Section 7216 of the Internal Revenue Code imposes criminal penalties for the unauthorized disclosure of tax return information to AI platforms without specific taxpayer consent. This foundational regulation creates a rigid boundary for the modern tax professional who must navigate the increasingly automated landscape of 2026. As Certified Public Accountants and federally authorized tax practitioners integrate generative artificial intelligence into their daily advisory services, they enter a territory that the original authors of the tax code did not foresee. The shift toward using large language models for complex legal research and the drafting of technical memoranda provides an undeniable efficiency advantage; however, it also brings a set of structural vulnerabilities that can undermine the traditional protections afforded to professional tax advice. The current environment is characterized by a rapid integration of these tools that has outpaced the evolution of judicial doctrines and ethical guidelines, leaving many practitioners in a precarious position regarding the confidentiality of their client communications and work product.
The contemporary tax practice is currently defined by a tripartite convergence of factors: the aggressive adoption of generative AI, the inherent limitations of the Section 7525 privilege, and a notably more assertive enforcement posture from the Internal Revenue Service. The IRS is frequently utilizing its summons power to peer into the analytical history behind aggressive tax positions, seeking to understand the subjective intent of taxpayers and the strategic “red-teaming” performed by their advisors. Because AI platforms create a permanent and often discoverable digital footprint of every research query and draft iteration, they provide a ready-made roadmap for federal investigators seeking to challenge the validity of a tax position. This technological reality means that the digital trail left behind by sophisticated tax planning is no longer a private internal record but a potential exhibit in future litigation, requiring practitioners to reconcile their desire for efficiency with the hard reality that their digital assistants may be creating the very evidence used against their clients.
Statutory Framework: The Structural Fragility of Section 7525
Section 7525 was established by Congress in 1998 as a legislative attempt to provide a measure of parity between accountants and attorneys, yet it remains a significantly more limited shield than many practitioners realize. Unlike the broad attorney-client privilege rooted in common law, the statutory privilege is strictly confined to federal noncriminal tax matters. This jurisdictional boundary creates a volatile situation for taxpayers, as any investigation that begins as a civil audit but transitions into a criminal referral immediately strips away the protection. Furthermore, the privilege does not extend to state tax proceedings or private civil litigation, meaning that information disclosed to a tax practitioner and shared with an AI tool might be entirely discoverable in a variety of legal arenas. This fragmentation of protection makes the Section 7525 privilege a fragile defense in a multi-jurisdictional legal environment where data can be subpoenaed by various entities with different evidentiary standards and procedural rules.
Beyond these jurisdictional limits, the architecture of Section 7525 inherits the historical constraints of common-law privilege, focusing solely on communications rather than underlying facts. In the context of 2026 tax practice, this distinction becomes increasingly difficult to maintain because the prompts and outputs generated by AI often blend technical client data with subjective legal analysis. If a practitioner provides a specific set of client facts to an AI to generate a legal conclusion, those facts remain discoverable even if the conclusion itself is theoretically protected under the statute. The historical application of the privilege has always favored narrow interpretations, and the introduction of a third-party algorithmic intermediary only complicates the matter. As practitioners rely more heavily on these tools to synthesize information, the clear line between a protected communication and an unprotected data transfer becomes blurred, potentially leaving the entire research process exposed to government discovery during an aggressive audit or investigation.
Tax Shelter Carveouts: Expanded Judicial Interpretations
Section 7525(b) explicitly excludes any communications related to the promotion of tax shelters, a provision that has been interpreted with increasing breadth by federal courts. In various landmark cases, the judiciary has expanded the definition of “promotion” to include not only the marketing of formal tax products but also bespoke analytical advice that facilitates participation in tax-advantaged transactions. This means that a significant portion of sophisticated, high-value tax planning may sit entirely outside the statutory privilege. When a practitioner uses AI to optimize a client’s tax position or to explore complex structural arrangements, the digital records of those explorations are likely to be classified under this carveout. This legal reality transforms the AI-assisted research process into a high-risk activity, as the very efficiency of the tool in finding tax savings can be used as evidence that the practitioner was engaged in the promotion of a tax-advantaged structure rather than providing routine tax advice.
The implications of this carveout are particularly severe for firms that use AI to run multiple scenarios for corporate reorganizations or international tax planning. Because the IRS and the courts view the promotion of tax-advantaged strategies through a wide lens, any AI prompt that asks the system to “find the most tax-efficient structure” could be characterized as an inquiry into a tax shelter. Once this classification is made, the practitioner loses the ability to assert the Section 7525 privilege over those specific communications. In the current era of automated discovery, the government can easily search for such prompts within a practitioner’s digital records to invalidate privilege claims. Consequently, the use of AI in high-stakes planning requires a heightened level of awareness regarding how the queries are phrased and how the resulting advice is documented, as the boundary between legitimate planning and the promotion of a tax shelter is thinner than ever before.
