A staff accountant pastes a client's trial balance into a chat window to ask why a ratio moved. In one keystroke the firm has disclosed confidential client information to a third party. Whether that was permitted depends on three layers of rules, and the layers do not all point to the same answer.
This post covers each layer in the order a firm should work through them.
Layer 1: the AICPA confidentiality rule
The AICPA Code's Confidential Client Information Rule (ET 1.700.001) starts from a simple premise: a member may not disclose confidential client information without the client's specific consent, subject to the rule's existing exceptions. The revised rule did not change the substance of the former Rule 301, so its existing exceptions still apply.
An AI tool is a third party. The Code's interpretation on disclosing information to a third-party service provider (ET 1.700.040) gives the member two routes:
- Contract. Enter into a contractual agreement with the provider to maintain the confidentiality of the information, and have reasonable assurance that the provider has appropriate procedures in place to prevent unauthorized release of the confidential information.
- Consent. Obtain the client's specific consent before disclosing the confidential information to the provider.
As a practice point, get consent in writing and have it name the information to be disclosed, the type of provider and the intended use.
Two consequences follow for AI tools:
- Consumer-grade terms are rarely enough. If a provider's terms allow it to retain inputs, use them to train models or let its personnel read them, you do not have a contract that "maintains confidentiality." You are in route 2, and the client has to consent to that specific use.
- Reasonable assurance is a documentable act. Review the provider's data handling terms, retention, access controls and the security reports it can produce, and keep a copy of what you reviewed and when.
Layer 2: IRC Section 7216 for tax return information
If the client data is tax return information, a statute sits on top of the Code. Internal Revenue Code Section 7216 makes it a misdemeanor for a person engaged in the business of preparing, or providing services in connection with preparing, tax returns to disclose or use tax return information other than for return preparation, subject to exceptions in the statute and regulations. The penalty is a fine of up to $1,000, imprisonment of up to one year, or both, plus costs of prosecution; where the disclosure or use is one to which Section 6713(b) applies, the fine can be up to $100,000.
The statute's own exceptions include disclosures and uses permitted by Treasury regulations, and the statute requires those regulations to permit disclosure or use for quality or peer reviews. Treasury's Section 7216 regulations set the consent rules that apply when a preparer wants to disclose tax return information to a provider outside the exceptions.
The practical rule: a firm that prepares returns should treat tax return information as its own, higher tier. Sending it to an AI provider without a basis under the regulations is a statutory problem, not only an ethics problem. Where a CPA's practice includes both audit and tax work for the same client, the data in the audit file can include tax return information, so the tiering has to follow the data, not the engagement type.
Layer 3: the FTC Safeguards Rule
The FTC's Safeguards Rule (16 CFR Part 314) applies to financial institutions within the FTC's jurisdiction, defined by activities that are financial in nature or incidental to them. The rule's list of examples expressly includes tax preparation firms; it does not name audit firms, so whether an audit-only practice is within the rule depends on whether its activities fall within the definition. A firm that does tax work should assume coverage.
Where it applies, the rule requires an information security program with specific elements, including:
- a designated qualified individual responsible for overseeing and implementing the program (§ 314.4(a))
- a written risk assessment (§ 314.4(b))
- access controls, encryption of customer information held or transmitted, and multi-factor authentication for any individual accessing any information system, unless the qualified individual approves in writing an equivalent or stronger control (§ 314.4(c))
- regular testing of key controls, annual penetration testing and vulnerability assessments at least every six months (§ 314.4(d))
- security awareness training (§ 314.4(e))
- oversight of service providers: reasonable steps to select and retain providers that can maintain appropriate safeguards, and periodic reassessment of them based on risk (§ 314.4(f))
- a written incident response plan (§ 314.4(h))
- a written report to the board or senior officer at least annually (§ 314.4(i))
- notice to the FTC no later than 30 days after discovery of a notification event involving the information of at least 500 consumers (§ 314.4(j))
An AI provider that receives customer information is a service provider under the rule. The provider-oversight and incident provisions apply to it the same way they apply to a payroll processor or cloud storage vendor.
Reconciling the layers
| Question | AICPA ET 1.700 | IRC 7216 | FTC Safeguards Rule |
|---|---|---|---|
| What triggers it? | Confidential client information | Tax return information held by a preparer | Customer information held by a covered financial institution |
| What permits AI use? | Confidentiality contract with reasonable assurance, or client consent | Exceptions in the statute and regulations, or consent that meets the regulations | A service provider selected, retained and monitored with appropriate safeguards |
| What does a failure look like? | Disciplinary exposure | Misdemeanor penalties | FTC enforcement and notification duties |
The strictest applicable layer controls for each category of data.
A workable control set
- Classify data before you classify tools. Public, client financial, and tax return or identity data are three different tiers. The AI governance framework shows how to tie approved tools to tiers.
- Approve tools in writing. Record the contract terms you relied on, including no training on inputs and retention limits.
- Block what is not approved. Policy without technical enforcement is a suggestion.
- Say it in the engagement letter. If the firm uses third-party tools on client data, the letter is the natural place to state it and to capture consent. See the audit engagement letter guide.
- Train staff on the stop rule. If you are unsure whether data may go into a tool, it does not go in.
- Plan for the misdirected upload. Know who is told, how fast, and what the contract with the provider lets you demand.
AI in auditing for small CPA firms covers how these controls fit into daily tool use.
Frequently asked questions
Does using AI require client consent every time?
No. Under ET 1.700.040 the member can instead have a confidentiality contract with the provider and reasonable assurance of its procedures. Consent is the route when that contract is not in place.
Is de-identified data safe to use?
Removing names reduces risk but does not end the analysis. Financial statements and ledgers often identify a client by their content, so test whether the data could be traced back before treating it as non-confidential.
Does the Safeguards Rule apply to audit-only firms?
The rule applies to financial institutions as defined by its activities test, and its examples name tax preparation firms, not audit firms. A firm doing any tax work should plan for coverage.
Sources
- AICPA Code of Professional Conduct, ET 1.700.001 (Confidential Client Information Rule), and ET 1.700.040 (disclosing information to a third-party service provider), as summarized in Journal of Accountancy, "AICPA confidentiality rule" (March 2015): https://www.journalofaccountancy.com/issues/2015/mar/aicpa-confidentiality-rule/
- Internal Revenue Code Section 7216 (26 U.S.C. 7216): https://www.law.cornell.edu/uscode/text/26/7216
- 16 CFR 314.1, Purpose and scope of the Safeguards Rule: https://www.law.cornell.edu/cfr/text/16/314.1
- 16 CFR 314.4, Elements of the information security program: https://www.law.cornell.edu/cfr/text/16/314.4
- PCAOB, Spotlight: Staff Update on Outreach Activities Related to the Integration of Generative Artificial Intelligence in Audits and Financial Reporting (July 2024): https://pcaobus.org/documents/generative-ai-spotlight.pdf
CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.
Part of CORAA University · Quality management and practice: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error