How to Answer a Client Who Asks Whether You Use AI on Their Return

Why does the answer to "do you use AI on my return?" matter so much?

Because the question is really about who else sees the client's Social Security number, income and bank details, and federal law already sets rules for that. A vague or inaccurate answer can damage trust, and an AI use that discloses return information without a valid basis carries penalties for the preparer.

Section 7216 of the Internal Revenue Code makes it a misdemeanor for a tax return preparer to knowingly or recklessly disclose or use tax return information for any purpose other than preparing the return, punishable by up to one year in prison and a fine of up to $1,000. Section 6713 adds a civil penalty of $250 per improper disclosure or use, up to $10,000 a year. The regulations define disclosure broadly: making tax return information known to any person in any manner whatever.

Your firm also falls under the FTC Safeguards Rule, which lists tax preparation services as covered financial institutions and requires oversight of service providers that receive customer information. An AI vendor is one of those providers. Our FTC Safeguards Rule checklist for tax preparers covers the rest of the rule.

When does an AI tool count as a disclosure under Section 7216?

It depends on where the data goes and what the recipient does with it, which is why the answer has to be tool by tool. The regulations allow some disclosures without client consent and require written consent for the rest.

Under 26 CFR 301.7216-2(d), a preparer may share return information with another preparer located in the United States for help preparing the return, so long as the help does not involve substantive determinations or advice affecting the tax liability. A preparer may also share it with contractors who program, maintain, repair, test or procure the software or equipment used for return preparation, only to the extent necessary, and only after giving them written notice that sections 6713 and 7216 apply to them. The regulations' own example says disclosing to a contractor outside the United States requires the taxpayer's consent.

A public chatbot account an employee signed up for does not fit neatly into any of these categories. An AI feature built into your tax software, governed by your vendor contract, may. Where each tool lands is a legal question for your firm and its counsel, and the answer you give the client should reflect that review.

What does a valid client consent have to include?

A consent must be knowing, voluntary, signed and dated by the taxpayer, and specific about the information, the purpose and the recipient. Under 26 CFR 301.7216-3, you generally cannot make tax preparation services conditional on signing, and you must have consent before disclosing to a preparer outside the United States. A Form 1040 filer's Social Security number cannot go to a preparer abroad unless the disclosure meets IRS-defined data protection safeguards.

For individual returns, Rev. Proc. 2013-14 sets the format:

• Each consent is a separate document, on paper or electronically, with paper consents in at least 12-point type.
• The consent must include mandatory statements in a set order, including that federal law requires the form, that the client is not required to sign to get return preparation services, and how to report misuse to the Treasury Inspector General for Tax Administration.
• The client must opt in. Pre-checked boxes and blanks filled in later do not qualify.
• If the consent does not state a duration, it lasts one year from the signature date.

What does the AICPA Code add for CPA firms?

It adds a confidentiality step before any client information reaches a third-party service provider. ET section 1.700.040 requires the member either to have a contract requiring the provider to keep the information confidential and reasonable assurance that the provider has appropriate procedures, or to obtain specific consent from the client. For an AI vendor, that points to a reviewed business contract with confidentiality terms.

What should the answer to the client actually say?

Keep it short, in writing and accurate on five points:

• Which AI tools the firm uses on return work, named, and that staff may not use personal or public AI accounts with client data.
• Where the data goes: inside your licensed tax or document software, or to a separate vendor, and whether any processing happens outside the United States.
• Whether the vendor may retain the data or use it to train its models, based on the contract you reviewed.
• Who reviews the output. A credentialed preparer remains responsible for every number on the return.
• Whether the client will be asked to sign a Section 7216 consent, and what happens if they decline.

One option is a one-page AI statement that goes out with the engagement letter, so the question is answered before it is asked. Whatever format you choose, make sure it matches what staff actually do. A promise you cannot back up with logs and settings becomes a liability of its own.

How do you make sure the answer stays true during busy season?

Enforce it with technical controls, and write it into the plan the IRS already expects you to keep. The IRS and Security Summit partners stated in IR-2026-92 that federal law requires tax professionals to maintain a written information security plan, and your AI rules belong in it. See how to update your WISP before the 2027 filing season.

Practical controls include limiting staff to firm-managed AI accounts, blocking personal AI sign-ins on firm devices, and turning on data loss prevention that stops Social Security numbers, EINs and bank account numbers from being pasted or uploaded into unapproved AI sites. Microsoft documents a Purview DLP policy for unmanaged AI apps in Edge for Business that can block both.

What should you do this quarter?

Finish this before filing season opens:

1. List every AI tool and AI feature that touches return data, including features vendors switched on inside your tax, document and portal software.
2. Collect each vendor's terms on retention, model training, human review and data location.
3. Review each use with counsel against the Section 7216 exceptions, and prepare Rev. Proc. 2013-14 consent forms for any use that needs one.
4. Confirm AICPA third-party provider requirements are met for each vendor.
5. Write the AI section of your WISP and train staff, including seasonal hires, before they get system access.
6. Draft the one-page client AI statement and have a partner approve it.

How does s90 help?

s90 works with CPA and tax firms to put the controls behind that client answer in place: AI guardrails that limit staff to approved tools, DLP that keeps tax documents out of public AI, and WISP documentation that reflects how the firm actually works. If a client question about AI caught your team off guard this year, we can help you prepare a clear answer before the next one arrives.