The Dual-Purpose Doctrine: Navigating Automated Workflows
The “dual-purpose” doctrine further complicates the privilege landscape by denying protection to documents prepared for both tax return preparation and potential litigation. Established in cases like United States v. Frederick, this doctrine holds that work primarily focused on compliance does not enjoy the same protections as work focused on legal defense. Because modern AI tools are often used as comprehensive assistants that handle everything from compliance checks to strategic defense drafting, the risk that a court will view AI-generated outputs as unprotected “return preparation” material is exceptionally high. If a practitioner uses the same AI thread to calculate a deduction and to research the legal defense for that deduction, the entire thread may be deemed discoverable. This lack of segregation in automated workflows creates a significant vulnerability for firms that do not maintain separate systems or threads for compliance and advisory functions.
The current judicial trend in 2026 suggests that courts are increasingly skeptical of broad privilege claims when technology is involved in the workflow. Judges often look for a clear primary purpose behind the creation of a document, and if the AI output is used to inform the final figures on a tax return, the privilege typically evaporates. For the tax professional, this means that the integration of AI must be accompanied by a rigorous structural discipline that separates compliance-related prompts from those intended for legal analysis. Without this segregation, the practitioner may inadvertently create a vast repository of discoverable material that should have been protected. This challenge is magnified by the fact that many AI platforms are designed to be conversational and persistent, encouraging practitioners to keep all information in a single, continuous dialogue that inevitably mixes protected and unprotected functions.
The Kovel Doctrine: A Strategic Shield for Digital Advisory
Given the inherent frailties and limitations of Section 7525, many tax practitioners have turned to the Kovel doctrine as a more robust alternative for protecting sensitive work. Originating from the 1961 Second Circuit decision in United States v. Kovel, this doctrine extends the attorney-client privilege to non-attorney experts, such as CPAs, whose specialized knowledge is essential for an attorney to provide legal advice. In a properly structured Kovel arrangement, the CPA acts as a “translator” or technical consultant for the legal team, bringing their work under the superior and more resilient umbrella of the attorney-client privilege. This framework is particularly relevant when using AI, as the technology can be framed as an instrumental tool used by the accountant at the direction of counsel to facilitate the legal defense or strategy.
To maintain a valid Kovel shield in an AI-driven environment, the practitioner must adhere to strict procedural requirements that have remained consistent through 2026. The accountant must be hired directly by the attorney rather than the client, and the engagement letter must clearly state that the accountant’s work is intended to assist the lawyer in providing legal advice. Furthermore, there must be a clear segregation of the Kovel-related work from any routine compliance or audit tasks the CPA may be performing for the same client. When AI tools are integrated into this specific workflow, the resulting digital trail is categorized as part of the legal team’s internal work product. This approach provides a much higher level of protection than the statutory privilege because it leverages the common-law protections that are not subject to the same tax-specific carveouts found in Section 7525.
Operational Discipline: Managing the Translator Model of Privilege
While the Kovel doctrine provides a stronger legal foundation, its success depends entirely on the operational discipline of the tax practitioner. In the context of AI, this means that the practitioner must treat every prompt and output as a formal part of the legal record. All AI research conducted under a Kovel arrangement should be documented as being performed at the specific direction of counsel, and the access to these AI accounts should be restricted to the specific team working on the privileged matter. This prevents the “bleeding” of information between privileged and non-privileged engagements, which is a common point of failure that the IRS looks for when challenging a Kovel claim. Firms that fail to maintain these boundaries risk a court ruling that the Kovel protection has been waived through commingling or improper oversight.
Furthermore, the practitioner must ensure that the AI platform itself does not compromise the Kovel shield through its own internal data handling. If the AI vendor retains data for model training or allows its employees to review prompts for quality control, the claim of confidentiality may be significantly weakened. The practitioner must verify that the terms of service for the tools they use under a Kovel arrangement are consistent with the high standards of confidentiality required by the legal profession. This often involves negotiating specific enterprise-level agreements that guarantee data isolation and zero-retention policies. By aligning the technological environment with the legal requirements of the Kovel doctrine, the tax professional can provide a powerful defense for their client’s most sensitive information while still benefiting from the analytical power of artificial intelligence.
