AI for Accounting Firms: Tax, Audit and Advisory Use Cases, Section 7216 Consent and an AI Policy Outline for CPA Firms

Why client data makes accounting firms a special case

Most professional services firms protect client data through contracts and ethics rules. CPA firms that prepare tax returns also answer to a criminal statute. Section 7216 of the Internal Revenue Code makes it a misdemeanour for a tax return preparer to knowingly or recklessly disclose or use tax return information for anything other than preparing the return, and Section 6713 adds a civil penalty for each improper disclosure.

On top of that sit the Gramm-Leach-Bliley Act and the FTC Safeguards Rule, which treat an accountant in the business of completing income tax returns as a financial institution. Audit practices add independence and documentation standards, and the AICPA Code of Professional Conduct applies to every member.

None of these rules was written for AI. All of them apply to it. This guide covers where AI helps across tax, audit and advisory work, then what each rule means for a firm choosing tools. Sources were read on the IRS, FTC, eCFR, AICPA and PCAOB sites on 22 October 2026.

AI for CPA firms in tax practice

Source document intake

The busiest weeks of tax season are spent keying data from W-2s, 1099s, K-1s, brokerage statements and client organisers. Document AI can read those forms, extract the fields and flag anything unusual, such as a K-1 with state apportionment the prior year did not have or a 1099-B with missing cost basis. A preparer reviews the extracted data before it enters the return.

Research and memos

Tax research is a good fit for retrieval over a trusted library: the Code, regulations, revenue rulings, the firm’s prior memos and its research service. A model drafts a memo that cites each authority and quotes the passage it relied on. Unsourced answers are a liability in tax work, because models invent citations, so the firm should only accept output that links to a document someone can open.

Review and planning

Models can compare the current return with the prior year and explain the largest changes, check that carryforwards were brought forward, and draft planning letters from the review notes. Each of these touches tax return information, which is why the Section 7216 analysis below matters for even routine use.

AI for audit firms: sampling, vouching, PBC tracking and workpaper review

Testing populations and supporting samples

Auditors have long used data analytics to test whole populations of journal entries or transactions. Generative AI extends that to unstructured evidence. Instead of vouching 60 sampled invoices by hand, a team can have a model read every invoice, contract or shipping document in the population, extract amount, date, counterparty and terms, and list the ones that do not match the ledger. The auditor then decides what that means for the sample and the conclusion.

The amendments to AS 1105, Audit Evidence, and AS 2301, The Auditor’s Response to the Risks of Material Misstatement, approved by the SEC in August 2024, apply to audits of financial statements for fiscal years beginning on or after 15 December 2025. They address the auditor’s responsibilities when using technology-assisted analysis, including investigating items identified in tests of details and evaluating the reliability of electronic information provided by the company.

Document vouching and tie-outs

Vouching a disclosure to its support, tying the financial statements to the trial balance and checking that every number in the notes agrees are mechanical and slow. An agent with access to the trial balance, the draft statements and the support folder can do the first pass and list differences for the senior.

PBC request tracking

The provided-by-client list is a project management problem. An assistant can match files clients upload to open requests, mark items received, notice when a file is the wrong period, and draft polite reminders for the engagement manager to send.

Workpaper review

Reviewers spend hours checking that workpapers have a purpose, procedures, results and conclusion, that tickmarks are explained and that cross-references work. A model can pre-review a workpaper against the firm’s methodology and draft review notes. The reviewer still signs off. The internal audit agent shows the population-testing and workpaper drafting pattern applied inside a company.

Advisory, client portals and engagement letters

Advisory and client accounting. Client accounting services and outsourced controller work involve coding transactions, reconciling accounts and closing the books every month. The month-end close use case and the financial reporting use case show how those steps are split between agents and reviewers, and the AI accounting agent covers transaction coding and balance explanations.

Client portal questions. Clients ask the same questions every season: what documents are still missing, when the return will be filed, why the estimate changed. An assistant that answers only from the client’s own engagement record and the firm’s approved FAQ can handle many of them, and hand anything substantive to a person.

