A continuaciónSiguiente guía
Cuando los clientes de terapia utilizan chatbots de IA
sociedad
GUÍA de sociedad
CPA Ethics and Client Data When Using AI
CPAs can use AI tools with client data only in ways that respect their confidentiality duties.
En esta pagina4 minutos de lectura
Descripción general
For tax work, the rules of Internal Revenue Code section 7216 on disclosing or using tax return information also apply. In practice that means knowing where the data goes, getting client consent or contractual protections when required, and vetting the vendor before any client information enters the tool. This matters because pasting a client file into the wrong chatbot can be an unauthorized disclosure with professional, civil and even criminal consequences.
Buceo profundo
Three sets of rules shape how a CPA can use AI with client information. The first is the AICPA Code of Professional Conduct. Its Confidential Client Information Rule (1.700.001) bars members in public practice from disclosing confidential client information without the client's specific consent, with limited exceptions such as responding to a valid subpoena or a peer review. The Code also has interpretations on third-party service providers, which cover most AI vendors. Broadly, the member should tell the client before sharing confidential information with such a provider. The member should also either have a contract requiring the provider to keep the information confidential, with reasonable assurance that it has procedures to do so, or get the client's specific consent. The second applies to tax preparers. Section 7216 makes it a crime for a return preparer to knowingly or recklessly disclose or use tax return information outside permitted purposes. Section 6713 adds a civil penalty. The Treasury regulations under section 7216 list some disclosures that need no consent. Many others need written consent obtained before the disclosure, signed and dated by the taxpayer, and in the format the IRS prescribes; Revenue Procedure 2013-14 gives the format guidance. Tax return information disclosed to anyone outside the United States gets stricter treatment. Whether a particular AI vendor falls under a no-consent exception is a legal question the firm should resolve with counsel, not assume. The third is data security law. Tax and accounting firms are generally covered by the FTC Safeguards Rule, which requires a written information security program. IRS Publication 4557 gives practical safeguarding guidance. Two misconceptions are common: stripping names does not make data anonymous. A combination of location, income, business type and dates can identify a client; and an enterprise AI plan does not remove the firm's obligations. It only makes them easier to meet.
Impacto Estratégico
Riesgo y seguridad
Los daños catastróficos y cotidianos de la IA dependen de quién comprende los riesgos y quién puede actuar.
Decisiones más claras
La alfabetización pública y profesional determina si es políticamente posible una política de seguridad sólida.
Cortando el bombo
Las explicaciones claras reducen la captación por la exageración, las relaciones públicas de laboratorio y el vago teatro de ética.
The Future of CPA Ethics and Client Data When Using AI
Professional bodies, state boards and the IRS are paying more attention to AI in tax and accounting practice. Firms should expect more specific guidance, updated engagement letter language and AI-specific vendor contract terms. How confidentiality and section 7216 apply to particular AI setups may be clarified over time, so firms should watch AICPA and IRS publications rather than rely on today's assumptions. Technology is also moving toward private deployments and stronger contractual data controls, which make compliant use easier. Consent, documentation and professional judgment will still be required.
Implementación en el mundo real
A tax preparer wants help drafting a reply to a client's IRS notice. Instead of pasting the notice into a free consumer chatbot, they use the firm's approved enterprise tool under a contract that bars training on inputs, and first remove the name, SSN and address.
A firm evaluating an AI bookkeeping assistant asks the vendor for its SOC 2 Type II report, data retention periods, subprocessor list and data processing location. It also checks whether a written contract bars the vendor from using client data to train its models.
A firm updates its engagement letters to tell clients that third-party service providers, including AI tools, may process their information. It also reviews whether any planned use of tax return information needs separate section 7216 consent.
A staff accountant pastes a client's full trial balance and payroll register into a personal chatbot account. The firm treats this as a possible unauthorized disclosure: it reviews the tool's data terms, asks for deletion where possible, documents the incident and retrains staff.
Riesgos y barandillas
Tratar el riesgo existencial como ciencia ficción mientras que la capacidad se agrava.
Confundir la seguridad del producto superficial con la alineación en condiciones de alta autonomía.
Dejando a las audiencias que no hablan inglés ni a expertos solo con fuentes de baja calidad.
Hoja de ruta de implementación
Separe los riesgos de daños al producto, mal uso y pérdida de control/desalineación.
Pregunte qué evidencia cambiaría su opinión sobre los plazos y la gravedad.
Prefiera fuentes primarias y evaluaciones concretas a afirmaciones de marketing.
Identifique un camino de acción: carrera, política, financiamiento o habilidades, no solo concientización.
Sigue explorando
Free newsletter
Get the daily AI briefing
Three verified AI stories every weekday morning, written in plain English. Free forever, no ads.
One email each weekday. Unsubscribe in one click. We never sell or share your address.
Test yourself
Take the CPA Ethics and Client Data When Using AI quiz
Instant feedback on every answer, and a shareable certificate with a verifiable ID once you pass a course.
Support free AI education. AI Understanding is a 501(c)(3) nonprofit — no ads, no paywall, ever. Make a donation
Preguntas frecuentes
What is CPA Ethics and Client Data When Using AI?
CPAs can use AI tools with client data only in ways that respect their confidentiality duties. For tax work, the rules of Internal Revenue Code section 7216 on disclosing or using tax return information also apply. In practice that means knowing where the data goes, getting client consent or contractual protections when required, and vetting the vendor before any client information enters the tool. This matters because pasting a client file into the wrong chatbot can be an unauthorized disclosure with professional, civil and even criminal consequences.
Según la Regla de información confidencial del cliente de la AICPA, ¿qué se requiere generalmente antes de que un miembro en la práctica pública revele información confidencial del cliente, fuera de las excepciones enumeradas?
La regla prohíbe la divulgación sin el consentimiento específico del cliente, con excepciones limitadas, como responder a una citación válida o una revisión por pares.
¿A qué se dirige principalmente la sección 7216 del Código de Rentas Internas?
La Sección 7216 es una disposición penal dirigida a los preparadores de declaraciones que revelen o utilicen indebidamente información de la declaración de impuestos.
¿Qué sección del Código de Rentas Internas agrega una sanción civil por divulgación o uso inadecuado de la información de la declaración de impuestos por parte de los preparadores?
La sección 6713 establece la pena civil que va junto con la disposición penal de la sección 7216.
Cuando se requiere el consentimiento de la sección 7216, ¿qué descripción coincide con las regulaciones que se resumen en la guía?
Las regulaciones requieren consentimiento por escrito antes de la divulgación, firmado y fechado por el contribuyente, y en el formato que prescribe el IRS. Rev. Proc. 2013-14 proporciona orientación sobre el formato.
Según las interpretaciones de proveedores de servicios externos de la AICPA, ¿qué se espera en términos generales antes de compartir información confidencial del cliente con un proveedor de IA?
El miembro debe informar al cliente y confiar en un contrato que obligue al proveedor a mantener la información confidencial, con una seguridad razonable de sus procedimientos, u obtener un consentimiento específico.
sigue aprendiendo
Guías relacionadas
Más guías seleccionadas para este tema.