Key takeaways
- Treasury regulations treat an employee who assists in preparing returns as a tax return preparer under Section 7216, with no distinction for seasonal work.
- Section 6713 sets a $250 civil penalty per improper disclosure, capped at $10,000 per calendar year.
- IRS Publication 5708 says new employees are trained before PII access and terminated employees' logins are disabled at termination.
- The FTC Safeguards Rule requires access limited to the customer information each person needs.
- An AI policy for accounting firms holds up through busy season when every seasonal account gets an end date at creation.
Why are seasonal staff and interns the hardest part of an AI policy?
They arrive at the busiest point of the year, they often already use AI tools from school or other jobs, and they leave before the policy becomes habit. A seasonal preparer hired in January may get a laptop, a login and a stack of returns in the same week. If the AI rules are a separate memo handed out in July, that person never sees them. Interns add another wrinkle: many are used to free AI accounts and to working on personal laptops.
The fix is to write the AI rules into onboarding, access and offboarding, the three steps every temporary hire already passes through. That is what lets an AI policy for accounting firms hold up through busy season.
Do the confidentiality rules apply to temporary staff?
Yes. Under 26 CFR 301.7216-1(b)(2)(i)(D), an employee who performs services that assist in preparing returns as part of the job is a tax return preparer for Section 7216 purposes, and the regulation does not distinguish by hours or season. Section 7216 makes a knowing or reckless disclosure or use of tax return information for other purposes a misdemeanor punishable by up to one year in prison and a fine of up to $1,000. Section 6713 adds a civil penalty of $250 per improper disclosure or use, capped at $10,000 per calendar year.
The FTC Safeguards Rule lists tax preparation services as covered financial institutions in 16 CFR 314.2(h)(2)(viii). Section 314.4 requires access controls that limit users to the customer information they need, security awareness training for personnel, and oversight of service providers. The IRS sample WISP in Publication 5708 says new employees will be trained before access to PII is granted, includes temporary and contract employees with PII access in annual training, and says terminated employees' logins will be disabled at the time of termination. In August 2026 the IRS and Security Summit reminded tax professionals that federal law requires a written information security plan.
The AICPA Code adds a step for AI vendors. Under ET 1.700.040, before a member discloses confidential client information to a third-party service provider, the member either has a contract requiring confidentiality and reasonable assurance of the provider's procedures, or obtains specific client consent.
What should the AI policy say for seasonal staff and interns?
The same rules as full-time staff, written so a new hire can read them in five minutes on day one:
- Firm AI accounts only. Use the approved AI tool through your firm login. No personal AI accounts for firm work, on any device.
- No client data in other AI tools. Never paste or upload returns, source documents, Social Security numbers, EINs or bank numbers into an AI tool that is not on the approved list. (Why client tax documents stay out of public AI.)
- No client data on personal devices. Publication 5708's sample language says no client PII can be stored on personal employee devices.
- Review the output. AI output on a return or workpaper gets the same preparer and reviewer checks as any other work.
- Report mistakes the same day. If client data goes somewhere it should not, tell the named contact right away. Early reports make the response simpler.
- Access ends with the engagement. Firm accounts, AI tool access and chat history stay with the firm when the season ends.
How do you build the AI rules into onboarding?
Make AI training and acknowledgment a gate before system access, the same way Publication 5708 treats PII training. A workable onboarding sequence:
- Create the firm account and set its end date on the day it is created.
- Enroll multifactor authentication before the first sign-in to tax software or the client portal.
- Deliver short training on the AI rules, phishing and how to report a problem.
- Collect a signed acknowledgment of the WISP and the AI rules.
- Assign the approved AI tool license only to roles that need it, and only after steps 1 to 4.
- Grant access to client folders by role, rather than copying a full-time preparer's permissions.
Interns who work only on internal projects may not need client data access or an AI license at all. Decide that at hire, and write the decision on the onboarding record.
How do you stop personal AI accounts and personal devices?
Back the written rules with controls on firm systems:
- Block personal accounts on firm devices. Tenant restrictions block personal Microsoft accounts and outside tenants for Microsoft services such as Copilot; for other AI services, use web filtering and the vendor's workspace controls so only the firm account works.
- Turn on browser DLP rules that detect Social Security numbers, ITINs, EINs and bank account numbers, and block paste and upload to unapproved AI sites. Check licensing first: as of October 2026, Microsoft lists Endpoint DLP under Microsoft 365 E5 and Purview add-ons, and does not list it for Business Premium.
- Keep client files in the firm's portal and document system, and use Conditional Access to require a compliant firm device for those apps, so a personal laptop cannot open them.
- Alert on new AI app sign-ups that use firm email addresses, which often come from new hires testing tools they used elsewhere. Sign-in and spend data show where shadow AI is already in use.
How do you end access when the season ends?
Disable the account on the last day, then remove the AI license and review the season's activity. Publication 5708's model language disables terminated employees' logins at the time of termination. For AI tools, also:
- Remove the user from the AI workspace so the seat and chat history return to firm control.
- Review the user's AI and DLP activity for the season and file a short summary with the WISP records.
- Collect firm devices and confirm no client files were synced to personal storage.
- Note what went wrong or right for next season's onboarding.
If the end date was set when the account was created, the account turns off even if the offboarding checklist slips during the April rush.
What should your firm do before the 2027 filing season?
- Add an AI section to the WISP and a one-page AI rule sheet for new hires.
- Pick the approved AI tool and confirm the vendor contract meets ET 1.700.040.
- Build the onboarding gate: account, MFA, training, acknowledgment, then access.
- Set end dates on every seasonal and intern account at creation.
- Turn on personal-account blocking and browser DLP in audit mode, then move to block.
- Write the offboarding checklist, including removal from the AI workspace.
How s90 helps
s90 builds seasonal onboarding and offboarding into Microsoft 365 for CPA firms: accounts with end dates, MFA, access by role, approved AI workspace licensing, tenant restrictions and DLP. We keep the records that show your WISP is followed, season after season. If you want your seasonal setup ready before busy season, start with a short planning call.
