Is it legal to use AI for tax return preparation?

Yes — IRS Circular 230 and AICPA SSTS allow AI assistance in tax prep provided a licensed practitioner exercises due diligence, signs the return, and takes responsibility. AI cannot be the preparer of record. Section 7216 prohibits disclosing client tax return information to any third party (including consumer AI platforms that train on inputs) without written consent. Use enterprise AI with a signed data processing agreement and a no-training clause.

Can AI perform an audit?

AI cannot sign or issue an audit opinion. It can assist with journal-entry testing, analytical procedures, confirmation tracking, risk assessment, and documentation — under AU-C 315 (risk) and AU-C 520 (analytics). PCAOB AS 1105 requires sufficient appropriate audit evidence; AI output alone is not evidence. The engagement team owns every workpaper, every conclusion, and every quality-control gate.

What about GLBA and the FTC Safeguards Rule for accountants?

Tax preparers and CPAs are financial institutions under GLBA. The revised FTC Safeguards Rule (2023) requires a written information security program, designated Qualified Individual, risk assessment, access controls, encryption at rest + in transit, MFA, incident response plan, and annual reporting to the board. Any AI vendor touching client PII / tax data is a service provider requiring oversight under 16 CFR 314.4(f).

Can AI write a client advisory or forecast?

Yes, as a draft. But Circular 230 §10.37 requires that written tax advice be based on reasonable factual and legal assumptions, consider all relevant facts, and not rely on unreasonable representations. AI-drafted advisory must be reviewed by a CPA who signs. For CAS / CFO advisory, AICPA's 2024 evolving guidance requires transparency to the client about AI use in deliverables.

Should partners tell clients the firm uses AI?

Yes — via your engagement letter, privacy notice, and (for attest clients) your independence documentation. Disclose that AI tools are used for drafting and analytics, that client data is not used to train third-party models, and that a licensed professional reviews and signs every deliverable. Many state boards of accountancy (CA, NY, TX, FL) updated advertising and client-communication guidance in 2025 specifically on AI transparency.

How to Use AI for an Accounting Firm (2026 Playbook)

May 4, 2026 · 14 min read

TL;DR

Accounting firms in 2026 win on three levers: compressing 1040 / 1120 / 1065 prep time, elevating bookkeepers into CAS advisory, and shrinking audit hours without killing quality. AI handles document intake, trial-balance tie-out, journal-entry anomaly detection, confirmation tracking, and first-draft client communications — inside tools like Karbon, Canopy, TaxDome, Intuit Copilot, CCH Axcess iQ, Caseware Sherlock, MindBridge, and DataSnipper. Hard rules: IRS §7216 consent before any client data leaves your stack, GLBA / FTC Safeguards-compliant vendors only, Circular 230 due diligence on every tax return, PCAOB / AICPA standards unchanged, and AI output is a draft — the CPA signs.

Why accounting firms need an AI playbook

Tax prep margins are squeezed by Big 4 software pricing and staffing shortages. Bookkeeping is commoditized by Bill.com, Ramp, and embedded QuickBooks agents. Audit is a permanent people problem — 300K fewer accountants than the economy needs by 2026 per AICPA pipeline reports. AI is not a nice-to-have; it is how a 15-person firm delivers the same client experience as a 50-person firm.

But accounting is a licensed profession. Every prompt has to respect Circular 230 practitioner duties, AICPA Code of Professional Conduct §1.700 (confidential client information), §1.295 (non-attest services for attest clients), GLBA, state board rules, and engagement letter terms. This playbook is organized so every AI use case has an identified compliance frame.

The compliance floor (read this first)

IRS Circular 230: practitioner due diligence (§10.22), reasonable reliance, written advice standards (§10.37), best practices (§10.33). AI output is not "due diligence" — your review is.
IRC §7216 + Rev. Proc. 2013-14: criminal liability for disclosing or using tax-return information without written consent. Consumer LLMs training on inputs is a disclosure.
GLBA + FTC Safeguards Rule (16 CFR 314): written ISP, Qualified Individual, risk assessment, access controls, encryption, MFA, IR plan, annual board report, service-provider oversight.
AICPA Code of Professional Conduct: §1.700.001 confidential client info; §1.295 independence; §1.310.001 competence — you must be competent in the AI tool you use.
PCAOB / AICPA SASs: AU-C 315 risk, AU-C 330 responses, AU-C 500 audit evidence, AU-C 520 analytical procedures, QM Section 10 quality management. AI is a tool, not evidence.
State boards of accountancy: advertising, client comms, and AI-disclosure guidance updated 2024-2025 in CA, NY, TX, FL, IL — check yours.
SOC 2 / ISO 27001 for vendors: every AI vendor touching client data signs a DPA + no-training clause + SOC 2 Type II report annually.

