IRC 7216, Pub 4557, and AI Tax Tools (2026 Checklist)

Last verified 2026-10-15. Sourced facts only. Bench test pending

Educational only, not legal advice.

Short answer

Before any client return information goes into an AI tool, update the WISP (Pub 4557 / Pub 5708), decide which enterprise-approved tools are allowed, plan for written consent under IRC §7216 when disclosure rules may apply, and require human review of every AI output.

1. Why this matters now

CPA Practice Advisor (Oct 12, 2026) summarized IRS Office of Professional Responsibility OPR Alert 2026-19, issued June 24, 2026, which gives introductory guidelines for responsible AI use in federal tax practice. Per that summary:

Practitioners should handle client data using only secure, enterprise-approved AI, and avoid uploading sensitive information to unsecured or public systems.
The alert ties unauthorized disclosure to the civil and criminal penalties under IRC §§6713 and 7216.
Firm leaders with oversight duties under Circular 230 §10.36 need documented procedures for staff training, secure data handling, AI accuracy monitoring, and vetting of outside AI tools.
It also flags cross-client leakage (one client's data used to answer a question about another) as a privacy risk.

If your staff already use ChatGPT or Claude, start with our safe-workflow guide for general AI assistants, then use the checklist below to put it in writing.

2. Pub 4557 and the WISP

IRS Publication 4557 (Rev. 6-2024), Safeguarding Taxpayer Data, explains that under the FTC Safeguards Rule, tax return preparers must create and maintain a written information security plan (WISP). Publication 5708 (Rev. 8-2024) is the IRS/Security Summit sample WISP template for tax and accounting practices, and Publication 5709 (Rev. 5-2024) is a short overview of how to create one.

The Safeguards Rule material in these publications says firms should select service providers that can maintain appropriate safeguards. An AI vendor that receives client data fits that description, so treat it like any other service provider. In practice, update the WISP to cover:

Approved tools list: which AI products and which plans (consumer vs. business/enterprise tiers often carry different terms).
Retention and training settings: whether the vendor keeps prompts and files, for how long, and whether it trains on customer data. Get it in writing.
Access controls: who can use each tool, and how client data is kept separate across clients.
Incident response: what happens if client data goes into an unapproved tool.

3. IRC §7216 consent

Section 7216 requires a taxpayer's written consent before a preparer uses or discloses return information outside the regulatory exceptions. For Form 1040-series returns, Rev. Proc. 2013-14 sets out the required consent format.

The IRS has not definitively said whether sending return information to an AI tool counts as a disclosure to a third party. Until it does, the cautious approach CPA Practice Advisor describes is a standalone, signed AI consent worded with your counsel.

Consents must be knowing and voluntary. Conditioning your services on the consent generally makes it involuntary.
Keep a no-AI prep path for clients who decline, and flag those clients so staff know before they open the file.

4. One-page firm checklist

Approved tools and plans only. Client return information goes only into tools on the WISP list.
Redaction or enterprise retention settings. Strip identifiers, or use a plan with written no-training and retention terms.
7216 consent workflow. Standalone AI consent drafted with counsel, plus a no-AI path for clients who decline.
Usage log. Record which tool touched which client's data, and who reviewed the output.
Human review. Every AI output is reviewed before filing or client delivery.
Annual policy review. Name one owner for the policy and vendor file, and calendar the review date.

5. What TaxPrepBench does not claim

We have not litigated these questions or audited any firm's compliance, and we have not tested any vendor's security controls. This page summarizes public IRS publications and published commentary. It is educational, not legal advice. Talk to your counsel before adopting a consent form or policy.

Sources

The Friday Prep Brief

One email a week: new AI tax tools, pricing changes, and bench results. Five minutes, no hype.

Form not loading? Subscribe here →