An AI policy for an accounting firm: client data, the AICPA Code and IRC §7216

Most firms already have staff using AI. The usual route is a free chat tool opened in a browser, with a client's spreadsheet pasted in to save an hour. A written policy does not stop that on its own, but its absence guarantees every person decides alone. This article lists what a firm's AI policy should contain, and where each part meets a rule that a partner or head of quality should check against primary sources.

It is general education, not legal, tax or professional advice. The rules named here change, and this article has not been reviewed for your state or your clients. Treat it as a list of questions to take to your own counsel and your professional bodies.

1. Sort data into classes before naming any tool

The policy should start with data, because the permissions follow from it. A simple three-level scheme is easiest to use:

• Safe to use in any tool. Invented or properly anonymized data, and public information. Staff can practice freely here.
• Use only in approved tools. Internal firm material and client information that has had identifiers removed, in tools the firm has reviewed.
• Do not enter. Tax return information, client financial records with identifiers, credentials and anything a client contract or law restricts.

The point of the third class is that it is written as a list of examples. Staff should not need to decide whether something is sensitive at 4:50 on a deadline day.

2. Tax return information and IRC §7216

For firms that prepare returns, IRC §7216 and the regulations under it restrict how a preparer may use and disclose tax return information, and section 6713 adds civil penalties [verify]. Consent requirements exist for certain uses and disclosures. Whether sending return data to an AI provider counts as a disclosure depends on the tool, the contract and the facts, so the answer for your firm belongs to your counsel. The policy should, at a minimum, say who decides, and that return information is in the "do not enter" class until that person has decided in writing.

3. The AICPA Code: confidentiality, competence and responsibility

The AICPA Code of Professional Conduct is built on principles that apply directly to AI use. Confidential client information may not be disclosed without the client's consent or another permitted basis. Members are expected to maintain competence and to take responsibility for work they sign, including work an AI drafted. Your state board of accountancy may add its own rules. A policy should say that AI output is a draft and the person who signs is accountable for it, and that staff must understand a tool's limits well enough to review its results.

4. The FTC Safeguards Rule

Tax preparers and some other accounting practices are treated as financial institutions under the FTC Safeguards Rule, 16 CFR Part 314. It requires a written information security program, including risk assessment, access controls, vendor oversight and incident response. An AI tool that touches customer information is a service provider the program has to cover. Check the current text of the rule and any amendments, including any notification requirements [verify], rather than relying on a summary.

5. Approving a tool

For each tool the policy should ask for a short, repeatable review, recorded in a register. Typical questions:

• What data does the tool receive, and where is it stored?
• Does the provider use customer content to train its models? Get the answer from the contract, not the marketing page.
• Who at the provider can read the data, and for how long is it kept?
• What independent security report does the provider have, such as a SOC 2 report, and what does it cover?
• Can the firm export and delete its data?

The NIST Cybersecurity Framework 2.0 and the NIST AI Risk Management Framework are voluntary frameworks, not rules. They give a vocabulary many clients and insurers recognize, and a way to organize the review.

6. Review of AI output

The policy should say what review is needed before AI-assisted work reaches a client. Include these points:

• A named person reviews every deliverable that used AI.
• Figures are re-performed or tied to source, not accepted on the AI's say-so.
• Where the AI shows its working, the working is kept.
• Staff do not rely on the AI's statements of law or standards without checking the primary source.

Evidence for why this matters is easy to find. In recorded runs on invented books, an AI reviewer found 13 of 14 planted errors in a close memo and did not flag the fourteenth. A duplicate-payment finder called its output possible duplicates, and one pair differed in the invoice number. Each is one run. The lesson is that a firm needs a documented review step, because the failures are quiet.

7. Testing before and after any change

Tools change underneath you. The policy should require a test, with an answer key and a pass mark, before a tool is approved for a task, and a re-test whenever the model or prompt changes. A real re-test runs each check several times and includes real past cases. For any agent that can write to a record, test it against hostile input too, such as a hidden instruction in a vendor invoice, and do not give it write access to bank details.

8. Training, disclosure and ownership

Decide who is trained, how often and on what. Decide whether and how clients are told that AI is used on their work, and check your engagement letters. Name an owner of the policy and a review date. Add a short route for staff to report a mistake, such as the wrong data pasted into the wrong tool, without fear, because early reporting is what limits the damage.

Where to start

A one-page policy that sorts data, names the approved tools and requires a named reviewer is better than a long one nobody reads. Revise it after the first quarter of use.

A course for firms

Ledger & Agent's AI for Accounting Professionals covers these areas, including the AICPA Code applied to AI, IRC §7216, PCAOB evidence requirements and the NIST frameworks, across eight weekly 60-minute sessions with coursework, written feedback and a capstone plan. A firm can require every submission to use Northwind Supply Co., the course's fictional company, so no client records need to enter an AI tool through the coursework. The full program is $2,450 per seat, and for team training, including a private cohort, contact us. A security and privacy pack is available on request.

Ledger & Agent's first course is AI You Can Sign Off On, four Tuesdays from November 17 to December 8, 2026. Each week brings one 60-minute live session, recorded and posted within 24 hours, about one to two hours of coursework, and written feedback that an AI drafts and a person reviews. By December 14 you hand in one workflow redesigned with AI, with its checks and controls, run on the Northwind books. It is a practical first step for a firm: several people can each redesign one workflow and bring the results to the partners.

Request a place in the November course

---

General education, not legal, tax, audit or security advice. Confirm the rules (AICPA Code, IRC §7216, FTC Safeguards Rule, NIST frameworks, auditing standards) against current primary sources before you rely on them. Northwind Supply Co. is a fictional company and all of its data is invented for teaching.