Engagement letters. Drafting letters from templates, checking that scope, fees and responsibilities match the proposal, and adding the right AI disclosure language are simple, useful tasks. If the firm decides to seek Section 7216 consent for AI processing, the engagement process is where that happens, using a separate consent document that meets the IRS format.

Section 7216 and AI: is sending tax return information to a model a disclosure?

The regulations at 26 CFR 301.7216-1 to 301.7216-3 answer most of this question, even though they predate generative AI.

What counts. Tax return information is any information furnished for, or in connection with, preparing a return, including name, address and identifying number, plus anything the preparer derives from it. A disclosure is making that information known to any person in any manner. Uploading a client’s return to an outside service fits that definition.

What is allowed without consent.

• Inside the firm, in the US. Officers, employees and members of the same preparer in the United States may use and share the information to prepare the return.
• Other US preparers for non-substantive help. Disclosure to another preparer in the United States is allowed for preparing a return or for auxiliary services, as long as that party makes no substantive determinations, defined as analysis, interpretation or application of the law.
• Contractors for software. A preparer may disclose information to a contractor for programming, maintenance, repair, testing or procurement of software used to prepare returns, only to the extent necessary, and only if every individual receiving it gets written notice of Sections 6713 and 7216. Such contractors become tax return preparers themselves.

Where AI tools run into trouble. A model asked to determine the tax treatment of an item is performing analysis or application of the law, which the non-consent exception for other preparers does not cover. Any processing by a person or system outside the United States requires the taxpayer’s consent first. For Form 1040 filers, a US preparer generally may not even obtain consent to send the taxpayer’s Social Security number to a preparer abroad, except through an adequate data protection safeguard defined by the IRS. A cloud AI service whose default processing location is global sits uneasily with those rules.

The penalties. The regulation describes Section 7216 as a misdemeanour carrying up to one year in prison, a fine of up to $1,000, or both, and Section 6713 as a civil penalty of $250 per disclosure, up to $10,000 a year.

What firms do in practice. In the absence of IRS guidance specific to AI, firms tend to choose one of three routes: obtain a written Section 7216 consent that names the AI processing; contract the AI provider as a US software contractor with the required written notice and limit what it receives; or keep tax return information on systems the firm runs, so no disclosure to another person occurs. Firms should confirm their chosen route with tax counsel.

The FTC Safeguards Rule, IRS Publication 4557 and the written information security plan

The FTC Safeguards Rule, 16 CFR Part 314, applies to tax preparers because tax preparation is a financial activity under the Bank Holding Company Act. It requires a written information security program, and several of its provisions bear directly on AI vendors:

• Service provider oversight (314.4(f)). Select providers capable of maintaining appropriate safeguards, require those safeguards by contract, and periodically assess the provider based on its risk.
• Multi-factor authentication (314.4(c)(5)). Required for anyone accessing an information system that holds customer information, including an AI workspace that does.
• FTC notification (314.4(j)). A notification event involving the information of at least 500 consumers must be reported to the FTC as soon as possible and no later than 30 days after discovery.

Firms that hold information on fewer than 5,000 consumers are exempt from a few provisions, including the written risk assessment, the written incident response plan and the annual report to the board, but not from the service provider rules.

The IRS points practitioners to Publication 4557, Safeguarding Taxpayer Data, and Publication 5708, a sample written information security plan written for smaller practices. Adding AI tools to the WISP means listing each tool as a system, naming the data it may receive, recording the vendor assessment and contract, and covering AI data exposure in the incident response plan.

AICPA confidentiality rules for AI service providers

The Confidential Client Information Rule, ET 1.700.001, bars members in public practice from disclosing confidential client information without the client’s specific consent, subject to listed exceptions. Interpretation ET 1.700.040, Disclosing Information to a Third-Party Service Provider, sets the route for vendors: before disclosing confidential client information to a service provider, the member should either enter into a contract requiring the provider to keep it confidential, with reasonable assurance that the provider has procedures to prevent unauthorised release, or obtain the client’s specific consent.

An AI provider that receives client data is a third-party service provider for these purposes. Its standard terms of service rarely amount to the confidentiality agreement the interpretation describes, so firms need either a negotiated agreement or client consent. Telling clients in the engagement letter that the firm uses AI tools and service providers is good practice either way.

