Short answer: Section 7216 of the Internal Revenue Code limits how a tax return preparer may disclose or use a client's tax return information. Before any AI tool reads client returns, ask what the vendor does with that information, whether that use or disclosure falls inside the permitted exceptions, and whether you need signed client consent. If you are not sure, ask your counsel before you turn it on. Running the work on your own hardware removes many of these questions.
We wrote about writing an AI policy for your firm and about what happens when staff paste client data into ChatGPT. This post is about the federal rule that sits under both of those for any firm that prepares returns.
This is not legal advice. It is a list of what to read and what to ask.
What the rule says, in plain words
Section 7216 makes it a crime for a tax return preparer to knowingly or recklessly disclose or use return information without authorization. The IRS describes it in Rev. Proc. 2013-14 as a misdemeanor with up to one year in prison, a fine of up to $1,000, or both. A related civil penalty under Section 6713 is $250 per disclosure or use, up to $10,000 per calendar year.
The Treasury regulations fill in the details:
- § 301.7216-1 defines who counts as a tax return preparer and what counts as tax return information. Read the definitions. They are broader than many people expect.
- § 301.7216-2 lists disclosures and uses that are allowed without consent.
- § 301.7216-3 says that, unless the statute or § 301.7216-2 allows it, a preparer may not disclose or use return information without the taxpayer's consent, and that consent must be knowing and voluntary.
Where AI comes in
An AI tool can touch return information in several ways. Each one is a different question:
- It reads the return to help prepare it. Some help in preparing the return is covered by the exceptions in § 301.7216-2. Whether your tool's use fits depends on the facts.
- The vendor keeps the data. Ask how long, and why.
- The vendor uses the data to train or improve its model. That is a use beyond your client's return. Ask the vendor in writing whether it happens.
- The vendor processes data outside the United States. The regulations have special rules for disclosures to preparers outside the U.S., including extra limits when Social Security numbers are involved. Rev. Proc. 2013-14 describes them.
- You use the data for something other than the return. For example, using AI to find clients for a new service from their return data. That is a use of return information for a purpose other than preparation. Read § 301.7216-3 before you do it.
We do not know which exceptions apply to your tools and your engagement letters. Your counsel does, or can find out.
If you need consent
For Form 1040 filers, Rev. Proc. 2013-14 sets the format and the required wording for consents. Some points from it:
- The consent must be a separate written document. It can be attached to an engagement letter.
- It must include mandatory statements in a set order.
- It must be affirmative. An opt-out box does not count.
- You cannot require it as a condition of preparing the return, in the cases the Rev. Proc. describes.
- If no length of time is stated, it is valid for one year from signature.
If the consent wording in your engagement letter came from a template years ago, read it again with AI in mind.
The questions to ask any AI vendor
- Where is our clients' data processed and stored? Country and company.
- Is any of it kept after the job? For how long?
- Is any of it used to train or improve a model? Get the answer in the contract.
- Who at the vendor can see it?
- What happens to the data if we leave?
If the vendor cannot answer these in writing, do not send it return data.
The on-premises option
When the AI runs on hardware your firm controls, the return information does not go to an outside vendor. That does not remove your duties under Section 7216. It does remove many of the vendor questions above. For some firms, that is the simplest path.
A realistic first step
List every tool in your office that can see client return data, including any that added AI features this year. For each one, write down what it does with the data and whether you have it in writing. Take that list to your counsel before tax season, not during it.
If you want AI that drafts and checks inside your own walls — talk with us. If your current tools already meet your counsel's bar, we will say so.
Related: an AI policy for accounting firms · staff pasted client data into ChatGPT · our approach for accounting firms.