Pevita Pearce
The upcoming busy season for tax firms will likely see an increase in the use of artificial intelligence (AI) tools to streamline workflows. A common scenario involves staff members pasting client tax return information into chat applications to quickly obtain summaries or insights. While often driven by a genuine desire to manage heavy workloads and clear backlogs, this practice introduces significant data privacy and compliance challenges that firm owners must proactively address. The Internal Revenue Service (IRS), through its Office of Professional Responsibility (OPR), has issued critical guidance that necessitates a formal, written strategy for AI integration within federal tax practices, underscoring the importance of safeguarding client data.
IRS OPR Alert 2026-19: A Framework for Responsible AI Use
On June 24, the IRS Office of Professional Responsibility released OPR Alert 2026-19, establishing foundational guidelines for the responsible deployment of AI in federal tax practice. This alert reiterates many of the core duties practitioners are already familiar with under Circular 230, the body of regulations governing tax practitioners. However, it also introduces specific directives that demand inclusion in every firm’s AI policy, particularly concerning the handling of sensitive client information.
The core of the IRS guidance emphasizes that practitioners must handle client data "using only secure, enterprise-approved AI." This directive serves as a stark warning against the casual uploading of sensitive financial and personal information to unsecured or publicly accessible AI systems. The IRS explicitly links non-compliance with these principles to the severe civil and criminal penalties associated with the unauthorized disclosure of taxpayer information, as outlined in Internal Revenue Code (IRC) Sections 6713 and 7216. These sections carry significant financial penalties and potential imprisonment for individuals and firms found to have improperly disclosed confidential tax return data.
Furthermore, the alert places a direct responsibility on firm leaders who possess oversight duties under Circular 230 Section 10.36. These leaders are now mandated to establish comprehensive procedures that encompass several critical areas: robust staff training on AI usage and data security, the implementation of secure data handling protocols, continuous monitoring of AI output for accuracy, and a thorough vetting process for all third-party AI tools utilized by the firm. Crucially, the IRS requires that every step taken in establishing and implementing these procedures be meticulously documented. This documentation serves as evidence of a firm’s commitment to compliance and due diligence.
Unpacking the Nuances: Hidden Risks and Fee Implications
Beyond the overarching mandate for secure AI use, the IRS alert highlights two specific points that are easily overlooked but carry significant implications for tax practices:
- Cross-Client Data Leakage: The guidance explicitly names cross-client leakage as a substantial privacy risk. This refers to the scenario where data or insights derived from one client’s tax file are inadvertently reused or accessed when responding to a query or processing information for another client. This risk is particularly acute with AI tools that have broad access to a firm’s entire client database. The integrity of client confidentiality hinges on the absolute separation of individual client data.
- Fee Transparency and Billing Practices: Under Section 10.27 of Circular 230, which governs fees, the IRS signals that billing practices related to AI-assisted work must be transparent and accurate. Specifically, the alert warns that billing for manual time that was not actually spent, or engaging in double billing for work that has been significantly automated by AI, could constitute a violation. The determination of such violations will depend on the specific facts and circumstances of each case, underscoring the need for accurate time-tracking and clear communication with clients about how AI impacts billing.
The Evolving Landscape of Client Consent for AI Use
A central compliance challenge for tax firms integrating AI lies in the realm of taxpayer consent. IRC Section 7216 fundamentally requires a taxpayer’s written consent before a tax preparer can use or disclose return information outside of specifically defined regulatory exceptions. For Form 1040-series returns, Revenue Procedure 2013-14 provides a standardized format for obtaining such consent. However, the IRS has yet to issue explicit guidance clarifying whether transmitting return information to an AI tool constitutes a "disclosure to a third party" in the context of Section 7216.
Given this ambiguity, the most prudent approach for tax firms is to implement a standalone, written AI consent form, drafted in consultation with legal counsel. This consent should be clearly worded to inform taxpayers precisely how their data might be used by AI tools. A critical consideration arises for clients who decline to provide this consent. The regulations stipulate that consent must be both knowing and voluntary. Conditioning tax preparation services on the provision of AI consent is generally viewed as making that consent involuntary, thus rendering it invalid. Consequently, firms must establish a clear protocol for preparing tax returns without the use of AI for any client who opts out. This requires staff to be aware of which clients have declined AI consent before commencing work on their files to ensure a non-AI workflow is initiated.
