Can Accountants Put Client Data Into AI Tools? IRS & FTC Rules (2026)

By The Professions Cloud Editors Updated October 13, 2026 · 5 sources · 3 min read

Prices and facts checked October 13, 2026. We don't accept payment for rankings.

Short answer: you can use AI tools with client data, but not casually. If you prepare tax returns, disclosing return information to a third party, including an AI vendor, generally requires the client's prior written consent under IRC §7216. Separately, the FTC Safeguards Rule treats tax and accounting practices as financial institutions, so every AI vendor that touches client data has to be covered by your written security plan.

Rule 1: IRC §7216, client consent for tax return information

Section 7216 makes it a misdemeanor for a tax return preparer to knowingly or recklessly disclose or use return information for anything other than preparing the return. The penalty is a fine of up to $1,000, up to a year in prison, or both (26 U.S.C. §7216). There's also a civil penalty of $250 per disclosure or use, up to $10,000 a year, rising to $1,000 per disclosure (up to $50,000) where identity theft is involved (26 U.S.C. §6713).

The regulations allow disclosure with the client's prior written consent. A valid consent must (26 CFR §301.7216-3):

• name you and the taxpayer
• state the purpose and identify the recipients
• specify exactly what information can be disclosed or used
• be signed and dated by the taxpayer, who gets a copy
• be knowing and voluntary: you generally can't refuse service if they don't sign

If the consent doesn't say how long it lasts, it expires after one year. Disclosures to anyone outside the U.S. need specific consent, and for Form 1040 clients the SSN generally has to be redacted unless an approved safeguard is used. That matters because many AI tools process data overseas.

What this means for AI: pasting a client's return details into a consumer chatbot, or connecting an AI tool that stores return information, is a disclosure to a third party. Either get consent that names the purpose and recipient, or keep identifiable return information out of the tool.

Rule 2: The FTC Safeguards Rule and your WISP

Under the Gramm-Leach-Bliley Act, the IRS and FTC treat tax and accounting professionals as financial institutions. They must protect customer data with a written information security plan (WISP) (IRS, IR-2025-79). The FTC's Safeguards Rule requires, among other things (FTC):

• a Qualified Individual responsible for your security program
• a written risk assessment of where customer data lives
• encryption in transit and at rest, plus multi-factor authentication
• service-provider oversight: choosing vendors that can protect the data, requiring it in contracts, and reviewing them periodically
• a written incident response plan
• notifying the FTC within 30 days of a breach affecting 500 or more people (in force since May 2024)

Every AI tool is a service provider under this rule. The IRS publishes a free WISP template for small practices, Publication 5708 (IRS).

A practical checklist before you use an AI tool

1. Classify the data. Is it tax return information (§7216), other customer financial data (Safeguards Rule), or neither?
2. Read the vendor's terms. Do they train models on your data? Where is it stored and processed? Is it encrypted? Can you get a security report (SOC 2)?
3. Prefer business plans that contractually exclude your data from model training, over free consumer chatbots.
4. Get §7216 consent where return information goes to the tool, naming the purpose and the vendor, with a duration.
5. Add the tool to your WISP as a service provider, and note who can access it with MFA.
6. Redact by default. For drafting emails or explaining a rule, you rarely need names, SSNs or account numbers.

FAQ

Can I use ChatGPT to draft a client email?

Yes, if you keep identifiable tax return information out of it, or have consent that covers it. General drafting with no client data doesn't raise §7216 issues.

Does an engagement letter count as consent?

For clients who don't file a Form 1040-series return, consent can be in any written form, including an engagement letter, if it meets the content requirements. Form 1040 consents have additional IRS formatting requirements.

Do bookkeepers who don't prepare returns need to worry?

Section 7216 targets return preparers, but the Safeguards Rule's definition of financial institution is based on activities. If you handle customer financial data, assume you need a WISP and vendor oversight.

Comparing tools? See our guide to the best AI bookkeeping software.

Changelog: Oct 13, 2026: first published.