Section 7216 and AI: what a CPA firm needs before client tax data touches an AI tool

What the IRS has said about AI so far

On June 24, 2026, the IRS Office of Professional Responsibility issued Introductory Guidelines for Responsible AI Use in Federal Tax Practice, Issue Number 2026-19. It applies the Circular 230 duties to AI work. Practitioners have to review what an AI produces before relying on it, and the guidance tells them to treat the written text that AI generates as drafts. For client data it says to use secure, enterprise-approved AI and never to upload sensitive data to unsecured sites.

The guidance leaves the Section 7216 question open. No IRS regulation or published Section 7216 guidance mentions AI tools, and the IRS's Section 7216 information center still lists guidance from 2012 and 2013. A CPA Practice Advisor column put it plainly on October 12, 2026: "The IRS hasn't said whether sending return information to an AI tool counts as a disclosure to a third party." Until it does, firms have to design to the rules that exist.

This guide is general information, not legal or tax advice. Ask counsel how the rules apply to your firm.

What counts as tax return information

The definitions in 26 CFR 301.7216-1 are wide. Tax return information means any information furnished in any form or manner for, or in connection with, the preparation of a tax return, including a taxpayer's name, address and identifying number. It also covers information from third parties and anything the preparer derives or generates from it. Even statistical compilations count when no single taxpayer can be identified, so an anonymized dataset built from client returns is still tax return information.

The definition of a preparer is just as wide. A vendor whose staff work on your AI tool can become a preparer under the regulation, with the same duties you have.

One exclusion matters for a first AI project. Information identical to tax return information falls outside the definition when the firm obtained it other than in connection with preparing a return. Our reading is that data a client gives you for a bookkeeping engagement stays outside, even when the same facts later feed a return, while data furnished for the return sits inside. Confirm this with counsel, because it decides which documents can go into a first project.

Use and disclosure are broad as well. A use includes relying on the information as the basis to take or permit any action, and a disclosure means making it known to any person in any manner whatever. On our reading, sending a client's documents to an outside AI service can be a disclosure.

The paths that need no consent

Section 301.7216-2 lists uses and disclosures a firm can make without the client's consent, each with its own conditions. The four below are a selection that matters for an AI project, and the regulation lists others:

• Inside the firm, paragraph (c)(2): staff in the United States may use or share the information within the firm to prepare the return or provide auxiliary services for it.
• Another preparer in the United States, paragraph (d)(1): disclosure for preparing a return or providing auxiliary services, as long as those services are not substantive determinations or advice affecting the tax liability.
• Software and equipment contractors, paragraph (d)(2): disclosure only to the extent necessary, and only if every individual who receives the information gets written notice that sections 6713 and 7216 apply to them.
• Books and records, paragraph (h)(1): a firm that prepares the return may use the information within the firm to prepare the client's books, working papers or accounting statements.

Written notice to vendor staff, and the location rule

The regulation's own examples show how strict the notice rule is. In Example 2 under paragraph (d), a disclosure to a software contractor's employee is impermissible because that employee never received the written notice. For an AI project, give that notice in writing to every vendor individual who can reach client data.

These paths cover only recipients in the United States. In Example 3, a contractor abroad who only views data kept on a United States server is still receiving a disclosure outside the United States, which needs the client's consent first. An AI service that processes client data abroad falls on the wrong side of this line.

When you need consent, and what it must look like

Consent is required unless the statute or the regulations specifically authorize the use or disclosure, and 301.7216-3 sets the rules for it. Consent must be knowing and voluntary, in writing, signed and dated by the taxpayer, and obtained before the use or disclosure. Uses and disclosures need separate consent documents, and a consent that states no duration lasts one year.

For Form 1040 series filers, Rev. Proc. 2013-14 sets the format. Each consent is a separate written document, which may be attached to an engagement letter, in at least 12-point type on paper, with mandatory statements in a set order. Conditioning the firm's services on consent generally makes it involuntary and invalid. A specific exception lets a preparer condition its services on consent to certain disclosures to another preparer who helps prepare the return, and counsel should decide whether it applies.

Whether you need consent depends on the design. An agent that runs inside the firm, only to prepare the return, may sit within the paths above, while a tool that uses client data for anything else, such as training a model, needs consent.

