Does Using AI on Client Tax Data Trigger Section 7216?
Most of the conversation about AI in tax practices is about time saved. There is a quieter question underneath it, and it has a criminal statute attached.
Does using AI on client tax data trigger section 7216?
Yes. Running client return information through ChatGPT, Claude or any general-purpose AI tool is a disclosure under IRC §7216, and it requires the client’s signed written consent first. The consent must name the specific vendor — “various AI tools” does not satisfy the rule.
Why this catches people out
Section 7216 prohibits a preparer from disclosing or using taxpayer information for anything other than preparing the return, without consent. It is a criminal provision, not a civil one: up to $1,000 and a year in jail per offence, plus $250 civil penalties per violation capped at $10,000 a year.
Nobody sets out to disclose client data. What happens is ordinary: a preparer pastes a partial return into a chat window to work out how to treat something, or drops a client letter in to have it rewritten more clearly. It feels like using a calculator. Under the statute it is a disclosure to a third party.
The other detail that surprises people is the consent has to name the vendor. A blanket line about “technology providers” or “AI tools” is not enough. If your practice uses two tools, both get named.
The guidance gap, stated honestly
The last formal IRS guidance on §7216 is from 2013 — before any of this existed. The AICPA is advising preparers to err on the side of caution and disclose AI use to clients, and CNBC covered the ambiguity in August 2026. So this is a live question rather than a settled one.
What that means practically: nobody can tell you with certainty where the line sits on every use. What they can tell you is which side of it you are comfortably on, and the comfortable side is not difficult to reach.
Where the line is clearer than you would think
Almost certainly a disclosure
Pasting return data, a client letter containing figures, a K-1, or anything identifying the taxpayer into a consumer AI tool. Uploading a document. Using an AI assistant connected to the mailbox where client documents arrive.
Almost certainly fine
Asking a general question about how a rule works, with no client facts in it. “How is a Section 179 deduction limited for an SUV?” is research. “My client bought a $70,000 SUV for their landscaping business in Lakeland, how do I treat it?” is starting to be a disclosure.
The part people miss entirely
Tools you did not think of as AI. A meeting note-taker sitting in a client call. An email assistant that reads the inbox where returns arrive. Automation that moves documents around. These hold standing access, granted once and rarely reviewed.
What to do about it before season
- Decide which tools are approved, and name them. One or two, on a business tier where the terms are on your side. Then remove the rest rather than leaving them connected.
- Update your §7216 consent to name those vendors. For individual returns it has to be a separate document, not a paragraph in the engagement letter — that shortcut is only available for entity returns.
- Find out what already has access to your systems. This is the step almost everyone skips. Permissions granted to an AI tool months ago do not expire and do not appear in any dashboard. When we audited our own Microsoft 365 tenant we found ChatGPT holding permission to read every file we owned, granted by one person clicking Accept. The full story is here.
- Write down the rule for your staff. One page — approved tools, what may never go in a prompt, who to ask. We publish a template you can copy for free.
- Do it before January. From late January to mid-April there is no good time to change anything.
This sits on top of what you already signed
Line 11 of Form W-12 is the data security item, signed under penalty of perjury, and the FTC Safeguards Rule applies to preparers as financial institutions. AI does not create a new obligation so much as give the existing ones a new way to be breached. If you want to see where your practice stands against the Safeguards items, there is a short self-check here — free, and no form.
We are a small IT company in Haines City and we look after a few accounting practices around Polk and Osceola. If it would help to have someone tell you plainly what already has access to your client data before renewal season, we will do that for nothing — about twenty minutes, and you get a straight answer either way.
General information about a regulation, not legal or tax advice. Section 7216 is a criminal statute; if you think you have a problem, talk to counsel.
More on using AI without creating a problem
- Can employees use ChatGPT with company data?
- Is it legal to use an AI note-taker in Florida?
- Can a law firm use ChatGPT without breaching confidentiality?
- Can front desk staff use AI to write patient emails?
- Does AI estimating actually work for a contractor?
The practical starting point: a free one-page AI acceptable use policy you can copy and issue this week, and how we approach AI consulting.
