AI for CPA firms and IRC §7216: what the assistant may and may not touch

In short

Section 7216 makes it a crime for a tax return preparer to disclose or use a client’s tax return information for anything other than preparing the return, unless a regulation permits it or the client signed a written consent first. Putting a client’s W-2s, workpapers or even name and address in front of an outside AI service is a disclosure. An AI assistant can work on the firm’s templates, calendars, research and synthetic examples without touching that information. Work on client tax data waits for a consent that names the recipients, the purpose and the information, signed and dated before use. Positions, signatures and advice stay with the CPA.

What the statute covers

26 U.S.C. 7216(a) applies to anyone in the business of preparing income tax returns or providing services in connection with their preparation, and to anyone who prepares a return for compensation. Such a person who knowingly or recklessly discloses information furnished for the return, or uses it for any other purpose, is guilty of a misdemeanor punishable by up to one year in prison. A related civil penalty under section 6713 applies to each prohibited disclosure or use, as 26 CFR 301.7216-1(a) summarizes.

The definitions are wide. Tax return information is “any information, including, but not limited to, a taxpayer’s name, address, or identifying number,” furnished in any form for or in connection with the return. It includes what third parties send the preparer, what the preparer derives from it, and statistical compilations even when no taxpayer can be identified. A use is any case in which the preparer refers to or relies on the information to take or permit an action. A disclosure is “the act of making tax return information known to any person in any manner whatever” (§301.7216-1(b)(3) to (5)).

The rule also follows the information. A person who develops software used to prepare or file a return is itself a tax return preparer under §301.7216-1(b)(2)(i)(B), and a contractor that receives tax return information to support the firm’s software becomes one too (§301.7216-2(d)(2)).

Where an AI assistant meets the rule

An AI assistant is not a closed box inside the firm. On Regaldi’s setup, as the CPA firms page states, working files stay in the firm’s folder, the text used for a task passes through Regaldi’s server to the AI provider, today Anthropic or OpenAI, and conversation memory and uploaded attachments are stored on Regaldi’s server. Each of those is a person to whom information becomes known. The first question for any workflow is therefore whether its inputs contain tax return information at all.

The regulations allow some disclosures without consent. Staff of the same firm in the United States may share the information to prepare the return (§301.7216-2(c)(2)). A preparer may disclose it to another preparer in the United States for preparation or auxiliary services “so long as the services provided are not substantive determinations or advice affecting the tax liability,” and “a substantive determination involves an analysis, interpretation, or application of the law” (§301.7216-2(d)(1)). Contractors who program, maintain, test or supply the firm’s tax software may receive what they need, but only if every individual who receives it gets written notice of sections 6713 and 7216 (§301.7216-2(d)(2)). A preparer located outside the United States receives nothing without the taxpayer’s consent first (§301.7216-3(a)(3)(i)(D)).

These exceptions are narrow and depend on the facts of each workflow. Regaldi does not rely on them. Its stated position is that client tax return information is not processed by Regaldi or its AI providers without the client’s written consent, and that the first engagement starts with a workflow whose inputs contain no client tax data. Whether an exception covers a given workflow is a question for the firm and its own advisers.

What a valid consent contains

Under 26 CFR 301.7216-3, every consent to disclose or use tax return information must meet these conditions:

• It names the tax return preparer and the taxpayer.
• For a disclosure, it states the purpose and the specific recipients. For a use, it describes the particular use.
• It specifies the tax return information to be disclosed or used.
• It is signed and dated by the taxpayer, before any disclosure or use. There is no retroactive consent.
• It is knowing and voluntary. Conditioning services on consent makes it involuntary, with one exception for disclosure to another preparer who assists in preparing the return.
• Uses and disclosures sit in separate documents, and each one is identified separately.
• The taxpayer receives a copy at signing, and a consent with no stated duration lasts one year.

Business filers outside the Form 1040 series may give consent in any format, including an engagement letter, if these elements are met, and the separate-document rule does not apply to them (§301.7216-3(a)(3)(iii)). For Form 1040 series filers, Rev. Proc. 2013-14 adds format rules: each consent is a separate written document, which may be attached to the engagement letter; paper consents use at least 12-point type and carry nothing else; the mandatory statements appear in the prescribed sequence, including the statement on how to contact the Treasury Inspector General for Tax Administration; and electronic consents need an electronic signature that meets section 6 of the procedure. A Form 1040 filer’s Social Security number may not be disclosed to a preparer outside the United States unless the adequate data protection safeguard the regulation describes is in place (§301.7216-3(b)(4)).

What the assistant may touch

Work	Client tax data	Who decides
Firm templates: engagement letters, organizer forms, consent drafts, document-request checklists	None	The CPA approves the template
Statutory due dates, the firm’s security-plan inventory, research memos with every citation listed for checking	None	The CPA verifies before relying on it
Training and demonstrations	None, synthetic documents only	The firm
Reading W-2s, 1099s and K-1s into an input workpaper, each figure with its file and page	Yes, after consent	Staff enter it; the preparer reviews
Personalized organizers, missing-document reminders, status notes to clients	Yes, after consent	A person approves each message
Variance lists for the reviewer, IRS notice summaries and response drafts	Yes, after consent	The practitioner decides and signs

What stays with the CPA

The firm decides whether a workflow needs consent or falls within an exception, and what each consent says. The taxpayer signs it. The CPA makes every substantive determination, the analysis, interpretation or application of law that §301.7216-2(d)(1) separates from clerical help. Return positions, signing as paid preparer, tax advice, representation and attest work remain with the CPA or the responsible practitioner. An AI assistant that drafts a research memo hands over a list of citations to check, not a conclusion.

How Regaldi sets this up

The CPA firms page lists the onboarding conditions to complete before any client tax data: a section 7216 consent package with use and disclosure in separate documents, the written notice of sections 6713 and 7216 to every person and subprocessor who can see the data, masking of Social Security, taxpayer identification and bank account numbers, processing locations confirmed in writing, and a written security description for the firm’s Safeguards Rule review. These are conditions to complete, not controls already in place. Regaldi Studio works on files in a folder the person chooses, and Regaldi Legate routes outgoing work to the firm for approval under permissions agreed in writing.