SeterusnyaPanduan seterusnya
AI untuk Penyedia Cukai
Aplikasi
PANDUAN Masyarakat
Keselamatan Data Penyedia Cukai dan AI
Tax preparer data security is the set of legal duties and practical safeguards that protect client tax information.
Pada halaman ini4 minit membaca
Gambaran keseluruhan
In the US it includes a written information security plan (WISP) required under the FTC Safeguards Rule, and it now has to cover AI tools and AI-driven phishing. It matters because tax offices hold Social Security numbers, bank details and income records that criminals use for identity theft and fraudulent refunds, and generative AI makes the scams aimed at them more convincing.
Menyelam dalam
The Gramm-Leach-Bliley Act treats paid tax preparers as financial institutions. Under it, the Federal Trade Commission's Safeguards Rule requires them to keep a written information security program. The FTC's amended rule, which took full effect in June 2023, spells out the elements. Firms must designate a qualified individual to oversee the program, conduct a written risk assessment, control access, encrypt customer data in transit and at rest, use multifactor authentication, train staff, oversee service providers, keep an incident response plan and have the qualified individual report on the program. A later amendment requires firms to notify the FTC of certain breaches involving unencrypted information of at least 500 consumers. The IRS supports this through Publication 4557, Safeguarding Taxpayer Data, and Publication 5708, a WISP template developed with the Security Summit partnership. Preparers are also reminded of the requirement when they obtain or renew a PTIN. AI brings two kinds of issue. The first is threats. Language models help criminals write fluent, personalized phishing emails, including the long-running new-client scam and fake IRS or software-vendor messages. Voice cloning makes impersonation calls more believable. The old tell of poor grammar is no longer reliable. The second is the firm's own use of AI. Pasting client returns into a consumer chatbot can put taxpayer data under terms the firm has not reviewed. Separately, Internal Revenue Code Section 7216 restricts the use and disclosure of tax return information without taxpayer consent. A WISP should list approved AI tools, what data each may process and how vendors are vetted. A common misconception is that small firms are too small to be targeted. Criminals seek out small practices because their defenses are often weaker and their data is just as valuable.
Kesan Strategik
Risiko dan keselamatan
Kemudaratan AI malapetaka dan setiap hari bergantung pada siapa yang memahami risiko dan siapa yang boleh bertindak.
Keputusan yang lebih jelas
Celik awam dan profesional membentuk sama ada dasar keselamatan yang kukuh adalah mungkin dari segi politik.
Memotong keterujaan
Penjelasan yang jelas mengurangkan tangkapan oleh gembar-gembur, PR makmal dan teater etika yang tidak jelas.
The Future of Tax Preparer Data Security and AI
AI-assisted fraud is likely to keep getting more convincing, so defenses that do not rely on spotting mistakes will matter most: MFA, verification over a separate channel and least-privilege access. Regulators have been tightening expectations over time, and professional bodies keep updating guidance. As more preparers adopt AI for intake and review, vendor contracts and data-handling terms will become a routine part of a WISP rather than an afterthought. The core duty does not change: know where client data goes, limit who can reach it, and be ready to respond when something goes wrong.
Pelaksanaan Dunia Sebenar
A two-person tax office uses the Security Summit's WISP template to write its plan. The plan names a qualified individual, lists every system that stores client data and adds a rule against pasting client information into unapproved AI chatbots.
During filing season a preparer receives a polished email from a supposed new client with a link to their tax documents. The link leads to a credential-harvesting page. Because the office requires multifactor authentication, the stolen password alone cannot open the tax software.
A firm evaluating an AI document-intake tool asks the vendor how it encrypts data, whether client data is used to train models, how long data is kept and where it is stored, and records the answers in its vendor file.
A staff member receives a phone call in a voice that sounds like the firm owner, asking her to change a client's direct-deposit account. Office policy requires confirming any such request through a second, known channel, so she hangs up and calls the owner back.
Risiko & Pengawal
Merawat risiko kewujudan sebagai sci-fi manakala sebatian keupayaan.
Mengelirukan keselamatan produk permukaan dengan penjajaran di bawah autonomi tinggi.
Meninggalkan khalayak bukan Inggeris dan bukan pakar dengan hanya sumber berkualiti rendah.
Hala Tuju Pelaksanaan
Asingkan bahaya produk, penyalahgunaan dan kehilangan kawalan / risiko salah jajaran.
Tanya apakah bukti yang akan mengubah pandangan anda tentang garis masa dan keterukan.
Lebih suka sumber utama dan penilaian konkrit berbanding tuntutan pemasaran.
Kenal pasti satu laluan tindakan: kerjaya, dasar, pembiayaan atau kemahiran — bukan sahaja kesedaran.
Teruskan Meneroka
Free newsletter
Get the daily AI briefing
Three verified AI stories every weekday morning, written in plain English. Free forever, no ads.
One email each weekday. Unsubscribe in one click. We never sell or share your address.
Test yourself
Take the Tax Preparer Data Security and AI quiz
Instant feedback on every answer, and a shareable certificate with a verifiable ID once you pass a course.
Support free AI education. AI Understanding is a 501(c)(3) nonprofit — no ads, no paywall, ever. Make a donation
Soalan lazim
What is Tax Preparer Data Security and AI?
Tax preparer data security is the set of legal duties and practical safeguards that protect client tax information. In the US it includes a written information security plan (WISP) required under the FTC Safeguards Rule, and it now has to cover AI tools and AI-driven phishing. It matters because tax offices hold Social Security numbers, bank details and income records that criminals use for identity theft and fraudulent refunds, and generative AI makes the scams aimed at them more convincing.
Why does the FTC Safeguards Rule apply to paid tax preparers?
The GLBA classifies tax preparers as financial institutions, which brings them under the FTC's Safeguards Rule.
Which IRS publication is the WISP template developed with the Security Summit?
Publication 5708 is the WISP template. Publication 4557 covers safeguarding taxpayer data more broadly.
Why does the guide say poor grammar is no longer a reliable phishing warning sign?
Generative AI removes the clumsy writing that once gave phishing away.
A caller who sounds like the firm owner asks to change a client's direct-deposit account. Which control does the guide recommend?
Out-of-band verification defeats cloned voices and spoofed messages, because the attacker does not control the second channel.
Which Internal Revenue Code section limits using or disclosing tax return information without taxpayer consent?
Section 7216 restricts preparers' use and disclosure of return information, which bears on pasting client data into outside AI tools.
Teruskan belajar
Panduan berkaitan
Lebih banyak panduan dipilih untuk topik ini