The IRS Office of Professional Responsibility has issued guidance on responsible AI use in federal tax practice. Learn how CPAs can leverage AI's benefits while addressing compliance, confidentiality and professional responsibility risks.
By William R. Stromsem, CPA, J.D., George Washington University School of Business
On June 24, the IRS Office of Professional Responsibility (OPR) released an alert,
"Introductory Guidelines for Responsible AI Use in Federal Tax Practice," to provide guidelines on how CPAs must use artificial intelligence responsibly to satisfy various requirements of Circular 230. The guidance is broad and general, partly because generative artificial intelligence (GAI) is evolving and remains a moving target for regulation, and partly because of the various tools and applications being used in myriad situations. However, the alert also contains some specific requirements.
AI can make your work better, cheaper and faster, but it also has the potential for great mischief. It is commonly used by CPAs for tax research and planning, return preparation, written communications, spreadsheets, emails, and almost any other computer-based application, even when the practitioner is unaware of its use. AI evolves as it learns from information and may recognize patterns, prioritize issues and make logical decisions without human involvement.
Although the OPR alert contains few specific requirements, the issues and practices it suggests are intended to protect practitioners, clients, the IRS and the tax system, and must be considered by CPAs. There are data protection, privacy and confidentiality issues when information is provided in application queries (e.g., if client planning ideas are analyzed and then used by the application to assist another client). Additionally, AI is sometimes an overly enthusiastic helper and has even hallucinated or fabricated and authoritatively cited fake facts and cases.
The alert makes it clear that responsibility for the work lies with the practitioner and that blaming the computer will not be accepted as an excuse. The OPR enforces Circular 230, which carries potentially severe sanctions.
Circular 230 Sections Referenced in the Alert
Section 10.22–Due Diligence. The practitioner must review all AI-created documents and language before submitting a writing to the IRS or to a client and must verify the accuracy of facts, citations and calculations produced by AI.
Section 10.27(a)–Unconscionable Fees. Cost savings from AI should be passed on openly, with billing practices that reflect those savings. Practitioners should fairly credit the client's account with any cost reductions from using AI. Charging for time not spent due to AI efficiencies would violate the unconscionable fees prohibition.
Section 10.35–Competence. Practitioners must understand both the law and the technology used to represent clients before the IRS, including the operational mechanics, limitations and risks of AI systems. They should understand how AI generates content, recognize potential bias or errors, and evaluate whether AI outputs are suitable for use in IRS matters.
Section 10.36–Procedures to Ensure Compliance. Staff should be trained in the use of AI, including technology, risks and other requirements. A firm should also establish protocols for secure data handling and for monitoring AI accuracy. The firm should also vet all outside third-party AI tools.
Section 10.37–Requirements for Written Advice. Practitioners cannot rely on AI projections or representations without verification when providing written advice to clients. Citations must be checked. Financial forecasts, inputs and formulas should be confirmed. If the system s logic is opaque (i.e., the user cannot discern the facts or logic behind the information - also termed a "black box" response), reliance may not be reasonable. Practitioners should treat AI-produced advice as a draft, subject to thorough practitioner review before being presented to a client.
Section 10.51(a)(15)–Willful Disclosure or Use of Tax Return Information. GAI applications may be at risk of unauthorized disclosure of taxpayer information. Practitioners must strictly handle all client data using only secure, enterprise-approved AI and robust confidentiality safeguards must be in place when using AI systems. In addition to a potential Circular 230 violation, the alert calls practitioner attention to possible civil and criminal penalties under IRC Sections 6713 and 7216(a) for the unauthorized use or disclosure of tax return information.
OPR Best Practices for Responsible AI Use
The alert provides the following best practices for using AI:
- Identify, understand and stay updated on any relevant federal or state-specific laws, regulations and guidance that pertain to your professional activities.
- Establish secure AI data handling protocols and access controls.
- Document AI usage and verification processes.
- Foster transparency and accountability in all AI practices.
- Prepare clear procedures for handling breaches or errors.
- Provide necessary staff training.
- Vet third parties' AI offerings when or before purchasing.
- Never upload sensitive data to unsecured sites.
- Treat the written text that AI generates as drafts.
- Review the resulting documents thoroughly for factual and legal accuracy (e.g., always check citations) and any problematic bias.
Other Regulatory Considerations for CPA Use of AI
In addition to Circular 230, practitioners should be aware of the requirements of the Statements on Standards for Tax Services (SSTSs), which were revised in 2023, in part to address the use of AI, as summarized in an earlier article, How to Comply with the New SSTSs.
SSTS No. 1 provided general standards for due diligence that a member should exercise appropriate professional judgment and professional care when relying on a tool, and that use of a tool does not absolve the member of professional obligations under ethical standards. Many state CPA societies and licensing boards of accountancy have adopted the AICPA professional standards, including the SSTSs. With the OPR alert, the AICPA is likely considering interpretations of this SSTS to address recent technological developments.
The American Bar Association has also released guidance and some states have enacted legislation on transparency, reducing bias and protecting consumers when using AI.
Finally, CPAs may be held liable to clients for failing to exercise due professional care and to follow best practices when serving clients with AI.
Practice Considerations
Although some firms clearly have their act together for using AI, it might be worth considering some of the following steps to take advantage of the benefits of AI and to responsibly use it in a way that will help avoid penalties, sanctions and liability. Here are some steps you may wish to consider:
- Hold a firm meeting to review the requirements and best practices in the OPR alert and to identify current tools and uses of AI.
- Conduct training sessions to empower staff to use AI effectively and responsibly. Ask team members for suggestions for tools and uses to more powerfully serve clients. The sessions might also include an exercise in which staff members are asked to correct an AI "solution" to a research problem for completeness, accuracy and applicability to a specific client situation. This will emphasize that AI results cannot be blindly accepted and underscore the importance of human review. This will empower less-experienced staff who may lack confidence to challenge facially correct AI work and may be tempted to treat AI results as sacrosanct. Make it clear that it is the responsibility of each individual to review and raise issues and that "AI made the error" is not an acceptable excuse. This may reassure staff that they are directing an AI project rather than being just along for the AI ride and that their work is needed rather than fearing that AI will eliminate their jobs.
- Sanitize client information being given to AI and set procedures for secure access to AI tools. Require that only firm-approved AI be used for certain work.
- Keep a record of files or other client information given to AI.
- Document the use of AI in research and other applications to allow review of the accuracy and reasonableness of its use. Establish this review as a routine part of quality control.
- Assign an individual or team to develop best practices for the responsible use of AI.
- Keep a record of training and other steps taken to use AI responsibly - this may help protect against penalties, sanctions and liability.
Navigating the Opportunities and Risks of AI
In our new world of generative artificial intelligence, CPAs must learn both the power and the risks of using it in providing tax services. This power can enhance your practice by improving the quality of your work and making your firm more efficient and profitable. However, practitioners must be vigilant in protecting clients and the tax system against the risks of using AI. Failure to do so can result in penalties, sanctions and reputational loss. Please review the OPR alert, consider some of the steps outlined in this article, and keep an eye on AI technological developments and regulations.