Platform Categorization: Analyzing Variable Risk Profiles
The level of risk associated with AI usage is not uniform and depends heavily on the specific category of tool being employed by the firm. General-purpose large language models, such as those available to the public, represent the highest risk tier because their standard terms of service typically include data retention and the potential use of input data for future model training. Using these public-facing platforms for sensitive tax research is often viewed by the judiciary as a voluntary disclosure to a third party, which effectively destroys any claim of privilege or confidentiality. Even if the practitioner attempts to anonymize some data, the sheer volume of contextual information provided in a complex tax query can often lead to the inadvertent identification of the taxpayer, further complicating the claim of privacy.
In contrast, tax-specialized platforms often utilize a different architectural approach known as Retrieval-Augmented Generation. These tools pull from curated, private legal and tax libraries rather than relying solely on the data they were originally trained on, providing a more controlled environment for research. While these platforms generally offer better security and specific data privacy agreements tailored to professional users, they still function as third-party intermediaries. The practitioner must perform a thorough review of the vendor’s security protocols and data handling practices to ensure that the information is not being logged in a way that could be accessed via a federal subpoena. The choice of platform is therefore a critical decision that directly impacts the firm’s ability to maintain the Section 7525 privilege and meet the ethical standards of the profession.
Embedded Systems: The Hidden Risks of Default AI Features
One of the most significant and often overlooked risks in 2026 is the presence of embedded AI features within standard audit, tax preparation, and practice management software. These features are frequently active by default and may automatically process data to provide suggestions, identify anomalies, or summarize documents. Because these tools are integrated into the daily workflow, practitioners may not realize that sensitive client information is being transmitted to the software provider’s AI model for processing. This automatic data transfer creates a documentary trail of the practitioner’s research and decision-making process that is entirely outside their direct control. If these embedded systems do not have the same level of protection as a dedicated, secure AI environment, they represent a massive vulnerability for the firm’s privilege claims.
The discovery of these hidden data flows often comes as a surprise during an IRS audit or a legal dispute. When the government issues a broad summons for all communications and workpapers related to a taxpayer, the records generated by these embedded AI systems are included in the scope of the request. If the firm cannot prove that these records were created in a secure and confidential environment, they may be forced to disclose them. To mitigate this risk, tax firms must conduct a comprehensive audit of all their software tools to identify any active AI components and understand how they handle data. In many cases, it may be necessary to disable these default features or to switch to providers that offer more robust confidentiality guarantees. Managing these “invisible” risks is a vital part of protecting the Section 7525 privilege in a tech-saturated environment.
Professional Standards: The Duty of Care and Technological Competence
The regulatory environment in 2026 has clearly shifted to hold tax practitioners accountable for their use of automated tools through updated professional standards. The American Institute of Certified Public Accountants has revised its Statements on Standards for Tax Services to explicitly include technological competence as a core component of the practitioner’s duty of care. This means that a CPA cannot simply blame an AI for an error or a breach of confidentiality; they are expected to have a working knowledge of how the technology operates and the risks it poses to client data. This duty of competence requires practitioners to vet the accuracy of AI-generated research and to ensure that the use of these tools does not compromise the professional standards of the tax practice, including the maintenance of privilege under Section 7525.
Failing to meet these standards can result in professional discipline and increased exposure to malpractice claims. If a practitioner uses AI in a way that leads to a privilege waiver, they may be found to have violated their fiduciary duty to the client. The standard of care now involves not only the accuracy of the tax advice provided but also the security and confidentiality of the process used to generate that advice. As AI becomes a standard tool in the industry, the expectation is that practitioners will implement formal policies and training programs to ensure that all staff members understand the legal and ethical implications of using these tools. This commitment to professional standards serves as a critical defense against both government scrutiny and potential litigation from clients who believe their confidences were not properly protected.
Regulatory Oversight: Compliance Under Treasury Circular 230
Treasury Circular 230 provides the federal regulatory framework governing practice before the Internal Revenue Service and imposes strict duties on practitioners regarding diligence and the quality of written advice. The IRS Office of Professional Responsibility has clarified that these standards apply to the use of AI just as they do to traditional research and drafting methods. Section 10.22 of Circular 230 requires practitioners to exercise due diligence in preparing documents and determining the correctness of representations made to the Treasury Department. When AI is used to synthesize legal authority or to draft a response to an IRS inquiry, the practitioner remains personally responsible for every word in that document. Relying on an AI’s summary without independent verification is considered a failure of diligence and can lead to sanctions.
