Most guides to AI for accounting firms are written by people selling the software. They skip the part a managing partner gets asked about first: whether the firm is allowed to put client data into the tool at all. The rules already answer most of that question, and none of them were written for AI. A federal criminal statute covers tax return information. The AICPA Code covers every other client file. In June 2026 the IRS spelled out how its own practice rules apply. None of them ban AI. All of them make the firm answer for where client data goes and who checks what comes back.
What does AI for accounting firms mean in 2026?
AI for accounting firms means using generative AI and AI features in accounting software to prepare, code, reconcile, research and draft faster, under the same duties of confidentiality, due diligence and supervision that already apply to the work. The tools are new. The obligations aren't.
This guide is for the people who decide how a firm of 20 to 1,000 people adopts AI: managing partners, firm administrators, COOs and IT leads. It covers US tax, accounting and audit practice, and it's based on the statutes, regulations, codes and regulator guidance listed under Sources. It isn't legal advice. For how to roll AI out across any organization, see our guide to AI deployment.
Can accountants use ChatGPT and other AI tools?
Yes, as long as client data goes only into tools the firm has vetted and a qualified person reviews everything the tool produces. No professional body has banned AI. Two regulators have now said how the existing rules apply.
On June 24, 2026, the IRS Office of Professional Responsibility (OPR), which enforces Circular 230, published "Introductory Guidelines for Responsible AI Use in Federal Tax Practice" (Issue Number 2026-19). It is direct about data: "Practitioners must strictly handle all client data using only secure, enterprise-approved AI." Its best practices include "Never upload sensitive data to unsecured sites" and "Vet third parties' AI offerings when or before purchasing."
The Texas State Board of Public Accountancy said the same in its August 2026 Board Report: the state's rules "do not specifically address generative AI", but "existing professional obligations apply regardless of the technology used." On confidentiality it says: "Those obligations do not disappear when information is entered into an AI system."
So the question for a firm isn't whether to allow AI. It's which tools, for which data, with which checks. A staff member pasting a client's return into a personal chatbot account fails the first test. Every rule below explains why.
What does Section 7216 mean for AI tools?
Section 7216 makes it a crime for a tax preparer to knowingly or recklessly disclose a client's return information without permission, and the regulations require written consent for any disclosure they don't specifically allow. This is the rule most firms underrate, because it predates AI by decades.
The statute covers anyone "engaged in the business of preparing, or providing services in connection with the preparation of" income tax returns. It covers any information "furnished to him for, or in connection with, the preparation of any such return." A knowing or reckless disclosure is a misdemeanor with a fine of up to $1,000 ($100,000 where the identity-theft provisions apply), up to a year in prison, or both. Section 6713 adds a civil penalty of $250 for each disclosure, up to $10,000 a year, and it doesn't require knowledge or recklessness.
The regulations set the default: "Unless section 7216 or § 301.7216-2 specifically authorizes the disclosure or use of tax return information, a tax return preparer may not disclose or use a taxpayer's tax return information prior to obtaining a written consent from the taxpayer."
The exceptions that could cover an AI tool, and their limits
Two exceptions in the regulations are the closest fit for an AI vendor. Neither mentions AI, and the IRS hasn't said whether they apply to one.
- Another preparer in the United States, for auxiliary services. A preparer may disclose return information to another tax return preparer "located in the United States" to help prepare a return or for auxiliary services, "so long as the services provided are not substantive determinations or advice affecting the tax liability." The regulations count software developers as preparers for this purpose. A substantive determination "involves an analysis, interpretation, or application of the law," and needs the taxpayer's consent first.
- Software contractors. A preparer may disclose return information to a contractor maintaining, testing or supplying the software used to prepare returns, "only to the extent necessary," and only if everyone who receives it gets written notice of the penalties in Sections 6713 and 7216.
Two limits are clear. First, anything that leaves the United States needs prior consent. The regulations say consent is required before any disclosure to a preparer "located outside of the United States," and the IRS's own example treats remote, view-only access from abroad as a disclosure. For Form 1040 clients, the Social Security number must be redacted before it goes abroad, unless both sides keep an "adequate data protection safeguard" as the IRS defines it. Second, asking a tool to analyze or apply tax law looks like a substantive determination, which needs consent even inside the United States.
