Đạo đức CPA và dữ liệu khách hàng khi sử dụng AI

Three sets of rules shape how a CPA can use AI with client information. The first is the AICPA Code of Professional Conduct. Its Confidential Client Information Rule (1.700.001) bars members in public practice from disclosing confidential client information without the client's specific consent, with limited exceptions such as responding to a valid subpoena or a peer review. The Code also has interpretations on third-party service providers, which cover most AI vendors. Broadly, the member should tell the client before sharing confidential information with such a provider. The member should also either have a contract requiring the provider to keep the information confidential, with reasonable assurance that it has procedures to do so, or get the client's specific consent. The second applies to tax preparers. Section 7216 makes it a crime for a return preparer to knowingly or recklessly disclose or use tax return information outside permitted purposes. Section 6713 adds a civil penalty. The Treasury regulations under section 7216 list some disclosures that need no consent. Many others need written consent obtained before the disclosure, signed and dated by the taxpayer, and in the format the IRS prescribes; Revenue Procedure 2013-14 gives the format guidance. Tax return information disclosed to anyone outside the United States gets stricter treatment. Whether a particular AI vendor falls under a no-consent exception is a legal question the firm should resolve with counsel, not assume. The third is data security law. Tax and accounting firms are generally covered by the FTC Safeguards Rule, which requires a written information security program. IRS Publication 4557 gives practical safeguarding guidance. Two misconceptions are common: stripping names does not make data anonymous. A combination of location, income, business type and dates can identify a client; and an enterprise AI plan does not remove the firm's obligations. It only makes them easier to meet.