Key takeaways
- ChatGPT and similar tools belong on a firm-managed business account, never a free or personal one, when client work is involved.
- Pasting tax return information into a public AI tool can be a disclosure under Section 7216.
- A knowing or reckless Section 7216 violation is a misdemeanor, and Section 6713 adds civil penalties of $250 per disclosure.
- Tax preparers are financial institutions under the FTC Safeguards Rule, which requires access controls, user monitoring and service provider oversight.
- Endpoint DLP can block pastes and uploads of SSNs and bank numbers to public AI sites while allowing an approved tool.
- Give staff an approved AI tool before blocking the rest, and write the rule into the WISP.
ChatGPT for accountants has become an everyday shortcut. A preparer pastes a W-2 to check a figure or uploads a K-1 to summarize it, and if that account is free or personal, the firm has just handed client tax return information to a third party it has no contract with.
Why is pasting a client return into a public AI tool a problem?
Because tax return information is protected by federal law, and a public AI tool is a third party. Under 26 CFR 301.7216-1, a disclosure is "the act of making tax return information known to any person in any manner whatever," and tax return information includes anything furnished in connection with preparing a return.
The penalties run on two tracks. A knowing or reckless violation of Section 7216 is a misdemeanor punishable by up to one year in prison and a fine of up to $1,000. Separately, 26 U.S.C. 6713 imposes a civil penalty of $250 for each improper disclosure or use, up to $10,000 per calendar year, with higher amounts when the disclosure is connected to identity theft.
The regulations include exceptions and a written taxpayer consent process, often called 7216 consent. Whether a particular AI vendor fits one of them is a question for your counsel. A free consumer chatbot that an employee signed up for with a personal email address is a long way from any of them.
Does the FTC Safeguards Rule apply here too?
Yes. The FTC treats tax preparation firms as financial institutions under 16 CFR 314.2(h)(2)(viii), so the Safeguards Rule's program requirements apply. Section 314.4 requires access controls, monitoring of authorized users' activity, and oversight of service providers, including contract terms that require them to protect customer information.
The IRS has been direct about the planning side. In IR-2026-92, the IRS and Security Summit partners reminded tax professionals that federal law requires a written information security plan. An AI tool staff use with client data belongs in that plan.
Your PTIN renewal already asks whether you have a WISP. Make sure that answer is true before staff start using AI with client files.
Can accountants use ChatGPT with client data?
Only through a firm-managed business account, and even then with client identifiers removed where the task allows. Free chatbot accounts, paid personal subscriptions, browser extensions that read page content and AI features in apps staff installed on their own are all public AI tools: the firm has no contract, no admin access and no logs for any of them. Security teams call this shadow AI.
A firm-managed business account is different. The firm signs the agreement, controls who has access through single sign-on, and can review the vendor's data handling terms before anyone uses it with client files. That is the account staff should use for everyday work, such as drafting engagement letters, summarizing new guidance or cleaning up a workpaper narrative, with client identifiers removed.
How does data loss prevention stop the paste?
Endpoint DLP inspects content at the moment it is pasted or uploaded in the browser and applies a rule. Microsoft Purview, which many firms already license through Microsoft 365, documents a paste-to-browser control that classifies content when it is pasted and can audit, block with override, or block outright. It works in Edge, Chrome, Firefox and Safari, with an extension required for Chrome and Firefox on Windows.
Rules are scoped to named groups of websites. A typical setup puts known public AI sites in one group with a hard block, and the firm's approved tool in another group with audit only. The rule triggers on built-in sensitive information types such as U.S. Social Security numbers, individual taxpayer identification numbers and bank account numbers. Check whether your DLP tool includes an EIN type. If it does not, add a custom pattern for the nine-digit format.
Uploads need their own rule. A preparer who drags a scanned 1099 into a chat window is uploading a file, so set the same block for file uploads to the public AI site group.
Will blocking AI sites slow the firm down during busy season?
Less than a cleanup would. Give staff an approved tool first, then block the rest, so nobody loses a working shortcut in February. DNS and URL filtering by category can block most public AI sites at once while allowing the firm's approved tenant.
The CIS Controls v8.1 safeguards map the order well. DNS filtering (9.2) sits in Implementation Group 1, URL filtering (9.3) and browser extension restrictions (9.4) in Group 2, and data loss prevention (3.13) in Group 3. Most small firms can get far with filtering and add DLP as the control that inspects what reaches the approved tool.
What should a CPA firm do before the 2027 filing season?
- Choose one approved AI tool on a business plan and connect it to your Microsoft 365 or Google sign-in with MFA.
- Inventory what staff use today. Sign-in logs and expense reports usually show the AI subscriptions already in the office.
- Block public AI categories and personal sign-ups with DNS or web filtering on every firm device, including laptops that leave the office.
- Finish the workstation hardening steps for the 2027 season so the filtering and DLP agents run on a patched, managed device.
- Turn on paste and upload DLP for SSNs, ITINs, bank account numbers and a custom EIN pattern. Run it in audit mode for two weeks, review the hits, then switch the public AI group to block.
- Add an AI section to your WISP. IRS Publication 5708 gives a template structure, and Publication 4557 covers the baseline safeguards.
- Train every preparer, seasonal hire and intern on the rule before they get access to client files, and keep signed acknowledgments.
- Review DLP reports monthly during the season and record what you blocked and why.
How s90 helps
s90 sets up DLP and AI guardrails for CPA firms and tax practices: an approved AI tool tied to your sign-in, blocks on public AI sites, paste and upload rules for SSNs and bank numbers, and a WISP section that matches what is actually enforced. Our agreements commit to 72-hour breach notification and 24-hour evidence production. If you want to know which AI tools your staff already use, we can start there before the season begins.