Section 6713 sets a civil penalty of $250 for each improper disclosure or use, up to $10,000 per person in a calendar year. Violations tied to identity theft carry $1,000 each, with a separate $50,000 annual cap. Under section 7216, a knowing or reckless disclosure or use is a misdemeanor with a fine of up to $1,000, or $100,000 where the identity theft rule in section 6713(b) applies, and up to a year in prison. The OPR guidance adds that willful mishandling of taxpayer information through AI may lead to Circular 230 discipline.

The Safeguards Rule side of the same project

The FTC Safeguards Rule treats tax preparation firms as financial institutions, whatever their size. IRS Publication 5708 says the rule requires a written information security plan, and line 11 of Form W-12, the PTIN application, asks every paid preparer to confirm they know it.

Under 16 CFR 314.2, any vendor that receives or processes customer information to provide you a service is a service provider. Section 314.4(f) then requires you to choose providers that can keep appropriate safeguards and to write those safeguards into the contract. You also have to reassess each provider periodically, based on the risk it presents.

The rule's technical safeguards apply to the agent itself. Our reading of 314.4(c): its service account reaches only the client files its job needs, data is encrypted in transit and at rest, people who reach the system use multi-factor authentication, and the agent's activity is logged. A notification event affecting at least 500 consumers, such as unauthorized acquisition of unencrypted customer information, has to be reported to the FTC as soon as possible and no later than 30 days after discovery. Authorized e-file providers must also report security incidents to the IRS as soon as possible and no later than the next business day after confirming them, under Publication 1345.

Smaller firms get a narrow break. Below 5,000 consumers, a firm is excused from the written risk assessment, the testing schedule, the written incident response plan and the annual report. It still owes access limits, encryption, multi-factor authentication, logging, staff training and service provider oversight. The rule does not say how to count households. Our reading is that spouses on joint returns and dependents may count, and so may former clients whose files you keep, which puts many firms above the line.

Four common AI uses and what each needs

The table maps four common AI uses to the rules above, as our reading for you to confirm with counsel.

The first row is the urgent one. As an illustration, assume one preparer pastes client data into a personal chatbot account 40 times in a year. If each paste counted as a prohibited disclosure, 40 at $250 would reach the $10,000 annual cap under section 6713. The habit should stop either way.

A worked example: a 30-person firm gets ready

This is an illustrative example with assumed numbers, not a client result. Take a 30-person firm with 2,400 individual returns and 40 monthly bookkeeping clients. Assume 60% of the individual returns are joint. That is 3,840 people before dependents and former clients, close enough to the 5,000 line that the firm should plan for the full Safeguards Rule.

Assume the setup takes 8 hours of the Qualified Individual's time to add the agent to the written information security plan and review two vendor contracts, plus one hour of training for each of the 30 staff. That comes to 38 hours, once. If counsel advises consent before tax documents go in, assume 80% of the 2,400 clients sign through the portal without a reminder. The 480 reminders at 4 minutes each add 32 hours. Assume 5% of clients, about 120, decline and keep a no-AI path, since consent generally cannot be made a condition of service.

Now set that against a first project that does not wait on the consent question. Assume the 40 bookkeeping clients send about 100 close documents a week between them, such as bank statements and payroll reports. Filing each one against the close checklist takes 6 minutes by hand, or 10 staff hours a week. With the agent, assume 85% are routine and take 1.5 minutes to review, while the rest stay manual at 6 minutes. The week drops to about 3.6 hours, which gives back about 6.4 hours.

At that rate the 38 setup hours come back in about six weeks. Tax documents can follow once counsel has confirmed the Section 7216 path and the plan is in place. Your own consumer count and weekly document volume decide the result.

Where to start with Section 7216

Start with an inventory. Ask every staff member which AI tools they use for client work, including personal accounts. Put the approved tools in the written information security plan and check each contract for data location and training terms. Then ask counsel whether your design needs Section 7216 consent and what your engagement letter should say about AI.

For the first project, pick work that does not wait on those answers. Bookkeeping and close documents usually arrive under a bookkeeping engagement and can start while counsel reviews the tax side. We bring tax return information in only after counsel confirms the exception that applies or the consent that is required, and after the firm approves the security controls.

Our five-day sprint can run on bookkeeping and close documents, or on sample tax documents with made-up figures, so no return information has to leave the firm to start. It costs $2,500 and comes with a full refund if we do not find 10 staff hours a week. A build is from $7,500 per workflow, in your firm's own environment, and running it is $1,200 a month.

Common questions