Using AI tools in a tax practice without risking client data

AI can draft letters and summarize notices quickly, but tax return information has special rules. Here is what to check before your staff paste client data into any tool.

Why tax data is different

Section 7216 of the Internal Revenue Code restricts how tax return preparers use and disclose tax return information. Uses and disclosures beyond preparing returns generally require the taxpayer's written consent, and the consent must meet specific content and signature requirements.

Whether sending data to a particular AI tool is a disclosure that needs consent depends on the tool and the purpose. That is a question for your counsel or professional body, not a vendor's sales page.

Questions to ask any AI vendor

• Is our data used to train your models? Can we turn that off by contract?
• Where is data stored, and for how long?
• Who at your company can see it?
• Do you offer a business agreement that covers confidentiality and breach notice?

A safe adoption checklist

• List every AI tool staff already use, including free ones.
• Approve a short list of tools and block or retire the rest.
• Decide which tasks may include client data and which must use anonymized text.
• Get consent where your counsel says it is required, before the data is used.
• Add AI vendors to your written information security plan.
• Train staff and review usage every quarter.

Good first uses

• Drafting routine client letters from a template, with names added afterward
• Summarizing IRS notice types and response steps
• Searching the firm's own approved knowledge base

Frequently asked questions

Can we use ChatGPT or similar tools with client tax data?

Not without care. Check the vendor's data terms, whether the use requires Section 7216 consent, and whether your security plan covers it. Many firms start with anonymized text only.

Does our written information security plan need to mention AI?

If AI vendors handle client information, your plan should cover them like any other service provider.

Sources

• The Tax Adviser (AICPA), "The many implications of Sec. 7216," January 2024↗
• IRS, "IRS, Security Summit remind tax pros they need a Written Information Security Plan"↗