Furthermore, Section 10.37 of Circular 230 sets forth the requirements for written tax advice, emphasizing that practitioners must not base their advice on unreasonable factual or legal assumptions. AI models are known for their potential to “hallucinate” or provide plausible-sounding but incorrect citations and arguments. If a practitioner includes such inaccuracies in their advice, they are in direct violation of Circular 230. From a privilege perspective, the lack of diligence can also be used by the government to argue that the advice was not “reasonable” and therefore not entitled to the protections of Section 7525. Maintaining compliance requires a rigorous review process where every AI-generated output is cross-referenced with primary tax authorities. This double-checking process is not just a best practice; it is a regulatory necessity for any practitioner who wishes to maintain their standing before the IRS.
Judicial Precedents: The Critical Warning of United States v. Heppner
The legal landscape regarding AI and privilege was significantly clarified by the case of United States v. Heppner, which serves as a primary warning for the tax profession. In this matter, the court rejected a privilege claim for legal research and strategy drafting conducted through an AI platform without the direct and active supervision of human legal counsel. The court’s reasoning was based on the concept of the “relational predicate,” stating that privilege exists to protect a specific bond between a client and a licensed professional who is bound by fiduciary duties and subject to professional discipline. Because an AI algorithm is not a licensed professional and cannot be held to ethical standards in the same way a human can, the court ruled that communications with the AI were not inherently privileged.
The Heppner decision highlighted a critical vulnerability for tax practitioners who use AI as a standalone researcher rather than as a tool for a human professional. If the practitioner delegates too much of the analytical process to the AI without demonstrating active human oversight, the resulting work product may be deemed unprotected. The court also noted that the user’s voluntary submission of sensitive information to a third-party AI vendor, whose privacy policy allowed for data retention, constituted a waiver of any reasonable expectation of confidentiality. This case underscores the necessity of maintaining the “human in the loop” for all privileged work and the importance of using enterprise-grade tools that strictly prohibit the retention or review of data by the vendor. For the tax practitioner in 2026, Heppner is a reminder that the law views technology as a tool, not a substitute for the protected professional relationship.
Third-Party Disclosures: Waiver Risks and Privacy Expectations
The third-party disclosure doctrine remains one of the most significant threats to the Section 7525 privilege in the age of AI. Under this doctrine, any information voluntarily shared with a third party who is not part of the privileged relationship is generally no longer considered confidential. When a tax practitioner inputs sensitive client data into an AI prompt, they are effectively sharing that data with the company that owns and operates the AI model. Unless there is a legally binding and robust confidentiality agreement in place that satisfies the court’s standards, this act can be viewed as a waiver of the privilege. The IRS has become increasingly adept at arguing that the use of cloud-based AI tools constitutes a disclosure to a third party, thereby opening the door for the government to subpoena the records directly from the AI vendor or the practitioner.
To counter these arguments, practitioners must be able to demonstrate a reasonable expectation of confidentiality. This expectation is built on the specific terms of the contract with the AI provider and the technical measures taken to secure the data. Simply relying on the vendor’s standard privacy policy is often insufficient in a legal challenge. Courts look for specific “zero-retention” clauses and evidence that the data is encrypted and isolated from the vendor’s general training sets. If the AI vendor has the right to access the data for any reason, the expectation of confidentiality is arguably lost. For tax firms, this means that the procurement of AI tools is no longer just an IT decision but a legal and compliance decision that must be vetted by experts in privilege and data privacy. The ability to defend the Section 7525 privilege in 2026 depends on the practitioner’s ability to prove that they never truly “shared” the data with the third party in a way that compromised its secrecy.
Documentary Trails: Red-Teaming and the Smoking Gun Problem
The “smoking gun” problem is a particularly damaging risk associated with the use of AI in high-stakes tax advisory. Tax practitioners often use generative AI to perform “red-teaming” exercises, where they instruct the model to identify all possible weaknesses in a proposed tax position or to play the role of an IRS agent challenging a deduction. While this is an excellent way to refine advice and prepare for potential audits, it creates a detailed digital record of the practitioner’s awareness of every legal flaw in their client’s position. If these chat histories are discoverable because of a privilege waiver or a successful government summons, the IRS gains a literal roadmap to the taxpayer’s most vulnerable points. This record can be used to prove that the taxpayer was aware of the risks and took the position anyway, which can be devastating in a civil audit or a penalty defense.
