Can accountants use ChatGPT with client tax data? Start with Section 7216.

The short answer

Not by pasting a client's return information into a general AI tool and hoping it's fine. Section 7216 of the Internal Revenue Code limits how tax return preparers use and disclose tax return information, and its regulations define disclosure as making that information known to anyone, in any manner. Typing it into an outside company's AI service can fit that definition.

The regulations do let preparers use outside service providers without consent in some cases. Whether a given AI tool fits those exceptions hasn't been settled, and as of October 16, 2026 the IRS's Section 7216 information center says nothing about AI. Until it does, the careful route is a business-tier tool, the minimum client information, and a written consent that names the provider before any return information goes in.

What counts as tax return information

The definition is broader than most people expect. The regulation covers any information furnished for, or in connection with, preparing a return, including a taxpayer's name, address and identifying number. It also covers information you get from third parties and information you derive or generate from what the client gave you.

That last part matters for AI. A summary you write from a client's documents, or a spreadsheet you build from their bank statements for the return, is still tax return information. So is a statistical compilation, even an anonymous one.

"Tax return preparer" is broad too. It includes anyone in the business of preparing or helping prepare returns, anyone providing auxiliary services like tax software, and the employees of both.

What's at stake

The civil penalty is the one to plan around. It doesn't depend on intent, and it's counted per disclosure.

Where AI tools fit, and where it's unsettled

The regulations allow some disclosures without client consent. Two are relevant to AI:

• Another preparer in the United States, for auxiliary services. Allowed, as long as the services "are not substantive determinations or advice affecting the tax liability." The regulation defines a substantive determination as "an analysis, interpretation, or application of the law."
• A contractor for software or equipment. Allowed for programming, maintenance, repair, testing or procurement of software, only to the extent necessary, and only if each recipient gets written notice of Sections 6713 and 7216 and their penalties. In practice, a general AI provider won't give each of its staff your written notice, which makes this exception hard to rely on for a chatbot.

So the question for any AI tool is which side of that line it falls on. A tool that reads a W-2 and fills in fields looks like processing. Asking a chatbot whether a client's deduction is allowed looks like a substantive determination: the regulation's own example of asking another firm whether a deduction is allowed requires consent.

Practitioners are still working this out. In October 2026 the American Bar Association's tax section scheduled a panel on exactly this question: whether an AI provider is "merely processing information or making a substantive determination," and when prompts and outputs count as tax return information.

Two limits apply whatever the answer. Disclosure to anyone outside the United States needs the client's consent. And for individual (Form 1040) clients, a preparer can't get consent to send the client's Social Security number offshore without an adequate data protection safeguard; otherwise it has to be masked. If you don't know where an AI provider processes your data, find out before client information goes in.

What careful firms do now

1. Use AI for work that isn't built from a client's return.

   Explaining a code section, drafting a generic client newsletter or summarizing a new IRS notice doesn't involve any client's tax return information.

2. Use business-tier tools only.

   ChatGPT Business, Claude Team, Microsoft 365 Copilot or Gemini in Workspace, signed in with work accounts. That settles training. It doesn't settle Section 7216, which is about your disclosure, not the provider's use. See ChatGPT Business vs Plus.

3. Strip identifiers, but don't treat that as a pass.

   Removing names, Social Security numbers and addresses lowers the risk. Because the definition covers derived and even anonymous information, it doesn't clearly take the data outside Section 7216.

4. Get written consent that names the provider.

   This is the most cautious route when return information does go into an AI tool. The requirements are below.

5. Put the tool in your WISP.

   Treat any AI tool that receives client data as a service provider under the FTC Safeguards Rule. Here's how to add AI tools to your WISP, with a section you can copy.

What a valid consent needs

From the consent regulation and, for Form 1040 clients, Revenue Procedure 2013-14:

• Written and signed before the disclosure. Consent can't be backdated, and "opt-out" consent isn't allowed.
• The names of the preparer and the taxpayer, the purpose, the specific recipient, and the information covered. If the recipient may be outside the United States, the consent has to say so.
• Separate documents: one consent for using the information and another for disclosing it.
• For Form 1040 clients, the mandatory statements from Revenue Procedure 2013-14, including "Federal law requires this consent form be provided to you" and the TIGTA contact line, in at least 12-point type on paper.
• A duration. If you don't state one, consent lasts one year from the date the client signs.
• A copy for the client. Electronic signatures are allowed if they follow the revenue procedure's rules.

CPAs also have the AICPA's confidential client information rule (ET 1.700.001) to consider alongside Section 7216. For business returns, the consent can be in any format, including an engagement letter. Consent also has to be voluntary: for most purposes you can't make it a condition of doing the client's return.

Common questions

Is ChatGPT Business enough to make this safe?

It handles a different problem. Business plans keep your data out of model training by default. Section 7216 is about whether you were allowed to share the client's information with the provider in the first place.

What about the AI built into my tax software?

Tax software developers count as tax return preparers under the regulation, so Section 7216 binds them too. Ask your vendor in writing whether its AI features send client data to another company, and where that data is processed.

Can I use AI for tax research?

General research that doesn't include a client's information isn't a disclosure. Once you describe a specific client's facts to get an answer, you're back under Section 7216.

Has the IRS issued guidance on AI and Section 7216?

Not on its Section 7216 information center, which the IRS last updated on September 7, 2026 and which doesn't mention AI. Check it again before relying on this page.

If you want help

We work with CPA, tax and bookkeeping firms around Charlotte, and this is usually the first thing we sort out: which tools your staff already use, whether your WISP covers them, and where consent language needs to change. We'll build to whatever position you and your advisors take. The first conversation is free.

More on what's worth automating in a firm: AI for small accounting firms.

Sources

1. 26 U.S.C. § 7216: disclosure or use of information by preparers of returns
2. 26 U.S.C. § 6713: civil penalty for disclosure or use
3. Treas. Reg. § 301.7216-1: definitions
4. Treas. Reg. § 301.7216-2: permitted disclosures without consent
5. Treas. Reg. § 301.7216-3: consent requirements
6. IRS: Revenue Procedure 2013-14
7. IRS: Section 7216 information center (checked October 16, 2026) and Section 7216 FAQ
8. AICPA Code of Professional Conduct: Confidential Client Information Rule (ET 1.700.001)
9. Winthrop & Weinstine: ABA Tax Section panel on AI and Sections 7216 and 6713 (October 2026)