Paul Starrett
When the question is about technology, the answer has to hold up — technically, legally, and with the people who built it.
I advise and represent companies on tax matters where AI and software are the hard part, and on the AI governance questions that come with them.
Attorney and technologist. Twenty-five years at the intersection of law and technology, specializing in AI and related technologies since 2013.
Matters involving technology are usually handled by advisors who cover one part of the problem well: the law, the tax, or the technology. The gaps between those parts get filled with assumptions, and assumptions are exactly what an examiner, a regulator, or opposing counsel will find.
A complete answer needs three things, in this order.
The technology
Understand what the system actually did, how it was built, trained, and run, well enough to answer the second and third questions, not just the first.
- Former security software engineer, RSA Security
- Former General Counsel and Chief Risk Officer, publicly held AI and data-management company
- M.S. Predictive Analytics, Northwestern University
- Lead author, Digital Signatures (RSA Press / McGraw-Hill, 2002)
The law and the tax
Turn the technical facts into legal and tax positions written for the people who will test them: examiners, judges, clients, and co-parties.
- Attorney at Law, California
- Master of Laws in Taxation
- Tax treatment of AI and software: the R&D credit and §174 / §174A, acquisitions, revenue sourcing, and IP transfers, federal and California
The people
Documents never hold every fact. The record has to be confirmed with the engineers, managers, and vendors who built and ran the system, using methods that hold up under scrutiny.
- Certified Fraud Examiner
- Licensed Private Investigator, California
- Author, The Investigative Interviewer's Guidebook, for risk, compliance, and legal professionals (first published 1998)
- Alongside your team. I work with your CPA, tax counsel, and engineers, filling the gaps rather than replacing anyone.
- One person across all three. The person who understands the system is the one who frames the position and interviews the witnesses, so nothing is lost in translation.
- Advisory by default, with legal representation where a matter calls for it, either as counsel or as a licensed investigator working under referring counsel's engagement.
Tax — AI and Software Development
The tax answer depends on what the AI actually is and where its value is created.
- When you claim the credit: R&D credit substantiation and audit defense, federal and California; §174 / §174A
- When you buy or sell: what the AI assets are, and how they’re valued and allocated in an acquisition
- When you sell across states and borders: how AI products and revenue are characterized and sourced
- When IP moves between entities: the technical facts behind where AI value is developed and maintained
AI Governance & Risk
The same analysis, applied to risk: governance has to match what the system actually does, not what the policy says it does.
- When AI makes decisions about people: risk assessment, testing, and documentation before launch, in hiring, lending, health, and housing
- When a customer, investor, or acquirer asks: AI diligence questionnaires and reviews, answered with evidence
- When you rely on vendors’ AI: third-party and AI-vendor risk, privacy, and cybersecurity
- When a regulator or plaintiff asks: regulatory inquiries and defense, backed by the technical record
Disputes & Investigations
Reconstructing what a system did when its outputs come under scrutiny.
My career has run on two tracks at once: building and securing technology, and practicing law about it. I have been a security software engineer at RSA Security, General Counsel and Chief Risk Officer of a publicly held AI and data-management company, and founding chair of the ABA Big Data Committee from 2013 to 2020. I have worked on more than 45 multimillion-dollar investigation and e-discovery matters for AmLaw 50 firms and Fortune 100 clients, and contributed to the IAPP's AI Governance certification. My practice was established in 2001.
I teach as well as practice: AI governance and cybersecurity law at Santa Clara University School of Law, computer and AI forensics in its Graduate School of Engineering, and law and machine learning in the M.S. Data Science program at the University of the Pacific.
Let's discuss your matter.
Whether you need an advisory memo or representation through a regulatory inquiry or dispute, the first conversation is direct and confidential.
paul@starrettlaw.com