AI for small accounting firms: rules first, then automation.

Three rules that shape how a firm can use AI

None of these rules say "don't use AI." They decide which tools, which accounts, and what paperwork comes first.

1. Your written information security plan (WISP)

Under the Gramm-Leach-Bliley Act and the FTC Safeguards Rule, tax and accounting professionals count as financial institutions. The IRS is direct about it: tax professionals are legally required to have a written, accessible information security plan and to review and update it regularly. The Safeguards Rule also requires you to choose service providers that can protect customer information and to oversee them.

In practice, an AI tool that touches client data belongs in your WISP, and so does any consultant who helps you set one up. The IRS publishes a free sample plan for small practices, Publication 5708.

2. Section 7216 and client consent

Section 7216 of the Internal Revenue Code limits how tax return preparers may use or disclose tax return information without the client's written consent, with criminal and civil penalties for violations. The consent rules, including required wording, are in Treasury regulations and Revenue Procedure 2013-14.

Whether sending return information to a particular AI provider counts as a disclosure that needs consent depends on the tool and how it's used, and practitioners are actively debating it. A common cautious approach is a written consent that names the specific provider before any return information goes into a general-purpose AI tool. Decide your firm's position with your own professional advisors. We'll build to whatever position you take.

3. Use business-tier AI with training off

Consumer AI accounts may use conversations for training unless the user opts out. Business plans from OpenAI, Anthropic, Microsoft and Google exclude your data from model training by default. That difference matters more for a firm than for almost any other small business. We compare the major tools in Is ChatGPT safe for company data?

What QuickBooks already does

If your clients are on QuickBooks Online, Intuit's own AI is worth understanding before you build anything. Its Accounting AI categorizes transactions and helps with bank reconciliation, and it's included with QuickBooks Online Essentials, Plus and Advanced. Intuit's help pages note that individual AI features can't be switched off one by one, so it's worth knowing what's running in each client file.

Custom automation helps where QuickBooks stops: coding rules that follow a client's history, document chasing across email, and close checklists that span several systems.

Four jobs worth automating in a small firm

The hours below are our planning estimates for a typical small firm, not client results. Bookkeeping automation is our deepest area; one of our founders has closed books for a living.

1. Client document chase

Every client is missing something different in tax season, and the chasing happens from memory. An automation checks each client's document checklist, drafts a specific reminder ("we still need your 1099-B from Fidelity and the property tax statement"), and queues it for a staff member to approve. Replies update the checklist. About 4 hours a week in season.

2. Bank-feed categorization that follows your rules

Rules come first: a vendor that has always been coded to the same account stays there. The AI only proposes codes for new vendors or unclear lines, shows how confident it is, and puts low-confidence lines at the top of the review list. Nothing posts without a person approving it. About 4 hours a week.

3. Month-end close prep

The close checklist runs itself as far as it safely can: reconciliation data pulled and compared, anything unusual flagged, and a one-page plain-language summary drafted for the client. Adjusting entries are drafted with a memo, never posted by the system. About 5 hours a month for a typical small business's books.

4. Vendor bills entered and matched

Bills that arrive by email or photo are read, matched to the vendor and coded, then staged for review, with duplicates flagged instead of posted twice.

What we won't automate

• Tax positions and advice. Those are yours. We automate the mechanics around them.
• Posting without review. Every entry is approved by a person, at any confidence level.
• Payroll runs, tax filings and vendor payments. We keep these read-only.

For firms, we offer a written data-handling addendum describing what we access, where the data stays, and how access is removed, so we can be documented as a service provider in your WISP.

Where to start

A sensible first step for a firm is getting its own house in order: which AI tools staff are already using, whether the WISP covers them, and whether client consent language needs updating. Then they pick one automation, usually document chase ahead of tax season. The first conversation is free. If there's a fit, the $999 AI Assessment can cover both the tool review and the automation plan.

We work with CPA, tax and bookkeeping firms across Charlotte, Davidson, Cornelius, Huntersville, Matthews and Ballantyne.

Sources

1. IRS: Security Summit reminds tax pros they must have a Written Information Security Plan (July 29, 2025)
2. IRS Publication 4557, Safeguarding Taxpayer Data
3. IRS: Section 7216 information center
4. Tom Talks Taxes: AI and the §7216 disclosure and use rules (practitioner commentary)
5. Intuit: overview of AI in QuickBooks Online
6. OpenAI: how your data is used to improve model performance (updated March 13, 2026)