AI in Accounting Firms: What the FTC Safeguards Rule and Your WISP Need to Cover
AI security for accounting firms starts with a rule that never mentions AI. The FTC Safeguards Rule treats a firm that completes income tax returns as a financial institution and requires a written information security program, and in our reading the client data staff paste into AI tools sits inside it. We map ten elements of the rule to staff AI use, set out what 26 U.S.C. 7216 leaves for counsel, and give eight steps to finish before busy season.
S
Sofia Reyes
Head of Compliance
Nov 12, 2026
On this page
AI security for accounting firms starts with a rule that never mentions AI. The FTC Safeguards Rule treats a firm that completes income tax returns as a financial institution and requires a written information security program. In our reading, client data that staff paste into ChatGPT or Microsoft Copilot sits inside that program, so the WISP has to cover it.
Most plans were written before any of this. Busy season starts in January, and seasonal preparers arrive with their own chatbot logins. Below: why the rule applies, where staff AI use touches each element, the tax statute beside it, and eight steps to finish before the first return.
Last verified: 12 November 2026, against the FTC's Safeguards Rule guidance page, 16 CFR 314.2, 314.4 and 314.6, 26 U.S.C. 7216, Treas. Reg. 301.7216-1 and 301.7216-3, and IRS news release IR-2026-92. The regulations and the statute were read on Cornell Law School's Legal Information Institute copy, because ecfr.gov returned a bot check that we did not try to get around. We could not read the text of IRS Publications 4557 and 5708 or the AICPA Code of Professional Conduct, so none of their detail is stated here.
Figure 1. The first three boxes are the law's own words. The fourth is our reading.
Why does the FTC Safeguards Rule apply to an accounting firm?
Because the rule says so by name. Among its examples of a financial institution, 16 CFR 314.2(h)(2)(viii) lists "an accountant or other tax preparation service that is in the business of completing income tax returns." The FTC's guidance page lists tax preparation firms too.
The IRS says the same. Its news release of August 18, 2026 (IR-2026-92) from the IRS and its Security Summit partners opens by saying "Federal law requires tax and accounting professionals to create and maintain a Written Information Security Plan" to protect client information. Under the Gramm-Leach-Bliley Act, it adds, "tax and accounting professionals are considered financial institutions" and must have a data security plan.
Small firms get partial relief. Section 314.6 is one sentence long: "Section 314.4(b)(1), (d)(2), (h), and (i) do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers." Those four paragraphs are the written risk assessment, the schedule of continuous monitoring or penetration testing and vulnerability assessments, the written incident response plan, and the Qualified Individual's annual written report. Everything else stays, including the Qualified Individual, the safeguards in paragraph (c), training and service provider oversight. The list does not name paragraph (j), the notice to the FTC.
What does the rule expect, and where does staff AI use touch it?
The rule does not mention AI. The words "artificial intelligence" appear nowhere in sections 314.2 or 314.4, on the FTC's guidance page or in the IRS release. So the first two columns of the table below are the rule, and the last two are our reading.
That reading rests on a few plain definitions. Customer information is "any record containing nonpublic personal information about a customer of a financial institution, whether in paper, electronic, or other form," that the firm handles or maintains. An authorized user is "any employee, contractor, agent, customer, or other person that is authorized to access any of your information systems or data." A seasonal preparer is an authorized user. A prior-year return is customer information. Pasting a page of it into a chatbot is activity the program is supposed to know about.
Take a fictional example. Rachel Torres joins for the season and uses her personal ChatGPT account to summarize a client's wage and withholding figures. The paste includes a Social Security number. Nobody acted in bad faith. But the plan is silent, the firm has no record, and no contract binds the vendor that received it. One more paragraph matters here: 16 CFR 314.4(c)(2) tells the firm to "identify and manage the data, personnel, devices, systems, and facilities" it relies on. In our reading, an AI tool used for client work is one of those systems.
How does each element map to AI use and to the WISP?