What a valid consent looks like
If you rely on consent, Revenue Procedure 2013-14 sets the format. Each consent must be on "a separate written document", which can be attached to an engagement letter, in at least 12-point type. It must be signed and dated, and the client gets a copy. "Opt-out" consents aren't allowed. For Form 1040 clients the consent must include mandatory wording, including "You are not required to complete this form to engage our tax return preparation services." You can't make a service conditional on consent: the regulations say that makes it involuntary.
| Situation | What Section 7216 requires |
|---|---|
| Tool used only for non-client work, with no return information | Nothing under 7216 |
| Return information goes to a contracted tool processed in the United States, for preparation support only | Possibly an exception (auxiliary services or software contractor), with written 7216 notice to the recipients. Unsettled for AI |
| Tool analyzes or applies tax law to the client's facts | Written consent first |
| Tool, vendor staff or processing outside the United States | Written consent first; mask the SSN on 1040 returns unless both sides keep the required safeguard |
| Staff member's personal chatbot account | Not covered by any exception. Don't allow it |
What does the AICPA Code say about AI vendors?
The AICPA Code treats an AI vendor as a third-party service provider: before client data goes to one, you need a confidentiality contract or the client's specific consent, and you should tell clients you may use one. That covers every client file, not only tax returns.
The Confidential Client Information Rule (1.700.001) says a member in public practice "shall not disclose any confidential client information without the specific consent of the client." Three interpretations apply when a firm uses an outside provider:
- Contract or consent (1.700.040). Before disclosing confidential information to a third-party service provider, the member should either "enter into a contractual agreement with the third-party service provider to maintain the confidentiality of the information and provide reasonable assurance that the third-party service provider has appropriate procedures in place," or "obtain specific consent from the client."
- Tell the client (1.150.040). The member "should inform the client, preferably in writing, that the member may use a third-party service provider." If the client objects, the member shouldn't use the provider for that work, or should decline the engagement. Purely administrative services, such as "software application hosting," don't need notice.
- Vet and supervise (1.300.040). The member should check the provider has the skills and resources needed, and "must adequately plan and supervise the third-party service provider's professional services."
In practice that means an AI tool that touches client data needs a business contract with confidentiality terms, not a consumer account's terms of service. For what changes between consumer and business plans, see our comparison of ChatGPT Plus vs Business. It also means your engagement letter should say you may use third-party AI providers.
What does the IRS's Circular 230 guidance on AI say?
OPR's June 2026 guidance applies five existing Circular 230 duties to AI: due diligence, fees, competence, firm procedures and reasonable reliance in written advice. Anyone who practices before the IRS is bound by them.
| Circular 230 section | What OPR says it means for AI |
|---|---|
| §10.22 Due diligence | Review "all AI-created documents and language incorporated into writings before delivery to a client or submission to the IRS," verifying "facts, citations, and calculations." "Practitioners cannot rely solely on AI" |
| §10.27 Fees | Billing for time not actually spent, or double billing for AI-assisted tasks, "may violate § 10.27, depending on the facts." "Cost savings should be passed on openly" |
| §10.35 Competence | Practitioners must understand "AI systems' operational mechanics, limitations, and risks" |
| §10.36 Firm procedures | Firms "must deploy internal policies and procedures," covering staff training, secure data handling, AI accuracy monitoring and vetting outside AI tools, with every step documented |
| §10.37 Written advice | "Blind reliance on what AI yields, especially when the underlying logic or sources are unclear, may constitute unreasonable reliance." Treat AI output as "a starting point" |
Section 10.36 is the one that reaches firm leadership. It applies to whoever has "principal authority and responsibility for overseeing a firm's practice", who "must take reasonable steps to ensure that the firm has adequate procedures in effect." OPR also points to §10.51(a)(15), which makes willful unauthorized disclosure of return information a disciplinary matter: "Willful mishandling of taxpayer information through AI may lead to disciplinary actions under Circular 230."
The guidance gives a cautionary example from outside tax. In July 2025 the Australian government published a report of more than 230 pages, prepared by Deloitte Australia, that "contained invented quotes attributable to a judge" and references to reports that don't exist. Deloitte reportedly agreed to refund part of the fee.
Does the FTC Safeguards Rule cover AI vendors?
Yes: tax preparers are financial institutions under the FTC Safeguards Rule, so the firm's written information security plan has to cover any AI vendor that handles client information. The rule defines "an accountant or other tax preparation service that is in the business of completing income tax returns" as a financial institution.
