Grady, the owner of Lighthouse Accounting LLC in the episode’s case study, has a capacity problem. In the previous episode of Tax in Action, he considered hiring employees, outsourcing work, or selling his firm. Now he’s asking, “What if technology could solve the problem?”
New software might automate some of the work. AI might reduce the need for seasonal staff. But adding technology creates its own risks, especially when client information leaves the firm.
In this episode, host Jeremy Wells, EA, CPA, explains why Section 7216 is only the starting point. Tax professionals must also consider the Gramm-Leach-Bliley Act (GLBA), the FTC Safeguards Rule, their written information security program (WISP), vendor oversight, SOC 2 reports, and the professional duties that apply when AI helps perform the work.
Three questions connect these rules:
- May we share the client’s information?
- Are we protecting it appropriately?
- Is a human still exercising professional judgment?
Section 7216 is only the first layer
Section 7216 generally prohibits a tax return preparer from using or disclosing tax return information unless an exception applies or the taxpayer provides written consent.
One exception covers certain “auxiliary services.” Certain disclosures for auxiliary services connected with tax return preparation are permitted without taxpayer consent. These services can include processing, storage, transmission, and software support. But the exception is not blanket permission to share client information with any technology provider. Firms must evaluate the services performed, where information will be disclosed, and the conditions of the applicable exception. Special requirements can apply to overseas disclosures, substantive tax determinations, and certain software-support contractors.
Without that exception, Jeremy notes, firms might be stuck using pencil and paper.
But Section 7216 only governs the use and disclosure of tax return information. It doesn’t tell you whether your firm or the provider has adequate safeguards. And disclosure can include both an intentional transmission and an unauthorized release, such as a data breach or someone viewing client information over your shoulder.
Once you determine that a disclosure is allowed, you must move to protecting the information.
GLBA creates the duty to protect client information
The Gramm-Leach-Bliley Act says financial institutions have an “affirmative and continuing obligation” to respect customer privacy and protect nonpublic personal information. It calls for administrative, technical, and physical safeguards that:
- Preserve the security and confidentiality of customer records
- Protect against expected threats or hazards
- Prevent unauthorized access that could cause substantial harm or inconvenience
GLBA appears in Title 15 of the U.S. Code rather than the Internal Revenue Code. It doesn’t specifically name accountants or tax preparers. Instead, the FTC’s regulations treat tax preparation firms as financial institutions because they engage in financial activities.
That means strict compliance with Section 7216 may not satisfy a firm’s broader information-security obligations. For those requirements, we must look at the FTC Safeguards Rule.
Your WISP should guide your technology choices
The FTC Safeguards Rule, found at 16 CFR Part 314, requires covered firms to develop, implement, and maintain a written information security program. The program must fit the firm’s size and complexity, the nature and scope of its work, and the sensitivity of the information it holds.
A solo practitioner and a national firm with 5,000 employees won’t need identical controls. That is why a generic WISP template isn’t enough. The document must reflect how your firm operates.
A WISP should address areas such as:
- Risk assessment and security safeguards
- Incident response
- Employee training
- Vendor selection and oversight
- Document retention and secure disposal
- Ongoing monitoring and updates
Some specific requirements have a small-firm exception. Firms maintaining customer information concerning fewer than 5,000 consumers are exempt from certain provisions, including the prescribed written incident response plan. They must still maintain a written information security program, and planning how to respond to an incident remains a sound practice.
The firm must also designate a Qualified Individual to oversee and implement the program. That person may work within the firm or for an affiliate or service provider, such as an outside IT firm. If the role is outsourced, the firm retains responsibility for compliance and must designate a senior employee to oversee the outside Qualified Individual. The affiliate or service provider must also maintain an information security program that protects the firm.
These duties apply whether your firm stores records in the cloud or in locked filing cabinets. Paper records still create questions about access, retention, destruction, and oversight of shredding providers.
Most importantly, software should conform to the WISP, not the other way around. Before adopting a new tool, ask what risks it creates, how you’ll manage those risks, who will oversee implementation, and whether you need to update the WISP. Because technology keeps changing, the WISP must be a living document.
That ongoing process also requires firms to evaluate the vendors behind their technology.
A SOC 2 report provides evidence, not certainty
The Safeguards Rule requires firms to take reasonable steps to select and retain service providers capable of maintaining appropriate safeguards, require those safeguards by contract, and periodically assess providers based on their risks and the continued adequacy of their safeguards.
Most firm owners can’t personally inspect a vendor’s servers, personnel, or access controls. A SOC 2 report helps fill that gap. In a SOC 2 engagement, an independent CPA examines controls related to one or more AICPA Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy.
There are two main report types:
- Type 1 evaluates the design of controls as of a specified date
- Type 2 evaluates both the design and operating effectiveness of controls over a period
A Type 2 report is generally more useful for an established vendor. Still, neither report certifies that a vendor is breach-proof. As Jeremy explains, it is “just one piece of evidence.” Firms should check the report type, the date or period covered, and whether the vendor continues to maintain its controls.
Vendor reports help with oversight, but they don’t transfer accountability away from the firm. The same principle applies when the technology uses AI.
Treat AI like a junior staff member
On June 24, 2026, the IRS Office of Professional Responsibility published OPR Alert 2026-19, its first guidance on artificial intelligence. Although the alert did not amend Circular 230 or create a separate set of AI rules, it explained how existing duties apply to AI-assisted work.
Those duties include due diligence, competence, supervision, written advice, and fees. Practitioners must still review client inputs and firm outputs, understand a tool’s limits, supervise AI-assisted workflows, and ensure written advice meets professional standards.
The alert also cautions against billing for time not actually spent or double billing for AI-assisted tasks, and calls for transparency about AI-related cost savings. Jeremy emphasizes that firms using time- or cost-based billing should review whether their charges fairly reflect those efficiencies under the client agreement.
Jeremy recommends treating AI like a junior staff member, not an unsupervised practitioner or business partner. AI can draft client messages, support research, assist with return preparation, or perform bookkeeping tasks. It can also make mistakes, produce unsupported answers, and tell users what it thinks they want to hear.
Jeremy’s point is that professional judgment and responsibility remain with the human practitioner.
Keep three questions in every technology review
For Grady, choosing technology to expand his firm’s capacity means evaluating more than how much time a tool might save. He needs to establish whether he may share client information, how it will be protected, and who will review the work. The same three questions belong in every firm’s technology review:
- May we share the information this way? Apply Section 7216 and determine whether an exception permits the proposed use or disclosure or valid taxpayer consent is required.
- Are we protecting it appropriately? Follow a firm-specific WISP and continue monitoring vendors.
- Are we still exercising professional judgment? Review the work and take responsibility for the result.
For Jeremy’s complete explanation and the rest of Grady’s case study, listen to Episode 36 of Tax in Action.