How tax preparers can use AI audit logs for Safeguards Rule monitoring

Does the Safeguards Rule require tax preparers to log AI use?

Not by name, but the logging duty reaches it, which is why AI audit logs belong in your program. The rule treats "an accountant or other tax preparation service that is in the business of completing income tax returns" as a financial institution under 16 CFR 314.2(h)(2)(viii). Paragraph (c)(8) of 16 CFR 314.4 then requires it to "implement policies, procedures, and controls designed to monitor and log the activity of authorized users and detect unauthorized access or use of, or tampering with, customer information by such users."

Two definitions pull AI tools in. An authorized user is any employee, contractor, agent or other person authorized to access your information systems or data. An information system is a set of electronic resources used to collect, process, maintain, use or share customer information. When a staff accountant pastes a client's W-2 details into an AI assistant, that assistant is processing customer information, and the activity belongs in your logging. The small-firm exception in 16 CFR 314.6, for institutions holding customer information on fewer than 5,000 consumers, does not include paragraph (c)(8). Logging applies at every size.

What should an AI audit log capture?

Enough of an audit trail to answer who sent which client data to which tool, and when. At minimum, look for:

• A named user for every event. Shared logins make the log useless as evidence.
• Time, tool and workspace for each prompt, upload and output.
• Prompt and file content, or at least file names and data types, so you can tell whether taxpayer identifiers were involved.
• Data loss prevention events: what was blocked, what was allowed with a warning, and who overrode a warning.
• Admin changes, such as new connectors, sharing settings, retention changes and new users.

Before approving an AI tool, check whether the plan provides an admin audit log or a compliance export. Personal AI accounts the firm cannot see into leave nothing to review, which is a practical reason to standardize on business plans and block personal accounts on firm devices. The same check applies to AI features built into tax and practice management software: ask the vendor what activity it records and how you get it.

How do AI logs fit the rule's testing and monitoring requirement?

They support it without replacing it. 16 CFR 314.4(d)(2) requires either continuous monitoring or annual penetration testing plus vulnerability assessments at least every six months. That requirement is aimed at detecting changes in your systems that create vulnerabilities. AI audit logs answer a different question: what authorized people are doing with client data.

Treat AI logs as evidence for paragraph (c)(8) and as input to paragraph (g), which requires you to evaluate and adjust the program in light of what testing and monitoring show. If logs reveal that staff keep uploading full returns to a tool meant for research questions, that finding should change your training, your DLP rules or your approved tool list. Firms under the 5,000-consumer threshold are exempt from (d)(2), but not from (c)(8) or (g).

Who reviews the logs, and how often?

The rule does not set a frequency, so the Qualified Individual should set one in writing. Paragraph (a) of 314.4 requires every covered firm to designate a Qualified Individual to oversee and implement its information security program, and a log nobody reads does little to "detect" anything.

A workable pattern for a small practice: automated alerts for DLP blocks and for uploads of identifier-rich files, reviewed as they arrive; a sample of activity reviewed weekly during filing season and monthly the rest of the year; and a short record of each review with the date, reviewer and findings. Firms above the 5,000-consumer threshold can summarize those reviews in the annual written report to the board or a senior officer that paragraph (i) requires.

What if a log shows client data went somewhere it should not?

Follow your incident response process and assess whether the information was acquired without authorization. (A written incident response plan is required for firms holding information on 5,000 or more consumers.) A "notification event" under 16 CFR 314.2(m) is the acquisition of unencrypted customer information without the authorization of the individual it pertains to. If one involves at least 500 consumers, 16 CFR 314.4(j) requires notice to the FTC as soon as possible and no later than 30 days after discovery.

Other rules may apply to the same facts. Section 7216 of the Internal Revenue Code and its regulations restrict how preparers disclose tax return information, which bears on which AI vendors may receive it at all. California Civil Code 1798.82 sets breach notice requirements for California residents. Work through the facts with counsel. A complete log is what lets you answer their questions quickly.

What should you set up before the 2027 filing season?

Most of this is configuration and paperwork, and it is easier to finish before the busy season starts:

• Inventory AI tools. List every AI tool staff use with client data, including features built into tax and practice software.
• Standardize on business plans. Move staff to plans with audit logs and contract terms that limit model training and retention, and block personal accounts on firm devices.
• Turn logging on and keep it. Confirm audit logging is enabled, set retention long enough to cover a full filing season and your review cycle, and protect logs from editing.
• Connect DLP. Write rules for Social Security numbers, EINs and bank account numbers in prompts and uploads, and send their alerts to the reviewer.
• Name the reviewer and the cadence. Put the schedule in writing and keep a record of every review.
• Update the WISP. Add AI tools, logging and review to your written information security plan, using IRS Publication 5708 as a template, and treat each AI vendor as a service provider you oversee under 314.4(f).

How does s90 help?

s90 sets up AI guardrails and data loss prevention for tax and accounting practices: approved AI tools, blocked personal accounts, DLP rules for taxpayer identifiers, and activity logs reviewed on a schedule. The result is evidence your Qualified Individual can point to in the WISP and the annual report. For the rest of the rule, see our FTC Safeguards Rule checklist for tax preparers. If you want a second look at your AI logging before filing season, talk with our team.