The IRS has now said how it expects tax practitioners to use AI. It has not said whether sending return data to an AI provider needs a 7216 consent. Here is what is settled, what is still open, and how to set up your firm so the open question can't hurt you.
The IRS Office of Professional Responsibility published introductory guidelines for AI in federal tax practice. It ties AI use to the Circular 230 duties you already have. In short:
The guidance never says whether sending return information to an AI provider requires the client's written consent under section 7216 and its regulations. It also never says that a "no training on your data" setting is enough.
That is why the debate keeps going. Some practitioners treat any AI provider as a disclosure that needs consent. Others treat it like any cloud software that processes returns. Your malpractice carrier and your state board may each have their own view.
That decision belongs to your firm and your attorney. What we do is make sure your systems hold up under either answer. If consent is required, your systems do exactly what the consent says. If it isn't, the provider never held your clients' data in the first place.
We are not lawyers. We build the controls your attorney, your insurer and your clients will ask about.
"Enterprise-approved" is the IRS's bar. Here is how the common options line up against it.
ChatGPT Free, Plus and Pro. Claude Free, Pro and Max. These are individual accounts: no admin controls, no business data terms, and retention your firm does not control.
ChatGPT Business or Enterprise, Claude Team or Enterprise. Admin controls, company accounts instead of personal ones, and no training on your data by default. The provider still keeps your data for a while: up to 30 days or longer, depending on the plan and settings.
We set it up and run it for you, together with your AI policy.
AI built into your workflow and run through a major cloud provider's AI service, set to zero data retention: no prompt or response is stored, and nothing is shared with the model's maker. The AI keeps nothing once a task is done.
We run this in production today for an accounting firm we manage.
Most of the debate is about what staff can safely paste into a chatbot. The systems we build don't work that way.
A smaller surface means a smaller risk, and an easier answer when someone asks where client data goes.
It helps, but it isn't zero retention, and the IRS hasn't said it's enough. Your data still sits with the provider for a period. If you want the provider to hold nothing, that takes a zero-retention setup.
Not automatically. Under the FTC Safeguards Rule your firm oversees its service providers, so their AI features and terms belong in your vendor review like everything else they touch.
That's a legal call for your attorney, and the IRS hasn't answered it yet. Some firms are choosing clear notice or consent to be safe. Whichever you choose, your systems should do exactly what your letter says.
No. Masking defeats the point: the AI needs the real names and numbers to do the work, like pulling them from an uploaded document into your system. What protects the client is that the AI keeps nothing once the task is done, and the data itself stays in your own systems, protected by multi-factor authentication.
No. Those are personal plans. They don't meet the "secure, enterprise-approved" bar, and the firm can't control or prove what happens to the data.
We review how your firm uses AI today, including the AI already built into your software, and leave you with a plan you can act on.
Tell us a little about your firm below, and we'll set up a time. Need a WISP first? Get our free standard one.
This page explains IT and compliance controls. It is not legal advice. For the 7216 question, ask your attorney.