Safeguards Rule element
What the rule says
Where staff AI use touches it (our reading)
What to add to the WISP
Written program (FTC guidance)
The program "must be written and it must be appropriate to the size and complexity of your business"
A plan silent on AI omits a daily route for client data
An AI section with scope, approved tools and an owner
Qualified Individual, 314.4(a)
Designate a person to oversee, implement and enforce the program; the firm retains responsibility
Someone has to decide which AI tools are allowed
The Qualified Individual approves AI tools and exceptions
Written risk assessment, 314.4(b) and (b)(1)
Identify reasonably foreseeable risks to customer information; the assessment "shall be written"
Pastes and uploads to AI tools are a foreseeable internal risk
An AI entry: tools, data exposed, mitigation or acceptance
Access controls, 314.4(c)(1)
Limit authorized users to the customer information "they need to perform their duties"
An assistant connected to shared drives reaches what its user can
Which roles may use AI with client data
Encryption, 314.4(c)(3)
Encrypt customer information "both in transit over external networks and at rest"
Data sent to an AI vendor is held on its systems
The approved vendor's encryption terms
Activity logging, 314.4(c)(8)
Controls to "monitor and log the activity of authorized users" and detect unauthorized access or use
Prompts and uploads are user activity, usually unrecorded
What AI activity is logged, where, and for how long
Staff training, 314.4(e)(1)
Security awareness training "updated as necessary to reflect risks identified by the risk assessment"
Seasonal staff bring personal AI accounts and habits
AI rules in onboarding, before system access is granted
Service provider oversight, 314.4(f)
Select capable providers, require safeguards "by contract," and assess them periodically
A licensed AI vendor fits the definition; a personal account has no firm contract
The AI vendor, terms reviewed, next review date
Written incident response plan, 314.4(h)
A written plan for any security event "materially affecting the confidentiality, integrity, or availability" of customer information
Client data in an unapproved AI account needs triage
An AI scenario: who is told, who decides on notice
Annual report, 314.4(i)
The Qualified Individual reports "in writing, regularly and at least annually"
Partners should see AI use beside other risks
An AI line in the report: tools, incidents, open items
Firms under the five-thousand-consumer line are excused from the written form of the risk assessment, the written incident plan and the annual report. The other rows still apply.
What does 26 U.S.C. 7216 say, and what does it leave open for AI tools?
Tax preparers carry a second duty. Section 7216 of the Internal Revenue Code covers any person "engaged in the business of preparing, or providing services in connection with the preparation of," income tax returns, and anyone who prepares one for compensation. It is a crime for that person to knowingly or recklessly disclose "any information furnished to him for, or in connection with, the preparation of any such return," or to use it "for any purpose other than to prepare, or assist in preparing, any such return."
The penalty is criminal. A violation is a misdemeanor, with a fine of not more than $1,000 ($100,000 in a case to which section 6713(b) applies), imprisonment of not more than 1 year, or both, plus the costs of prosecution.
The Treasury regulations fill in the terms. Section 301.7216-1 defines disclosure as "the act of making tax return information known to any person in any manner whatever." Section 301.7216-3 says that unless the statute or section 301.7216-2 specifically authorizes it, a preparer may not disclose or use a taxpayer's return information "prior to obtaining a written consent from the taxpayer,".
Here is the open question. Is sending return information to an AI tool a disclosure? Is it authorized, or is written consent needed, and in what form? We do not answer that, and no vendor should. It is a question for the firm's counsel, tool by tool.
The account type still matters in practice. With the firm's licensed tool, the firm is party to a contract and can show counsel what the vendor may do with the data. With a personal account on a consumer plan, the staff member accepted the terms alone. The firm has no agreement to read and no record. Our guide to what a ChatGPT Enterprise license covers shows how much of the answer lives in the plan and its contract.
CPAs also have professional confidentiality duties under the AICPA Code and state boards. We could not read the Code at the source, so we do not describe what it requires.
Figure 2. A contract does not settle the section 7216 question. It gives counsel something to read.
When could an AI incident raise the FTC breach notice question?
Since May 2024 the rule has carried a notice duty. Under 314.4(j), if a notification event involves the information of at least 500 consumers, the firm must notify the FTC "as soon as possible, and no later than 30 days after discovery of the event." A notification event is the "acquisition of unencrypted customer information without the authorization of the individual to which the information pertains," and unauthorized access is presumed to be acquisition unless the firm has reliable evidence otherwise.
