v. Adlman, 134 F.3d 1194 (2d Cir. 1998), still asks whether the document would have been created in essentially similar form absent the prospect of litigation.

Run an agent operator's records through that question honestly.

Your runtime tax determination log — jurisdiction, rate, taxability decision, timestamp, per transaction — exists because the agent has to compute tax in order to charge it. It would exist in identical form if no state ever opened an examination. It is an ordinary business record. It is not work product, and no ruling about chatbots changes that.

That is the record most agent operators are quietly assuming is somehow shielded, and it is the one that is most completely exposed. It is also, mercifully, the one you should want an auditor to read, provided it is right.

Section 7525 does not fill the gap

Tax practitioners reach next for IRC § 7525, the federally authorized tax practitioner privilege, and it is worth being precise about how little it does here.

By its own terms § 7525 applies to noncriminal tax matters before the Internal Revenue Service and noncriminal proceedings in federal court brought by or against the United States. It carries the same limitations as the common law attorney-client privilege, which means it protects advice and not underlying facts. Subsection (b) carves out written communications in connection with the promotion of tax shelters.

For a company whose exposure is state sales and use tax, that list has an obvious hole in it. A state sales tax audit is not a proceeding before the IRS and is not a federal court proceeding. Section 7525 is unavailable in the forum where most agent operators will actually be examined. Whether any privilege attaches there is a question of that state's own law; a minority of states recognize a statutory accountant-client privilege, and its scope in a state tax proceeding varies enough that it should be checked jurisdiction by jurisdiction rather than assumed.

The Kovel route the CPA Practice Advisor piece recommends — bringing the accountant inside the attorney's engagement under United States v. Kovel, 296 F.2d 918 (2d Cir. 1961), so that the accountant's work facilitates legal advice — is genuinely the strongest available structure. It is also, and this is the part usually left out, expensive per document and unsuited to anything generated continuously. You cannot run a million runtime determinations through counsel. You can run one memo.

What to do about it

Sort your tax records into three piles and treat them differently, because they have different exposure and only one of them is worth protecting.

The runtime record. Assume it is discoverable in full. Spend your effort making it accurate, complete, and reconstructable — the rate applied, the sourcing decision, the taxability determination and its basis, retained for the whole statute of limitations. Accuracy, not protection, is the defense here.

The exposure memo. The document that says where you are uncertain, which states you may already owe, and roughly how much. This is the one that hurts in an audit or in discovery. If you are going to write it, write it once, at the direction of counsel, for the purpose of legal advice, and keep it out of the shared drive. If you cannot do that, think hard about whether the analysis needs to exist as a document at all.

Vendor output. A tax engine's answer is a third party's output. It was never privileged and it does not need to be. Treat it as what it is — evidence that you exercised care in determining tax, which is the posture you want in front of an examiner anyway.

And do not read Warner as permission. It says a drafting tool is not an adversary. It does not say that material generated in the ordinary course becomes protected because a model touched it. On the narrow question of whether AI use waives an otherwise valid work product claim, the emerging answer looks favorable — two district courts and no contrary authority to date, though the question remains open. On whether an agent operator's runtime tax records are work product at all, I see no real doubt: I do not think the question is close.

What to watch

The first appellate treatment of either case is the development that matters, and neither has one. Closer in: whether any state tax tribunal addresses AI-assisted work product in an administrative examination, which is the forum where this will actually be tested for our audience; whether the IRS or state departments of revenue begin requesting model prompts and outputs as a routine audit item, which would move this from doctrine to practice quickly; and whether the OPR's AI guidance, which we covered here, gets extended to address documentation and retention rather than only competence and supervision.

The underlying confusion here is the same one we wrote about yesterday in what "agent tax compliance" actually means: the software is an instrumentality, and every duty and every exposure it generates lands on a person. Privilege is no different. The model does not hold it, cannot waive it, and does not create it.

AgentTax produces a per-transaction determination record — jurisdiction, rate, taxability basis, timestamp — designed to be handed to an examiner rather than hidden from one. See the per-state logic at agenttax.io, or start with the AI agent sales tax hub.

This analysis is for informational purposes only and does not constitute legal or tax advice. This post reflects AgentTax's current interpretation of evolving law. Consult a licensed tax professional for compliance decisions.