The rule requires a written information security program, and one of its elements is to "oversee service providers" by:
- taking reasonable steps to choose providers that can keep appropriate safeguards;
- "requiring your service providers by contract to implement and maintain such safeguards"; and
- "periodically assessing your service providers based on the risk they present."
Firms holding information on fewer than 5,000 consumers are exempt from some parts of the rule, but not from the written program or the service-provider duty. The IRS repeats the point in Publication 5708: "A requirement of the Safeguards Rule is implementing and maintaining a WISP. Your WISP must be written and accessible." Add each AI tool to the WISP's list of service providers, with its contract and a review date.
What about AI in audits?
Audit teams can use AI, but its output isn't audit evidence on its own, and the auditor who uses it answers for the work. PCAOB staff spoke to large audit firms for a July 2024 Spotlight, which is a staff view and "not a rule, policy, or statement of the Board". The firms were using generative AI "primarily on administrative and research activities," and some didn't allow it on audit or attest procedures "due to data privacy concerns and other risks." The firms told staff that someone who uses an AI tool "is still responsible for the results and documentation of the work," and that reviewers apply "the same level of diligence" as for any other work.
The Texas board put it more bluntly in August 2026: "AI-generated analyses do not constitute audit evidence." Use AI to find trends and organize files. Base audit conclusions on evidence your team obtained and evaluated.
Where does AI save accounting firms hours?
The best field evidence so far shows AI taking routine data entry off accountants and speeding up the month-end close, with the freed time going into business communication and checking. In a study published in the Journal of Accounting Research in 2026, Jung Ho Choi of Stanford and Chloe Xie of MIT Sloan surveyed 277 accountants and analyzed over 200,000 transaction records from an AI-enabled accounting platform serving 79 small and midsize businesses.
According to write-ups of the study by MIT Sloan and Stanford GSB:
- accountants using generative AI reallocated about 8.5% of their time from routine data entry to tasks such as business communication and quality assurance;
- they closed the books 7.5 days faster each month; the authors put it as finishing "almost within two weeks after month-end, whereas others take over a week longer";
- their general ledgers were 12% more granular (more detailed).
The same study found that relying on AI recommendations that went against the consensus "can increase the risk of error." 62% of the accountants surveyed were worried about errors and accuracy in AI-generated reporting.
Adoption is still uneven. In the Thomson Reuters Institute's 2026 AI in Professional Services Report (1,514 respondents in 27 countries, surveyed in late 2025), 34% of tax firm respondents said their firm already uses generative AI. Only 18% of all respondents said their organization collects metrics on the return from AI. About two in five law and tax firm respondents said different clients had given them conflicting views on whether AI should be used on their work. That's one more reason to put your approach in writing.
Review is the work that's left
The study's most useful finding for a managing partner isn't the 7.5 days. It's where the time went: into quality assurance. Every rule above says the same thing in its own words. The CPA's diligence, the reviewer's sign-off and the firm's procedures are what make AI output usable. When AI does the preparation, review becomes the main job, and it needs the same planning as the preparation used to get.
That means deciding in advance what "checked" means for each kind of output: which figures get tied back to source documents, which citations get opened and read, and who signs. Our framework calls this an output standard, and the output standard lesson in our free leaders' course shows how to write one in an afternoon. The firms that save time are the ones where the reviewer knows exactly what to check, rather than rereading everything.
How to roll out AI in an accounting firm
These six steps meet the rules above. Each one produces something the next one needs. Adapt them with your firm's counsel.
01 · Find out what's already in use
Ask every partner and staff member which AI tools they use, and offer an amnesty for owning up. Include the AI features switched on inside your tax software, practice management system, document portal and email. The Shadow AI Audit builds the list in minutes. The output is an inventory, and it tells you which tools have already seen client data.
02 · Approve tools by where the data goes
For each tool on the list, answer four questions. Is there a business contract that keeps client information confidential? Is client data used to train the vendor's models? Where is the data processed and who can see it, inside or outside the United States? Can access be limited to the staff on each engagement? Approve tools for named data classes only: public information, client financials, tax return information. Our free data map lesson shows how to sort data into those classes. The output is an approved-tools list, which goes into your WISP as service providers.
03 · Fix the engagement letter and the consents
Add a clause telling clients the firm may use third-party service providers, including AI tools, as AICPA interpretation 1.150.040 suggests. Where a use needs Section 7216 consent (anything processed abroad, or a tool applying tax law to the client's facts), use a separate consent document in the Revenue Procedure 2013-14 format and wording, signed and dated, with a copy to the client. Don't make the engagement depend on it. The output is updated templates, ready for the next engagement season.