Whether client data placed in an AI tool amounts to such an acquisition depends on facts we cannot judge: whose account it was, what the vendor's terms allow, who could see the data afterward, and how many consumers were involved. We are not saying it is a notifiable event, and we are not saying it is not. The practical point is narrower. A firm with no record of what was sent, to which account and for how many clients cannot answer the question either way, and the 30 days run from discovery.
What should a firm do before busy season?
Inventory the AI tools and accounts in use. For each tool, note whether staff sign in with a personal or a business account.
Pick and license one approved tool. People use personal accounts when there is no sanctioned alternative.
Review the vendor's contract as a service provider. Check data use, retention, encryption and breach notice, and file the review.
Write the AI section of the WISP. Scope, approved tools, data that may never be entered, the owner.
Add an AI scenario to the incident response plan. Walk through the Rachel Torres case and name who decides.
Set data controls. Block personal accounts for client work and redact identifiers such as Social Security numbers. We compare the methods in how to block personal AI accounts.
Cover seasonal staff on day one. Training and controls come before the first login.
Log AI activity. Keep enough to show what was sent, by whom and to which account.
Two free documents shorten steps 3 and 4. The AI vendor security questionnaire gives the service-provider review a structure, with 50 scored questions across 8 domains to put to the AI vendor. The AI acceptable-use policy template is editable starting text for the AI section of the WISP, so the Qualified Individual edits 20 drafted sections instead of facing a blank page.
Figure 3. The grouping is ours. Writing comes before enforcement so every control has a policy behind it.
What about advisory and consulting work beyond tax?
Advisory, valuation and consulting practices have no equivalent sector statute that we verified. The duty to keep client material confidential comes from the engagement letter, the NDA and the client's contract terms. The controls are the same: know which tools are in use, keep client documents in the approved one, and keep a record.
What can software do here, and what stays with the firm?
Software cannot write the plan, serve as the Qualified Individual or decide a section 7216 question. It sees managed devices and browsers, not a preparer's personal phone. No product makes a firm compliant with the Safeguards Rule. The firm owns the program.
What software can do is supply the facts and enforce the rules the plan sets. AccuroAI recognizes 1,400+ AI tools in the browser and on managed devices, each with the signed-in account (personal or business) and the plan, which is the inventory in step 1. Inline redaction runs 40+ classifiers in under 38 ms p99, so a Social Security number in a paste is removed before it reaches the model. It detects the identifiers on a tax document, not the form as such. Uploads to personal accounts can be blocked while the licensed tool keeps working, and audit logs stream to the firm's SIEM. It does not write or maintain the WISP. Our accounting page has more.
FAQ
Does the FTC Safeguards Rule mention AI tools?
No. Neither 16 CFR 314.2 nor 314.4 uses the term, and the FTC's guidance page does not either. In our reading, the elements still reach staff AI use wherever customer information is involved.
Does a small firm still need a WISP?
Yes. Firms that maintain customer information on fewer than five thousand consumers are excused from four paragraphs: the written risk assessment, the monitoring and testing schedule, the written incident response plan and the annual report. The rest of the program still applies.
Is putting client tax data into ChatGPT a section 7216 violation?
We cannot tell you. The statute covers knowing or reckless disclosure or use of return information, and the regulations set written consent rules. How those apply to a given tool and account is a question for counsel.
Is an AI vendor a service provider under the rule?
The rule's definition covers any person or entity that "receives, maintains, processes, or otherwise is permitted access to customer information" by providing services directly to a financial institution. In our reading, a licensed AI vendor that receives client data fits those words.
When does the 30-day FTC notice apply?
When a notification event involves the unencrypted customer information of at least 500 consumers. The firm must notify the FTC as soon as possible and no later than 30 days after discovery. Whether a specific AI incident qualifies is for counsel.
This guide is general information about federal rules for tax and accounting firms, not legal advice. Confirm how each rule applies to your firm with counsel.
If you would rather start step 1 with facts than with a staff survey, see it on your own devices: a 72-hour pilot maps the AI already in use before any policy is enforced. Start a free pilot.
