An AI Use Policy for a Tax Practice: What to Put in It

Gather the Firm's existing AI-use decisions from emails, account settings, and review notes. Put them in one policy a new hire can read.

A written AI use policy turns those habits into decisions the Firm made and can point to. It can be short as long as it's specific.

Below, each section is split into what to decide and what to write down. Every line is a choice the Firm makes. Where a section touches the Firm's data security plan or its §7216 review, have the Firm's own counsel or compliance lead confirm it before the policy is adopted.

Approved tools and accounts

What to decide. Which AI tools staff may use for Firm work, and under which account. Name the account, not just the product. Read the vendor's current terms for that account before it goes on the list. For how two vendors describe their account terms, see the account terms comparison.

What to write down. One line per approved tool: the tool, the account, its administrator, and the date the Firm last read the terms. Then one more line: a tool not on the list isn't approved for Firm work until it's added through the policy's new-tool steps.

Client data rules

What to decide. For each approved tool, what client data may go into it, and what goes into no tool at all. Go item by item: identification numbers, source documents, bank and payroll records, prior returns, call notes.

What to write down. A table with data types down the side and approved tools across the top, each cell marked allowed or not allowed. Below it, the data that goes into no AI tool on any account. Say whether staff remove identifiers before an upload, and how. Say what a staff member does on realizing data went somewhere the table doesn't allow, and whom they tell.

Who uses what, for which tasks

What to decide. Which roles may use which tool for which jobs. Decide which tasks the Firm relies on a tool's draft for at all, and which stay fully by hand.

What to write down. A grid of role, tool, and task allowed. Name any task kept off the grid on purpose, and who can approve an exception.

Review and sign-off for AI-drafted work

What to decide. How work an AI tool drafted gets checked before it reaches a workpaper, and who does each check.

What to write down. First, the Preparer checks each AI-drafted row, figure or sentence against the source page it cites and marks it confirmed, wrong, or a question. Second, nothing AI-drafted goes into the workpaper before that check. Third, the Reviewer reads back the checked work and signs off on the workpaper.

Spell out the readback as well. The Reviewer picks entries, opens each cited source page, confirms the entry matches the page, and records what was read and what turned up. The Firm decides how many entries that takes. The Reviewer readback post covers the readback, and for reviewers the Reviewer's role.

Records

What to decide. Where AI drafts, the instructions given to the tool, and its outputs are saved, and whether anything kept only inside a tool's own history counts as the Firm's record.

What to write down. The folder or system for each saved item, the naming convention that ties it to the client and the workpaper, and who saves it. Have the workpaper note which tool drafted each part.

Tie-in to the data security plan

An IRS tax tip on data security plans, Tax Tip 2019-174 dated December 11, 2019 (as read on October 16, 2026), points preparers to Publication 4557, Safeguarding Taxpayer Data, and lists this among the things that publication helps preparers to do: "Follow the Federal Trade Commission's Safeguards Rule." The same tax tip says: "These items are required when writing and following a data security plan: Pick one or more employees to coordinate the information security program." This piece quotes that one item of the eight the tip lists, and doesn't check whether the tip or the publication has been updated since. Leave the reading of the Safeguards Rule to the Firm's counsel or compliance lead.

What to decide. Whether the AI policy sits inside the data security plan, beside it, or as an attachment, and whether the employees the plan picks to coordinate the information security program also own the approved tool list.

What to write down. The Firm decides how to cross-reference the two documents, where to record its coordinators' names, and where to file counsel's or the compliance lead's confirmation of how the documents fit.

The Firm's §7216 review

The IRS Section 7216 Information Center, as read on October 16, 2026, opens by describing final Treasury Regulations "on rules and consent requirements relating to the disclosure or use of tax return information by tax return preparers" that "became effective Dec. 28, 2012." Under a heading for one revision, "Revision to Section 301.7216-2 Guidance", it describes that guidance this way: "These final and temporary regulations provide updated guidance regarding the disclosure and use of tax return information by tax return preparers without taxpayer consent." This piece doesn't say what those regulations require, permit or prohibit for any AI use. That reading belongs to the Firm's counsel or compliance lead.

What to decide. Whether the Firm's own §7216 review has looked at each tool and task on the grid, and who carries it out.

What to write down. For each tool and task, a line showing that counsel or the compliance lead reviewed it, their conclusion in their own words, and where it's filed. Mark a use approved only where that written conclusion allows it, and any use still waiting on the review as not approved.

Owner, re-reads, and adding a new tool

What to decide. Who owns the policy, how often the Firm re-reads it, and which events trigger an earlier re-read, such as a change in a vendor's terms or a request for a new tool. Pick the schedule yourself.

What to write down. The owner, the schedule, the triggers, and a change log of what changed and who approved it.

Then write the steps for adding a tool. The person asking names the tool, the account, the tasks, and the data it would touch. The owner reads the vendor's current terms. Before any client data goes near the tool, test it: build a synthetic file for a made-up Doe client, write the expected output by hand, run the tool with the instructions staff would use, and compare line by line, including anything missing or extra. Resolve each mismatch and rerun the test after every change to the instructions. Record the results and the owner's decision, then send the request through the data security plan tie-in and the §7216 review. Only after both does the tool join the approved list. Where AI fails in tax prep walks through that testing.

A Doe example

Doe Holdings CPA is a made-up firm. Jane Doe owns it, and Alex Doe is its Reviewer. An excerpt:

None of those lines says what the law requires.

The policy checklist

1. List approved tools by account and read each account's current terms.
2. Build the data table, plus the data that goes into no tool.
3. Build the role-by-task grid.
4. Preparer checks against the cited page; Reviewer reads back and signs off on the workpaper.
5. Say where drafts and instructions are saved.
6. Cross-reference the data security plan; counsel or the compliance lead confirms.
7. Record the Firm's §7216 review, done by counsel or the compliance lead.
8. Name the owner, schedule and triggers; keep a change log.
9. Add tools only after the synthetic Doe test and both reviews.

Where TracePrep fits

TracePrep is tax-prep software for CPA and EA firms. We've built a tax-prep plugin that drafts prep work in your Firm's workflow. The plugin drafts; the Firm's preparer prepares; the Reviewer signs off. Access to the plugin is by waitlist.

Not tax advice.

This is general information, not tax or legal advice. Your licensed professional and your Firm's Reviewer are responsible for every return and every conclusion. Keep client data inside the systems your Firm has approved. As general guidance only, not advice: if you use an AI tool with client data, firms generally look for a business or commercial plan whose terms cover how that data is handled; read the vendor's current terms before you do.

Join the waitlist