04 · Write the firm's AI policy
Put the rules in one document: approved tools and the data allowed in each, a ban on client data in personal accounts, the review standard, how to report a mistake, and who owns the policy. This is the "internal policies and procedures" OPR expects under §10.36. The AI Usage Policy generator drafts one in a few minutes, and our AI policy template gives copy-ready clauses. The output is a signed-off policy.
05 · Make review a named step with a sign-off
For every deliverable AI touched, name the reviewer and what they check: facts, citations and calculations, as OPR's §10.22 guidance lists. Record the sign-off in your workflow tool. In audits, keep AI output out of the evidence file unless your team has tested it. The output is a review record you could show a peer reviewer or the IRS.
06 · Train everyone, and bill for real time
Train every person who touches client work on the policy, the approved tools and the review step. OPR's competence standard expects practitioners to understand the tools' limits. Our free first hour with AI course covers the basics for all staff. Then check billing: hourly work is billed for time actually spent, and OPR says savings "should be passed on openly." The output is a trained team and billing that will stand up to a client's questions. If you'd like help putting these steps in place, our AI governance service does this work with firms.
What's still open
- How Section 7216 treats AI vendors. The IRS hasn't said whether an AI provider can fall under the auxiliary-services or software-contractor exceptions, or when using a tool counts as a substantive determination. Until it does, firms relying on an exception are making a judgment call.
- More IRS guidance. OPR calls its June 2026 document "introductory," so more detailed guidance may follow.
- Your state board. State boards license CPAs and set their own rules. Texas has said how its rules apply to AI. Check your own board's publications.
- Client expectations. Some clients now ask whether AI will be used on their work. Expect engagement terms and client questionnaires to start asking.
We'll update this article when the IRS, the AICPA or the PCAOB issues new guidance on AI. The date at the top of the page shows when we last checked.
Sources
- 26 U.S. Code § 7216, Legal Information Institute, October 2026: the criminal penalty for disclosing or misusing tax return information.
- 26 U.S. Code § 6713, Legal Information Institute, October 2026: the civil penalty per disclosure and the annual cap.
- 26 CFR § 301.7216-1, § 301.7216-2 and § 301.7216-3, Legal Information Institute, October 2026: who counts as a preparer, the exceptions for other preparers and software contractors, the rules for disclosure outside the United States, and the consent requirements.
- Revenue Procedure 2013-14, IRS, 2013: the form, type size and mandatory wording of Section 7216 consents.
- Issue Number 2026-19: Introductory Guidelines for Responsible AI Use in Federal Tax Practice, IRS Office of Professional Responsibility, June 2026: how Circular 230's duties apply to AI, and the Deloitte Australia example.
- Circular 230 (Publication 230), IRS, June 2014: the text of §§ 10.22, 10.36 and 10.37.
- AICPA Code of Professional Conduct, AICPA, September 2026: rule 1.700.001 and interpretations 1.700.040, 1.150.040 and 1.300.040 on third-party service providers.
- 16 CFR § 314.2, § 314.4 and § 314.6, Legal Information Institute, October 2026: the FTC Safeguards Rule's definition covering tax preparers, the service-provider duty and the small-firm exemption.
- Publication 5708: Creating a Written Information Security Plan, IRS, August 2024: the WISP requirement for tax professionals.
- Spotlight: Staff Update on Outreach Activities Related to the Integration of Generative AI in Audits and Financial Reporting, PCAOB staff, July 2024: how large audit firms were using generative AI, and their safeguards.
- Board Report, Volume 168, Texas State Board of Public Accountancy, August 2026: how Texas's rules apply to generative AI, including confidentiality and audit evidence.
- Human + AI in Accounting: Early Evidence from the Field, Jung Ho Choi and Chloe Xie, Journal of Accounting Research, June 2026: the study's design and findings (abstract).
- How generative AI can make accountants more productive, MIT Sloan, August 2025: the 8.5%, 7.5-day and 12% figures, and the 62% worried about accuracy (secondary).
- AI is reshaping accounting jobs by doing the boring stuff, Stanford GSB, June 2025: the same figures, as reported by the authors' school (secondary).
- 2026 AI in Professional Services Report, Thomson Reuters Institute, 2026: tax firm adoption, ROI tracking and conflicting client views.