This detailed trail of mental impressions is exactly what the IRS seeks during its discovery process. In a reasonable-cause defense under Section 6664, a taxpayer must show that they acted in good faith and with reasonable reliance on professional advice. If the government can produce an AI transcript showing that the advisor identified a 70% chance of failure for a specific position, it becomes much harder to argue that the reliance was in good faith. To mitigate this, practitioners must treat their AI prompts as formal workpapers and exercise extreme caution in how they document their internal research process. Using anonymized data for red-teaming exercises and avoiding the use of client-specific identifiers can help reduce the risk, but the fundamental danger remains: the very technology that makes an advisor more effective can also make them a more effective witness for the government.
Tactical Mitigation: Private Cloud Architectures and Anonymization
To protect the integrity of the Section 7525 privilege, forward-thinking tax firms in 2026 have adopted a “defense-in-depth” strategy that prioritizes architectural safeguards. One of the most effective methods is the transition to private cloud or on-premises AI deployments. By running AI models within their own secure environment, firms can ensure that no data ever leaves their controlled network, which significantly strengthens the argument for a reasonable expectation of privacy. This architecture removes the third-party disclosure risk because the AI vendor never has access to the prompts or the outputs. While these private deployments require a greater investment in infrastructure and technical expertise, they provide the highest level of legal protection available for firms that frequently handle sensitive, high-risk tax matters.
Operational discipline at the prompt layer provides an additional level of protection. Practitioners are encouraged to use pseudonymization, a process where all identifying information is replaced with generic placeholders, such as “Company A” or “Project X,” before being entered into an AI tool. By ensuring that the AI never receives identifiable client data, the practitioner can conduct extensive research and analysis without creating a discoverable link to a specific taxpayer. Furthermore, firms should implement strict data-retention policies for their AI interactions, ensuring that chat histories and temporary files are deleted as soon as they have served their purpose. These tactical measures, combined with a secure technical architecture, create a multi-layered defense that protects client confidences from both external breaches and government discovery efforts.
Section 7216 Compliance: Safeguarding Tax Return Information
Beyond the concerns of privilege, tax practitioners must also navigate the strict privacy mandates of Section 7216, which governs the disclosure and use of tax return information. This statute is separate from the concept of privilege and carries criminal penalties for unauthorized disclosure. In 2026, the IRS has emphasized that processing tax return data through a third-party AI platform constitutes a “disclosure” that requires specific, informed consent from the taxpayer. This consent must meet the rigorous requirements of the Treasury Regulations, including a clear explanation of what data will be shared, with whom it will be shared, and for what specific purpose. Many firms that focus solely on the Section 7525 privilege may overlook these administrative requirements, leaving themselves vulnerable to criminal and civil penalties regardless of whether the communication itself is privileged.
Maintaining compliance with Section 7216 requires a proactive approach to client communication and engagement letters. Firms must update their standard agreements to include specific AI disclosure and consent provisions that satisfy the federal regulations. These provisions should clearly describe the security measures the firm has in place to protect the data and the specific types of AI tools that will be used in the engagement. For highly sensitive matters, it may be necessary to obtain separate, matter-specific consents to ensure that the client fully understands the risks and benefits of using AI in their representation. By integrating Section 7216 compliance into their standard practice, tax professionals can avoid the severe penalties associated with unauthorized disclosure while building a foundation of trust and transparency with their clients.
Practical Recommendations: Future-Proofing the Modern Tax Practice
The integration of artificial intelligence into the tax profession has proven to be a permanent and transformative shift that required a re-evaluation of established practices. Successful firms recognized that the benefits of speed and analytical depth had to be balanced against the preservation of statutory and ethical confidentiality. They implemented rigorous training programs that taught practitioners how to interact with AI without compromising privilege, emphasizing the importance of prompt engineering and the avoidance of sensitive data entry. These firms also moved away from consumer-grade tools, opting instead for enterprise-tier solutions with robust legal and technical protections. By treating AI as a high-stakes professional tool rather than a casual assistant, these organizations maintained their role as trusted advisors while staying ahead of the technological curve.
The focus eventually shifted toward creating a unified framework that combined technical architecture, legal strategy, and operational discipline. Practitioners who utilized Kovel-mediated workflows for their most sensitive advisory work found that they could provide superior legal protection for their clients’ digital footprints. Meanwhile, the use of private cloud environments and strict pseudonymization protocols became the standard for routine research and compliance tasks. These steps proved essential as the IRS and other regulatory bodies became more sophisticated in their ability to target and analyze digital evidence. Ultimately, the survival of the Section 7525 privilege in an automated world depended on the practitioner’s ability to remain diligent, technically competent, and fiercely protective of the professional relationship that the law was designed to shield.