The 2026 accounting-firm AI stack

Practice management: Karbon AI, Canopy AI, TaxDome AI, Financial Cents — email triage, workflow, client portals.
Tax compliance: Intuit ProConnect Copilot, CCH Axcess iQ, Thomson Reuters UltraTax + CoCounsel, Drake, Lacerte. Source-document OCR + TRUI / K-1 extraction + diagnostics triage.
Audit: Caseware Sherlock, MindBridge, DataSnipper, Inflo, AuditBoard AI. JE testing, analytical review, confirmation tracking, flux analysis, workpaper indexing.
Bookkeeping / CAS: QuickBooks Intuit Assist, Xero Just Ask, Ramp AI, Bill.com agents, Dext, Keeper. Coding, reconciliations, AP review, client reporting.
Advisory / CFO: Fathom AI, Spotlight, LiveFlow, Finmark, Cube for forecasting, KPI narratives, cash-flow modeling.
Research: Thomson Reuters Checkpoint Edge + CoCounsel Tax, Bloomberg Tax, CCH AnswerConnect with AI search.
Horizontal AI (firm-internal, NOT client PII): ChatGPT Enterprise / Claude for Work / Copilot (with DPA + no-training). Consumer tiers are off-limits for client data.

10 copy-paste prompts for an accounting firm

Run these inside tools that have signed a DPA with a no-training clause (Intuit, Thomson Reuters, CCH, Karbon, ChatGPT Enterprise, Claude for Work). Never paste raw PII or W-2s into consumer LLMs. Every output is a DRAFT — a CPA reviews and signs.

1. 1040 intake triage

You are a tax-season staff accountant. Here is a client's 1040 organizer response + uploaded documents [paste list: W-2, 1099-INT, 1099-DIV, 1099-B, K-1s, 1098, HSA statements, charitable letters]. Output: (1) completeness checklist against last year's return (flag missing forms), (2) likely schedule triggers (Schedule A itemization, Schedule C, Schedule D, Schedule E), (3) diagnostic checks (mortgage interest limit, SALT cap, AMT exposure, NIIT, IRMAA bracket), (4) open questions for the client, (5) preparer-alert flags (underreported income, inconsistent crypto activity, foreign account indicator). Mark DRAFT — manager / CPA must review before filing. §7216 consent is on file.

2. K-1 extraction and tie-out

Parse these partnership/S-corp K-1s [paste] into a normalized schedule: EIN, entity name, ownership %, Line 1 ordinary, Line 2 net rental, Line 3 other rental, Line 4 interest, Line 5 dividends, Line 6 royalties, Line 7 net short-term, Line 8 net long-term, Line 10 Section 1231, Line 13 credits, Line 17/20 §199A QBI info, foreign tax info, basis schedule items. Flag: missing QBI info, inconsistent EIN vs prior year, negative basis, disproportionate distributions. Preparer validates tie-out to tax software.

3. Corporate / 1120 audit-ready workpaper draft

Draft a trial-balance-to-tax-return reconciliation workpaper for [entity, tax year]. Inputs: GL trial balance [paste], book-to-tax adjustment list from prior year, current-year memo. Output: 5-column reconciliation (Book / M-1 additions / M-1 subtractions / M-3 if applicable / Tax), footnoted with adjustment rationale, cross-references to supporting schedules, and open items list. Flag items that look like permanent differences coded as temporary or vice versa. Preparer signs, reviewer ties out.

4. Client advisory memo (Circular 230 §10.37 compliant)

Draft a written tax-advice memo for [client] on [issue, e.g., S-corp election for an LLC expecting $450K 2026 profit, CA resident owner]. Structure: facts, assumptions (explicit), issue, authority (Code + Regs + relevant rulings), analysis, conclusion, limitations. Cite only authority you can verify — do NOT invent Code sections or case names. Flag any fact where you relied on client representation. Include the standard §10.37 paragraph and the "for discussion purposes" caveat. CPA reviews, signs, and dates. Final memo goes to the client after review.

5. Audit journal-entry anomaly triage

Here is the full GL for [client, period] with JE population [paste summary stats + seed-queried subset]. Apply AU-C 240 fraud-risk JE tests: manual JEs to sensitive accounts, round-dollar JEs, JEs posted by unusual users, weekend/after-hours JEs, reversing entries without support, JEs that straddle cut-off. Output: ranked anomaly list with rationale, suggested sample for testing, and documentation of the threshold-selection logic. Auditor-in-charge selects final sample. This is AI-assisted risk assessment, not audit evidence by itself.

