SelanjutnyaPanduan berikutnya
AI untuk Penyusun Pajak
Aplikasi
PANDUAN Masyarakat
Keamanan Data dan AI Penyusun Pajak
Tax preparer data security is the set of legal duties and practical safeguards that protect client tax information.
Di halaman ini4 menit membaca
Ikhtisar
In the US it includes a written information security plan (WISP) required under the FTC Safeguards Rule, and it now has to cover AI tools and AI-driven phishing. It matters because tax offices hold Social Security numbers, bank details and income records that criminals use for identity theft and fraudulent refunds, and generative AI makes the scams aimed at them more convincing.
Menyelam Lebih Dalam
The Gramm-Leach-Bliley Act treats paid tax preparers as financial institutions. Under it, the Federal Trade Commission's Safeguards Rule requires them to keep a written information security program. The FTC's amended rule, which took full effect in June 2023, spells out the elements. Firms must designate a qualified individual to oversee the program, conduct a written risk assessment, control access, encrypt customer data in transit and at rest, use multifactor authentication, train staff, oversee service providers, keep an incident response plan and have the qualified individual report on the program. A later amendment requires firms to notify the FTC of certain breaches involving unencrypted information of at least 500 consumers. The IRS supports this through Publication 4557, Safeguarding Taxpayer Data, and Publication 5708, a WISP template developed with the Security Summit partnership. Preparers are also reminded of the requirement when they obtain or renew a PTIN. AI brings two kinds of issue. The first is threats. Language models help criminals write fluent, personalized phishing emails, including the long-running new-client scam and fake IRS or software-vendor messages. Voice cloning makes impersonation calls more believable. The old tell of poor grammar is no longer reliable. The second is the firm's own use of AI. Pasting client returns into a consumer chatbot can put taxpayer data under terms the firm has not reviewed. Separately, Internal Revenue Code Section 7216 restricts the use and disclosure of tax return information without taxpayer consent. A WISP should list approved AI tools, what data each may process and how vendors are vetted. A common misconception is that small firms are too small to be targeted. Criminals seek out small practices because their defenses are often weaker and their data is just as valuable.
Dampak Strategis
Risiko dan keselamatan
Kerugian akibat AI yang bersifat bencana dan sehari-hari bergantung pada siapa yang memahami risikonya dan siapa yang dapat bertindak.
Keputusan yang lebih jelas
Literasi masyarakat dan profesional menentukan apakah kebijakan keselamatan yang kuat memungkinkan secara politis.
Menembus hype
Penjelasan yang jelas mengurangi penangkapan oleh hype, PR laboratorium, dan teater etika yang tidak jelas.
The Future of Tax Preparer Data Security and AI
AI-assisted fraud is likely to keep getting more convincing, so defenses that do not rely on spotting mistakes will matter most: MFA, verification over a separate channel and least-privilege access. Regulators have been tightening expectations over time, and professional bodies keep updating guidance. As more preparers adopt AI for intake and review, vendor contracts and data-handling terms will become a routine part of a WISP rather than an afterthought. The core duty does not change: know where client data goes, limit who can reach it, and be ready to respond when something goes wrong.
Implementasi Dunia Nyata
A two-person tax office uses the Security Summit's WISP template to write its plan. The plan names a qualified individual, lists every system that stores client data and adds a rule against pasting client information into unapproved AI chatbots.
During filing season a preparer receives a polished email from a supposed new client with a link to their tax documents. The link leads to a credential-harvesting page. Because the office requires multifactor authentication, the stolen password alone cannot open the tax software.
A firm evaluating an AI document-intake tool asks the vendor how it encrypts data, whether client data is used to train models, how long data is kept and where it is stored, and records the answers in its vendor file.
A staff member receives a phone call in a voice that sounds like the firm owner, asking her to change a client's direct-deposit account. Office policy requires confirming any such request through a second, known channel, so she hangs up and calls the owner back.
Risiko & Pagar Pembatas
Memperlakukan risiko eksistensial sebagai fiksi ilmiah sementara kemampuan bertambah.
Membingungkan keamanan produk permukaan dengan penyelarasan dalam otonomi tinggi.
Membiarkan audiens non-Inggris dan non-ahli hanya memiliki sumber berkualitas rendah.
Peta Jalan Implementasi
Pisahkan risiko bahaya, penyalahgunaan, dan hilangnya kendali/ketidakselarasan produk.
Tanyakan bukti apa yang akan mengubah pandangan Anda mengenai jangka waktu dan tingkat keparahannya.
Lebih memilih sumber primer dan evaluasi konkrit dibandingkan klaim pemasaran.
Identifikasi satu jalur tindakan: karier, kebijakan, pendanaan, atau keterampilan – bukan hanya kesadaran.
Terus Menjelajah
Free newsletter
Get the daily AI briefing
Three verified AI stories every weekday morning, written in plain English. Free forever, no ads.
One email each weekday. Unsubscribe in one click. We never sell or share your address.
Test yourself
Take the Tax Preparer Data Security and AI quiz
Instant feedback on every answer, and a shareable certificate with a verifiable ID once you pass a course.
Support free AI education. AI Understanding is a 501(c)(3) nonprofit — no ads, no paywall, ever. Make a donation
Pertanyaan yang sering diajukan
What is Tax Preparer Data Security and AI?
Tax preparer data security is the set of legal duties and practical safeguards that protect client tax information. In the US it includes a written information security plan (WISP) required under the FTC Safeguards Rule, and it now has to cover AI tools and AI-driven phishing. It matters because tax offices hold Social Security numbers, bank details and income records that criminals use for identity theft and fraudulent refunds, and generative AI makes the scams aimed at them more convincing.
Why does the FTC Safeguards Rule apply to paid tax preparers?
The GLBA classifies tax preparers as financial institutions, which brings them under the FTC's Safeguards Rule.
Which IRS publication is the WISP template developed with the Security Summit?
Publication 5708 is the WISP template. Publication 4557 covers safeguarding taxpayer data more broadly.
Why does the guide say poor grammar is no longer a reliable phishing warning sign?
Generative AI removes the clumsy writing that once gave phishing away.
A caller who sounds like the firm owner asks to change a client's direct-deposit account. Which control does the guide recommend?
Out-of-band verification defeats cloned voices and spoofed messages, because the attacker does not control the second channel.
Which Internal Revenue Code section limits using or disclosing tax return information without taxpayer consent?
Section 7216 restricts preparers' use and disclosure of return information, which bears on pasting client data into outside AI tools.
Teruslah belajar
Panduan terkait
Panduan lainnya dipilih untuk topik ini