AI Acceptable Use Policy for CPA Firms

Updated 2026-10-16. Educational only, not legal or tax advice. Every claim links to a source below.

Short answer: IRS OPR Alert 2026-19 (June 24, 2026) does not invent new duties. It maps generative AI onto Circular 230 and IRC §§6713 and 7216: human review of AI outputs, fair billing for AI efficiencies, technological competence, firm procedures, verified written advice, and only secure enterprise-approved tools for taxpayer data. Put that in a written acceptable-use policy, train staff, and treat AI text as drafts.

What OPR 2026-19 requires of firm leaders

The Office of Professional Responsibility's introductory guidelines walk through the Circular 230 sections that already govern AI use in federal tax practice:

• §10.22 Due diligence: thoroughly review AI-created documents before client delivery or IRS submission; verify facts, citations and calculations. Practitioners cannot rely solely on AI.
• §10.27 Fees: do not bill for time that was not spent. Pass AI efficiencies on openly; disclose AI activities as needed and credit cost reductions.
• §10.35 Competence: understand how the AI works, its limits (hallucinations, bias, opacity) and whether outputs are suitable for IRS matters.
• §10.36 Firm procedures: leaders with principal authority must ensure adequate procedures: staff training on AI risks, secure data-handling protocols, accuracy monitoring, and documented vetting of third-party AI tools.
• §10.37 Written advice: base advice on reasonable factual and legal assumptions; independently authenticate citations, forecasts and opaque model logic before clients see it.
• IRC §§6713 and 7216: civil and criminal penalties for unauthorized use or disclosure of return information. Use only secure, enterprise-approved AI; never upload sensitive data to unsecured or public systems. Circular 230 §10.51(a)(15) also prohibits willful unauthorized disclosure.

OPR also flags real-world sanctions for fabricated citations, and notes that client data generated for one matter can spill into answers about another. Those risks are why firm-level rules matter as much as individual judgment. Pair this alert with 7216 consent, your WISP, and a clear rule on general assistants and client data.

Policy sections checklist

Use these sections as a drafting checklist. They track OPR's best-practice recap and common firm governance patterns (for example, CPAI / Journal of Accountancy drafting guidance).

1. Approved tools: name each generative AI product and plan tier allowed for firm work (consumer vs business/enterprise). Require a written request path for new tools.
2. Prohibited inputs: ban SSNs, EINs, account numbers, full returns and other tax return information on unapproved or consumer plans. Default to redaction for general assistants.
3. Human review: every AI output that leaves the firm or enters a return is reviewed by a competent practitioner under §10.22. Treat AI text as drafts.
4. Billing: state how AI-assisted work is billed so §10.27 is not violated (no phantom hours; pass through real time savings).
5. Training: initial and periodic training on risks, hallucinations, data rules and escalation (§10.36).
6. Vendor vetting: before purchase, document security posture (SOC 2 where available), retention/training terms, data location and 7216 handling. Keep evidence in the WISP vendor file (Pub 4557 / Pub 5708).
7. Incident response: what to do if client data hits an unapproved tool, including who to notify and how it ties to your breach procedures.
8. Client disclosure / 7216: when identifiable return information must reach a third-party AI tool, get written consent that meets Treas. Reg. §301.7216-3 and, for Form 1040 clients, Rev. Proc. 2013-14 format rules. Keep a no-AI path for clients who decline.

Sample one-page outline (not a legal form)

This is an educational outline only. Have counsel adapt it to your engagement letters and state rules.

1. Purpose: generative AI supports, and never replaces, professional judgment under Circular 230.
2. Scope: all partners, staff and contractors using AI on firm devices or firm accounts.
3. Approved list: [tools and plan tiers]; personal accounts prohibited for firm work.
4. Data rules: no tax return information into general assistants without redaction and, where disclosure applies, signed 7216 consent naming the tool.
5. Review rule: AI drafts stay internal until a named reviewer verifies facts, citations and calculations.
6. Billing rule: time entries reflect actual human time; AI efficiency is disclosed and credited, not double-billed.
7. Logging: record tool, client (if any), purpose and reviewer in the workpapers.
8. Training & acknowledgement: annual training; signed acknowledgement kept with HR or compliance.
9. Incidents: report unapproved uploads within [X hours] to the AI lead / WISP owner.
10. Review cadence: policy owner reviews the approved list and vendor file at least annually, or when OPR/IRS guidance changes.

OPR's own best-practice list is short: know the law, secure data handling, document usage and verification, breach procedures, staff training, vet third parties, never upload sensitive data to unsecured sites, treat AI text as drafts, and check citations.

What this page is not

Not a form, not legal advice, and not a substitute for counsel or your state board rules. TaxPrepBench has not audited any firm's compliance. For tool-level security claims, read each vendor page and our tool reviews; examples of tax-specific products practitioners evaluate include Juno, Filed, Blue J and TaxGPT.

FAQ

Sources

1. irs.gov/pub/opr-taxpros/issue-number-2026-19-introductory-guidelines-for-responsible-ai-us
2. irs.gov/pub/irs-pdf/p4557.pdf
3. irs.gov/pub/irs-pdf/p5708.pdf
4. law.cornell.edu/uscode/text/26/7216
5. law.cornell.edu/uscode/text/26/6713
6. cpai.com/Education-Resources/My-Firm/Data-Security-Risk-Management/Drafting-an-AI-Policy-t