AI for accountants: who builds it, and who runs it

Under 26 U.S.C. 7216, a preparer who knowingly or recklessly discloses or uses tax return information for anything other than preparing the return commits a misdemeanor.^[1] The regulations say a preparer may not disclose or use that information before obtaining written consent, unless an exception applies.^[2] Ask counsel which AI uses need consent.

Disclosing return information to a preparer located outside the United States requires the taxpayer's prior consent, and a US preparer generally must redact or mask a Form 1040 filer's SSN before disclosing it to someone abroad.^[2] Your operator works from Latin America, so builds are designed so they never see unmasked SSNs.

The FTC lists tax preparation firms as covered financial institutions. Requirements include a Qualified Individual, a written risk assessment, encryption, multi-factor authentication, oversight of service providers, and notifying the FTC within 30 days of a breach involving at least 500 consumers.^[3] Every tool your operator adds goes into your security plan.

The IRS says tax professionals need a written information security plan, and points to Publication 4557, Safeguarding Taxpayer Data.^[4] The Ownership Binder lists every account, integration and access level, which is most of what that plan has to describe.

Your professional standards also restrict disclosing confidential client information. Keep client data in tools your firm controls, under accounts in the firm's name.

AI summaries of notices and transactions are drafts. A qualified person reviews anything that affects a return, a filing or advice.