Deconstructing Vendor Agreements: The Devil is in the Details
The broad statement "We use an AI tool" provides minimal practical insight into a firm’s AI compliance posture. The critical questions are specific to the particular AI product and the service plan chosen by the firm. Key considerations include:
- Data Retention Policies: Does the AI provider retain user prompts and uploaded files? If so, for how long?
- Model Training: Does the provider utilize customer data for training its AI models? This is a significant concern for data privacy.
- Scope of Agreements: Does a "zero-retention" or "data privacy" agreement cover only the direct integration via a developer API, or does it extend to the more accessible chat interfaces that staff might routinely use?
- Tiered Service Differences: Consumer-grade and business-grade tiers of the same AI product can often carry vastly different terms of service and data handling policies.
Firms must meticulously document the answers to these questions within their vendor files. Furthermore, these requirements should be explicitly incorporated into contractual agreements with AI service providers. If a vendor is unwilling to provide written assurance that client data will not be used for training purposes, firms should operate under the assumption that it will be, and adjust their usage accordingly.
Fortifying Data Segregation: Preventing Cross-Client Contamination
The IRS’s concern regarding cross-client data leakage is not solely a policy issue but also a fundamental design challenge for AI systems. An AI tool that is capable of searching across all client files to answer a query could inadvertently pull information from an unrelated client’s return. To mitigate this risk, firms must confirm that any AI system they deploy enforces strict separation of client data. This ensures that work performed on one client’s tax return cannot draw upon or be influenced by another client’s documents or data. It is imperative to inquire with AI vendors about the specific mechanisms they employ to enforce this data segregation and to understand the implications when an employee has access to a broad range of client files.
The Imperative of Audit Trails: Documenting AI’s Footprint
The OPR alert stresses the importance of documenting AI usage and verification processes. In practice, this translates to the ability to definitively answer a critical question for any given tax return: Which AI tools processed this client’s information, and who reviewed the output before it was finalized and submitted to the client or the IRS?
Such detailed records are also instrumental in upholding the IRS’s guidance on fee transparency. If AI has demonstrably reduced the time required to complete a tax return, a comprehensive log will provide evidence of this efficiency gain. This allows firms to price their services fairly, transparently communicate any changes in billing to clients, and defend their billing practices if questioned.
As an illustrative example, consider the development of agent workflows for high-volume tax practices. In such systems, human intervention can be reduced to under five minutes per return. This efficiency is only achievable when preparers have visibility into every action taken by the AI agents, and when any task requiring human judgment or approval is explicitly flagged for review. The same type of running record that enables a preparer to oversee AI agents is precisely the kind of documentation the IRS now requires firms to maintain.
Establishing a Foundational AI Policy: A Starting Point
For the majority of tax firms, a practical and effective initial AI policy can be concise, ideally fitting on a single page. This policy should clearly delineate:
- Approved AI Tools and Plans: A list of all AI tools sanctioned for use by the firm, along with the specific service plans subscribed to.
- Data Handling Restrictions: A clear statement that client return information is to be processed exclusively within these approved tools and plans.
- AI Consent Protocol: Adoption of a standalone AI consent form, developed with legal counsel, and the establishment of a defined workflow for clients who decline AI usage.
- Human Review Mandate: A standing requirement that all AI-generated output undergoes thorough human review before being presented to a client or submitted to the IRS.
- Logging and Auditing: A commitment to logging which AI tools have interacted with a client’s data, thereby creating an auditable trail.
Given the dynamic nature of AI technology and evolving regulatory landscapes, it is essential to schedule an annual review of the firm’s AI policy. This ensures that the policy remains current, effective, and compliant with the latest guidance.
Finally, designate a specific individual within the firm to be accountable for the AI policy and the maintenance of vendor documentation. Place the date for the first annual review on the firm’s calendar to institutionalize this ongoing compliance effort.
Broader Implications for the Tax Profession
The IRS’s proactive stance on AI in tax practice signals a broader trend of increased regulatory scrutiny as new technologies become integrated into core professional services. For accounting and tax firms, this guidance serves as a crucial wake-up call, emphasizing that innovation must be coupled with robust data security, client privacy, and ethical considerations. Firms that embrace these principles proactively will not only mitigate risks but also build greater trust with their clients and establish themselves as responsible leaders in the adoption of AI. The future of tax practice will undoubtedly involve AI, but its successful integration depends on a foundation of diligence, transparency, and unwavering commitment to professional standards.
