Why CPA firms need better questions before using AI with client data
A CPA firm should establish what client and taxpayer information a proposed AI provider receives, how it is stored or reused and who can access it. For tax return information, check the applicable US disclosure and consent rules before uploading material.
The CalCPA and CAMICO checklist makes a useful distinction: AI used as a professional tool under supervision carries a different risk profile from AI that interacts directly with clients or gives automated tax and accounting guidance. That difference should drive the level of due diligence, consent, monitoring and sign-off required.
The safest answer is to approve the tool before the data, not after
A CPA firm should not treat an AI provider as safe for client data until it has checked the provider's privacy, security, contract and operational controls. Review storage, processing location, retention, deletion, model training, third-party access, incident reporting and confidentiality obligations. For taxpayer information, check whether consent is needed before disclosure to an external system.
For a US tax engagement, have the responsible tax or legal reviewer determine the applicable restrictions and permissions before sharing taxpayer information with an AI provider. Record the activity, material, provider terms and basis for the decision; this checklist does not establish an IRC Sec. 7216 conclusion.
Review your AI data risk before rollout
The core vendor questions to ask first
Start with the data lifecycle. Ask what categories of information the provider receives, whether the service separates your firm's data from other customers, where data is processed and stored, and whether backups, logs or support tickets can contain client material. Then ask how long each copy remains in the system and what evidence the provider gives when deletion is requested.
Next, ask about model training and reuse. The contract should say whether prompts, uploaded documents, outputs, metadata or usage patterns can be used to train, tune or improve models. If the provider says data is not used for training, the firm should still ask whether humans can review content for support, abuse monitoring, quality control or product improvement. Keep the relevant contract clause, policy extract or security schedule with the provider review.
Then ask about third parties. Many AI tools rely on infrastructure providers, subprocessors, analytics vendors and support systems. The firm should know who those parties are, where they operate, what they can see and how changes are notified. Record any missing subprocessor information or change-notice process before deciding whether to approve the provider.
Questions that matter for taxpayer and confidential client information
CPA firms need a stricter test for taxpayer data than for generic internal notes. Before uploading tax returns, source documents, payroll records, identity documents or client correspondence, ask whether the transmission counts as disclosure to a third party, whether written taxpayer consent is required, and whether the provider is contractually barred from using the data beyond the engagement purpose.
Check whether the task needs names, tax IDs, addresses, bank details or transaction references. Use only the data approved for that task, whether or not identifiers have been removed. If exact client data is needed, check the approved environment, access controls, logging and accountable reviewer before proceeding.
Confidentiality also means controlling outputs. AI-generated summaries, draft emails, tax research notes or client recommendations can contain errors or sensitive inferences. Every output that affects client advice should be reviewed by a qualified person before it leaves the firm, with the review recorded in the file.
What the approval record should contain
Keep an approval record that explains the decision and the information reviewed. Record the use case, the data categories involved, the approved tool, the provider due diligence reviewed, the contractual restrictions, the retention and deletion terms, the human review step and the owner accountable for monitoring.
It also helps to classify tools by permitted use. One tool may be approved for public research prompts but prohibited for client documents. Another may be approved for anonymised analysis but restricted for taxpayer data. For higher-risk workflows, include the proposed environment, logging, access controls and review in the approval decision.
Set up an AI governance operating model
How to turn the answers into an operating policy
Once the firm has answered the vendor questions, convert them into everyday rules staff can follow. The policy should name approved tools, prohibited data, consent triggers, review steps, escalation routes and incident reporting expectations. It should also say what staff must do when a client asks whether AI was used in their work.
Use workflow examples in staff training: copying a spreadsheet into a public chatbot, drafting a client email, uploading a contract for summarisation or using a browser extension. Explain which data and tools are permitted in each case.
The policy should be reviewed whenever the provider changes terms, launches new data features, adds subprocessors or introduces agentic functions that can take actions on connected systems. Update the approval record when the provider or permitted use changes.
Conclusion
Before approving an AI provider for client work, resolve the disclosure and consent questions, provider terms and professional review steps. If those questions remain open, keep the tool out of that client-data workflow until the firm has decided what use is permitted.
Build safer AI workflows for client work
Need a safer AI route for your firm?
For a proposed CPA workflow, identify the client and taxpayer data involved, provider terms and unresolved disclosure or consent questions before approving the tool.