State boards of accountancy and state privacy laws add their own requirements, which vary by state.

What the PCAOB and COSO have said about generative AI

PCAOB staff spotlight, July 2024. The PCAOB staff’s outreach found that audit firms were using generative AI mainly for administrative and research tasks, and that some firms did not allow it for audit or attest procedures because of data privacy and reliability concerns. Firms said an engagement team member who uses a generative AI tool remains responsible for the results and documentation, and that reviewers should apply the same diligence as for any other work. Some firms were designing tools to record the source data behind each output.

Standard-setting in 2026. The PCAOB has not issued an AI-specific auditing standard. Its March 2026 request for comment on strategic priorities asked how the Board itself should use technology including AI, and in June 2026 it sought comment on its standard-setting and research agendas, with comments due on 7 August 2026. Firms should watch for the outcome rather than assume new requirements.

COSO, February 2026. COSO published Achieving Effective Internal Control Over Generative AI, which applies the 2013 Internal Control–Integrated Framework to generative AI and groups use cases into capability types such as ingestion, transformation, judgement and monitoring. Audit firms will see clients use it to design controls over AI in financial reporting, and can apply the same thinking to their own tools.

An AI policy outline for a CPA firm

An AI policy for a CPA firm should be short enough for staff to read and specific enough to settle real questions. A workable outline:

1. Purpose and scope. Which partners, staff, contractors and offices it covers, including offshore teams.
2. Approved tools and data classes. A table of tools against data classes: public, firm internal, client confidential, tax return information, audit evidence, personal data. Consumer AI accounts are barred from everything except public information.
3. Section 7216 rules. When consent is required, which consent form is used, how US-only processing is confirmed, and how SSNs are handled.
4. Vendor management. The assessment, contract and periodic review each AI provider needs under the FTC Safeguards Rule and ET 1.700.040, including training, retention, subprocessors and processing location.
5. Professional responsibility. The person who uses AI owns the output. Returns, opinions and workpapers need human review and sign-off at the same standard as any other work.
6. Documentation. How AI use is recorded in engagement files and workpapers, including the source data relied on.
7. Client communication. Standard engagement letter language and the process for clients who decline AI processing.
8. Security and incidents. Multi-factor authentication, access by role, logging of prompts and outputs, and AI data exposure in the WISP’s incident plan.
9. Training and monitoring. Annual training and checks for unapproved AI services on firm devices.
10. Review cycle. Revisit the policy at least annually and whenever the IRS, AICPA, PCAOB or a key vendor changes its position.

The AI governance policy generator can produce a first draft of policy text, RACI tables and approval steps to adapt to this outline.

Accounting firm tasks by data sensitivity

How VDF AI fits an accounting practice

VDF AI is installed on servers the firm runs, on-premises, in a private cloud in a region the firm chooses, or air-gapped. The models, retrieval indexes, conversation history and audit logs stay on those servers. With external model APIs disabled, tax return information and audit evidence are processed only by open-weight models the firm hosts, which supports the route under Section 7216 where no outside party receives the data. VDF AI carries no IRS, AICPA or PCAOB endorsement; the deployment belongs inside the firm’s own written information security plan and quality management system.

Permission-aware retrieval suits engagement-based access. Each client or engagement can have its own collection, so a staff member’s question only searches files for engagements they are assigned to, and a client portal assistant only answers from that client’s record. Governed agents can run intake extraction, PBC matching, tie-outs and workpaper pre-review with tool permissions set per role, and a workflow can pause for a manager or partner to approve before anything reaches a client or the IRS. The platform records each turn with the user, model version, retrieved sources and tool calls, which gives the engagement file a trail of what the AI saw and produced.

The VDF AI Router can register local model endpoints from Ollama, vLLM or other servers, and permit a cloud model only for task types the firm’s policy allows, such as public research. On-premises, staff sign in through Microsoft Entra ID natively, and other identity providers connect through an SSO-aware reverse proxy, with role-based access control on every plan. The finance AI use cases and the finance agents catalogue show related workflows. This guide is general information and not tax, legal or professional standards advice.