6. Analytical-review flux analysis

Run flux analysis on [client] financials for [CY vs PY] at the account level [paste TB or summary]. Output: accounts with >10% and >$25K (threshold configurable) variance, proposed explanation categories (volume, price, one-time, reclassification, timing, error), expected explanations from operations context, and unexpected movements requiring expanded procedures under AU-C 520. Tag any account where the change disagrees with known operational events. Engagement manager reviews and documents conclusions.

7. Client monthly bookkeeping package + narrative

Draft the monthly close package for [CAS client, month]. Inputs: reconciled QBO/Xero file, bank and credit-card recs, payroll summary, AR aging, AP aging, month-end cash. Output: (1) P&L + BS snapshot, (2) top 5 variances vs budget and MoM, (3) three-sentence narrative the owner can read in 60 seconds, (4) questions for the owner, (5) open items pushed to next month. Tone: plain English, not CPA jargon. Senior reviews before sending.

8. CAS / CFO 13-week cash-flow forecast

Build a 13-week cash-flow forecast for [client]. Inputs: bank balance, AR aging with collection probability, AP aging, recurring payroll, rent, loan payments, sales tax, estimated taxes, known one-time items. Output: weekly cash roll with conservative / base / upside cases, minimum cash threshold flag, suggested collection calls, and three owner actions for the week. Pair with Fathom / Spotlight KPI commentary. CPA reviews.

9. IRS / state-agency notice response

Draft a response to this IRS CP2000 / state notice [paste notice]. Pull the relevant return, identify the proposed adjustment, reconcile to what we filed, and draft either an agreed response, a partial-agreed response with revised schedule, or a disagreement with supporting computations. Cite the Code section / statute / regulation the Service relied on and the counter-authority. Enclose the amended schedule if needed. POA on file = Form 2848 or 8821. CPA signs response, deadline tracked in Karbon.

10. Partner practice dashboard

Write the managing-partner's monthly operating dashboard. Inputs: realization %, utilization %, WIP aging, client concentration, top 10 clients by revenue, pipeline (new tax engagements, audits booked), staff headcount + attrition, CPE compliance, peer-review readiness, AR DSO, cash position, PTO liability, PCAOB / state-board deadlines. Output: 1-page narrative + KPI table + top 3 risks + top 3 opportunities. Written for the managing partner, not the admin team.

Common mistakes we see

Pasting W-2s / 1099s into consumer ChatGPT. §7216 violation plus GLBA + state breach-notification exposure. Enterprise + DPA only.
Letting AI write the final return signature. Circular 230 §10.22 due-diligence is personal to the signing preparer.
Treating AI output as audit evidence. AU-C 500 requires sufficient appropriate evidence — AI analysis is a procedure, not evidence.
Vendor sprawl without DPAs. Every AI-adjacent tool that touches client data is a Safeguards Rule service provider under 16 CFR 314.4(f). Inventory, DPAs, annual review.
Skipping the §7216 consent update. If you changed AI tooling mid-season, your consent language probably no longer covers your data flow.
Independence drift on CAS clients. AI-automated bookkeeping for an attest client can tip into §1.295 non-attest service limits — "management responsibilities" line matters.
No AI policy in the ISP. FTC Safeguards 2023 expects you to address AI/model-training in your written security program.

A 60-day rollout for a 10-50 person CPA firm

Days 1-10: inventory every tool touching client data, collect DPAs with no-training clauses, update ISP with an AI section, refresh §7216 consent language for next engagement letter. Designate Qualified Individual.
Days 11-20: roll out Karbon or Canopy AI for email triage + internal use of ChatGPT Enterprise / Claude for Work. Pilot on one service line (tax).
Days 21-30: deploy tax-side AI — TaxDome source-doc extraction, CCH Axcess iQ diagnostics, or Intuit Copilot. Measure: minutes-per-return savings, reviewer rework rate, diagnostic-acceptance rate.
Days 31-45: for firms with audit practices, pilot DataSnipper + MindBridge on 1-2 engagements. Document AU-C 315 + 500 integration in methodology.
Days 46-60: CAS / advisory layer — Fathom / Spotlight / LiveFlow narratives. Update engagement letters for all new 2026 clients with AI-disclosure language. Add AI review to quality-control monitoring.

Want the Happycapy CPA Firm toolkit?

1040 intake triage template, K-1 normalization schedule, 1120 book-to-tax workpaper starter, Circular 230 §10.37 memo template, AU-C 240 JE-risk worksheet, and the managing-partner dashboard — one downloadable pack.

See Happycapy Pro / Max →

Back to all Happycapy guides.