AI Security for Accounting & Tax Firms
Use AI on client work without risking taxpayer data or your license.
Accounting & Tax Firms
Keep Client and Taxpayer Data Where It Belongs
Accounting and tax firms hold some of the most sensitive data there is: Social Security numbers, bank accounts, income and the details of clients' businesses. AI is a natural fit for the work, from drafting client letters to reading source documents, and a natural risk, because tax return information carries rules of its own. We help firms use AI without putting client data, or the firm's license, at risk.
AI use folded into your written information security plan, with clear rules on client consent.
For Accounting & Tax Firms
Risks, Rules and How We Help
← All AI Security & Governance services
Where AI risk shows up in an accounting firm
- Client documents uploaded to AI tools to summarize, extract or draft, without anyone checking what the tool keeps or who can see it.
- AI features inside tax, practice management and document software that process client data under terms nobody has read.
- Email and portal automations that could send the wrong client's information to the wrong person.
- Phishing and fraud made more convincing by AI, aimed at firms during filing season.
The rules your AI use touches
- FTC Safeguards Rule: tax preparers and accounting firms must keep a written information security program, with a risk assessment, access controls, encryption and multi-factor authentication. AI tools that touch client data belong in it. Firms must also notify the FTC of a breach involving unencrypted information of 500 or more consumers within 30 days of discovering it.
- IRS Publication 4557 and Publication 5708: the IRS's guidance on safeguarding taxpayer data and its template for a written information security plan.
- Internal Revenue Code section 7216: tax return preparers face penalties for using or disclosing tax return information without the taxpayer's consent. Sending a client's return to a third-party AI service is a question to settle before it happens.
- Professional confidentiality: the AICPA Code of Professional Conduct's confidential client information rule applies to the tools you use as much as the people.
How we help
- An AI Risk & Exposure Assessment that finds where client and taxpayer data goes, reviews vendor terms, and feeds straight into your written information security plan.
- An AI Governance Program with clear rules on what client data may go into which tools, and when client consent is needed.
- Secure AI Implementation for document intake, client communication and workflow automations.
Get Started
Start With a Scoping Call
Thirty minutes, by video or on-site. We will talk through how your business uses AI today and where customer data goes, and you will leave with a written scope and quote. Nothing is tested and no data is shared until a written agreement is signed.
