WISP for Tax Preparers: Requirements and AI Tools
Updated 2026-10-15. Educational only, not legal or tax advice. Every claim links to a source below.
Short answer: under the Gramm-Leach-Bliley Act and the FTC Safeguards Rule, tax preparers must keep a written information security plan (WISP). IRS Publication 5708 is a free template built for tax and accounting practices.
Who needs a WISP
IRS Pub 5708 explains that the FTC's Safeguards Rule, which implements GLBA, applies to tax return preparers. A central requirement is implementing and maintaining a WISP that is written and accessible.
Pub 5708 also notes there is no one-size-fits-all plan: a sole practitioner can use a shorter plan than a 10-partner firm.
What the plan must include
- Risk assessment: identify and assess risks to customer information in each area of the practice and evaluate your safeguards (Pub 5708).
- Breach reporting: report a security event affecting 500 or more people to the FTC as soon as possible, and no later than 30 days after discovery (Pub 5708).
- Multi-factor authentication: for anyone accessing customer information (Pub 4557 and the Safeguards Rule).
- Staff acknowledgement: Pub 5708 includes a sample Employee/Contractor Acknowledgement and a list of employees authorized to access PII.
Adding AI tools to your WISP
- Approved-tools list: name each AI tool and the plan tier you use, for example ChatGPT Business or Claude Team.
- Data rules: state what data may go into each tool. Redact by default.
- Vendor evidence: keep each vendor's SOC 2 report or security page on file. Many AI tax tools list SOC 2 Type II, including Blue J, Filed, TaxDome and Soraban.
- Consent: link to your 7216 consent process for tools that see real return data.
FAQ
Is a WISP required for tax preparers?
Yes. IRS Pub 5708 explains that the FTC Safeguards Rule requires tax return preparers to implement and maintain a written information security plan.
Where can I get a free WISP template?
IRS Publication 5708, "Creating a Written Information Security Plan for your Tax & Accounting Practice", includes a sample plan and attachments.
Do I need to list AI tools in my WISP?
The rule requires assessing risks to customer information wherever it is handled. If AI tools touch client data, documenting them and their safeguards is the practical way to meet that.
Sources
The Friday Prep Brief
One email a week: new AI tax tools, pricing changes, and what practitioners report. Five minutes, no hype.