What should a CPA engagement letter say about AI use?

Should a CPA engagement letter mention AI?

Yes, if any AI tool the firm uses receives confidential client information. The engagement letter is where a CPA firm already tells clients how their information will be handled, and the AICPA rules on third-party service providers expect the client to hear about those providers before confidential information leaves the firm. An AI tool that receives client data is usually one of them. If the letter is silent, the firm is relying on notice it never gave.

Clients now ask whether their return or financial statements will be run through AI, and some arrive with their own policies on the subject. A short, accurate AI section answers that question once, in writing, at the start of the engagement, which is easier than answering it client by client in the middle of busy season. It also forces the firm to know which tools actually touch client data, which is the harder part of the work.

What do the AICPA rules require before client data reaches an AI vendor?

The AICPA Code expects two things before confidential client information reaches a third-party service provider such as an AI vendor: notice to the client, and either a confidentiality contract backed by reasonable assurance or the client's specific consent. The notice comes from ET 1.150.040, Use of a Third-Party Service Provider, which calls for the member to inform the client, preferably in writing, before disclosing confidential client information to the provider. The Journal of Accountancy notes that this disclosure may be made through a provision in the client engagement letter.

The second, ET 1.700.040, sits under the Confidential Client Information Rule. Before disclosing confidential client information to a third-party service provider, the member either enters into a contract requiring the provider to keep the information confidential and obtains reasonable assurance that the provider has appropriate procedures in place, or obtains specific consent from the client. Notice in the engagement letter addresses the first interpretation. The vendor contract and the firm's due diligence address the second.

For tax work, the revised Statements on Standards for Tax Services, effective January 1, 2024, added standards on data protection and on reliance on tools, including technology. An AI tool is a tool. The standards leave engagement letter wording to the firm. They do make the firm's handling of client data and its review of tool output part of the professional standard it will be measured against.

Can a CPA engagement letter double as Section 7216 consent?

No, a clause inside the engagement letter is not a valid Section 7216 consent, though a separate signed consent form can be attached to the letter. Section 7216 makes it a misdemeanor for a tax return preparer to knowingly or recklessly disclose or use tax return information outside the permitted purposes, and the regulations define disclosure as making the information known to any person in any manner whatever. Section 6713 adds a civil penalty of $250 per improper disclosure or use, up to $10,000 per calendar year.

The regulations under 301.7216-2 permit some disclosures without consent, including to contractors who program, maintain, test or supply the software and equipment used to prepare returns, and only to the extent necessary for their contracted services. Uses outside those exceptions need the taxpayer's signed written consent before the disclosure. For Form 1040 filers, Rev. Proc. 2013-14 sets the format: the consent must be on a separate written document, paper or electronic, and it may be provided as an attachment to an engagement letter. It must include mandatory statements, including that the taxpayer is not required to sign to engage the firm's tax return preparation services, and it defaults to one year from signature if no duration is stated.

So for Form 1040 clients, the engagement letter can deliver a 7216 consent as an attachment, but a sentence buried in the terms cannot be one. Whether a given AI feature falls inside an exception is a question for tax counsel, and the answer can differ by vendor and by how the vendor uses the data.

What does California add for CPA firms licensed here?

California adds a written-permission rule, including a specific one for client data that may leave the United States. California Board of Accountancy regulations at 16 CCR 54.1 prohibit a licensee from disclosing confidential client information without the written permission of the client, subject to listed exceptions such as subpoenas, regulatory inquiries, peer review, and disclosures required by law. The listed exceptions do not name service providers. Section 54.1(b) adds that if confidential client information may be disclosed to persons or entities outside the United States in connection with the services, the licensee must inform the client in writing and obtain the client's written permission.

That second point matters for AI. Many AI services process or store data in more than one country, and the vendor's terms do not always say where. A California firm that cannot confirm U.S.-only processing has a reason to address it in writing before the engagement starts, and to ask counsel how its existing vendor arrangements fit the rule.

What should the AI section of a CPA engagement letter include?

The AI section should describe what the firm actually does, in plain language a client can check against reality. A workable section covers the following points:

• Which categories of AI tools the firm uses on client work, such as features built into licensed tax and audit software or a firm-managed AI assistant, and which it prohibits, such as personal or free consumer accounts.
• What client information those tools may receive, and what is excluded.
• That approved vendors are bound by confidentiality terms, that the firm has reviewed their data retention and model training terms, and whether client data may be used to train vendor models.
• Where the data is processed, and whether any processing may occur outside the United States.
• That a qualified member of the firm reviews AI output before it is relied on, and that the firm remains responsible for the work.
• How the client can opt out or set limits, and what that means for timing or fees.
• That any use requiring Section 7216 consent will be covered by a separate consent form, attached and signed before the disclosure.

Each statement should be one the firm can prove with a tool inventory, vendor contracts, and review records. A promise the firm cannot evidence is a liability the day a client asks for proof.

What should stay out of the engagement letter?

Vague reassurance and anything that will go stale should stay out. Phrases like "industry-leading AI security" say nothing a client can rely on. Naming specific products in the letter means a new letter each time a vendor changes, so most firms describe categories in the letter and keep the current list in a schedule or on request.

The letter also should not try to carry the firm's whole AI program. The FTC Safeguards Rule treats tax preparers as financial institutions, and 16 CFR 314.4(f) requires them to oversee service providers through selection, contract terms, and periodic assessment. Under SQMS No. 1, technological resources are part of the firm's system of quality management. Client notice in an engagement letter sits on top of those obligations and does not replace any of them.

What should a CPA firm do before engagement letters go out?

Update the engagement letter template now, starting from an inventory of the AI tools that touch client data. Most engagement letters for the 2027 filing season go out in the next few months. A practical sequence:

• Inventory every AI tool and AI feature that touches client data, including features added to software the firm already licenses. Our guide to evaluating AI add-ons in tax software covers what to check.
• For each tool, record the vendor contract, confidentiality terms, retention and training terms, and processing location.
• Draft the AI section from that inventory, and have counsel review it alongside the firm's Section 7216 consent forms.
• Decide how the firm will handle a client who declines AI use, and tell staff.
• Add the AI tool list to the firm's WISP and its SQMS No. 1 documentation, and confirm the technical controls match the letter, such as blocking unapproved AI services on firm devices.

How does s90 help?

s90 helps CPA firms in Los Angeles and Orange County build the evidence behind the letter. We inventory the AI tools and features in use, configure controls that keep client data in approved tools, and document vendor reviews so the firm's engagement letter, WISP, and day-to-day practice say the same thing. If that would be useful before engagement letters go out, we are glad to talk it through.