For CPAs, Enrolled Agents (EAs), and tax firms adopting generative AI, these requirements become particularly important when sharing client financial records, Form 1040 information, or tax-related facts with third-party AI providers.
Understanding Section 7216 AI consent requirements helps tax professionals determine when taxpayer authorization is necessary, which regulatory exceptions may apply, and how to evaluate AI-assisted tax workflows while protecting client confidentiality.
Quick Answer: Do Tax Preparers Need Client Consent to Use AI Under Section 7216?
Tax preparers need prior written or compliant electronic taxpayer consent when an AI-related use or disclosure of tax return information is not otherwise authorized under IRC Section 7216 or its regulations. The requirement depends on the information involved, processing purpose, recipient, and applicable exceptions - not simply whether the preparer uses AI.
What is IRC Section 7216 and How Does It Apply to AI Tax Tools?
IRC Section 7216 is a federal law that prohibits tax return preparers from knowingly or recklessly disclosing tax return information or using it for unauthorized purposes.
The law applies to tax return preparers and certain individuals or businesses providing services connected with tax return preparation. Its implementing regulations establish when information may be used or disclosed without separate taxpayer consent.
For AI-assisted tax workflows, two activities must be distinguished:
Use of tax return information: Employing taxpayer information for a particular purpose, such as preparing a return or conducting tax-related analysis.
Disclosure of tax return information: Making protected information available to another person or organization, including an external AI service provider.
For example, a CPA using a firm-operated AI model within an authorized, access-controlled environment may present a different compliance situation from a CPA submitting the same information to a third-party AI chatbot.
However, an AI application is not necessarily internal merely because employees access it through their firm's computers.
The firm must determine whether an external hosting provider, administrator, support team, or subprocessor can access protected taxpayer information. Any such access may require a separate disclosure analysis.
What Tax Return Information Is Protected Under Section 7216?
Under Treasury Regulation §301.7216-1, tax return information includes information furnished to a preparer for, or in connection with, preparing a taxpayer's return.
Protected information may include:
Taxpayer names, addresses, and Social Security numbers (SSNs).
Financial records received during tax preparation.
Information generated or derived in connection with preparing a return.
Tax return information is broader than personally identifiable information (PII). Financial facts and return-related details may remain protected even after names or direct identifiers are removed.
This distinction matters when deciding what information can be entered into an AI application. For related data-handling considerations, see our guide toPII and generative AI for CPAs.
When Does Section 7216 Require Taxpayer Consent for AI Use?
Client consent is required when the intended use or disclosure of tax return information is not independently authorized by Section 7216 or an applicable regulatory exception.
When is Written Taxpayer Consent Required for AI Use or Disclosure?
Under §301.7216-3, tax return preparers generally must obtain knowing and voluntary written consent, which may be executed electronically under applicable requirements, before using or disclosing tax return information for a purpose that is not otherwise authorized.
In AI-assisted workflows, consent may be required when:
A preparer shares taxpayer information with an external AI provider and no applicable disclosure exception covers the arrangement.
Tax return information is used for purposes outside authorized tax preparation activities.
A third-party AI provider retains or processes taxpayer information for independent purposes beyond the authorized engagement.
A preparer sends protected information to an external provider for substantive tax advice without an applicable exception.
AI model training deserves particular attention.
If a provider retains or uses protected tax return information to train, fine-tune, evaluate, or improve AI models beyond the authorized engagement, preparers should assume that taxpayer consent or another valid legal authorization is required before permitting that activity.
A vendor contract, legitimate business purpose, or security certification does not independently authorize disclosure.
Other permissible legal bases must arise from specific statutory or regulatory authorizations, which may include certain disclosures made pursuant to a court order under IRC §7216(b)(1).
Informing a client that the firm uses AI is not the same as obtaining legally valid Section 7216 consent.
A general statement in an engagement letter, privacy notice, or client communication does not automatically authorize every use or disclosure. When consent is required, it must satisfy the applicable regulatory requirements for the specific activity.
When Can Tax Preparers Use AI Without Taxpayer Consent?
Treasury Regulation §301.7216-2 permits certain uses and disclosures without separate taxpayer consent, provided the relevant conditions are satisfied.
Internal AI Use for Tax Return Preparation
Under §301.7216-2(c)(2), qualifying use and disclosure of tax return information among authorized personnel within the same U.S.-based tax preparation firm may be permitted for return preparation or qualifying auxiliary services.
An externally hosted AI application does not automatically qualify as an internal operation merely because the firm subscribes to it.
Disclosures to Other U.S. Tax Return Preparers
Under §301.7216-2(d)(1), a preparer may disclose information to another qualifying U.S.-based tax return preparer for specified return preparation or auxiliary services.
However, this exception does not cover services involving substantive determinations or advice affecting the tax liability reported by taxpayers.
A substantive determination involves analyzing, interpreting, or applying tax law, including advising on the tax treatment of particular taxpayer facts.
This distinction is important when an external AI provider generates recommendations about deductions, credits, income classification, or tax treatment.
AI Processing and Qualifying Contractor Services
Under §301.7216-2(d)(2), certain disclosures to contractors are permitted in connection with the programming, maintenance, repair, testing, or procurement of equipment or software used for tax return preparation.
This exception is subject to specific conditions:
Disclosed information must be limited to what is necessary for the contracted services.
Individuals receiving the information must receive written notice describing the applicability, requirements, and penalties of IRC Sections 7216 and 6713.
The activity must fall within the services permitted by the regulation.
A document-processing vendor does not automatically qualify merely because it operates domestically, performs optical character recognition (OCR), or has signed a service agreement.
The deciding factor is whether the actual service and disclosure satisfy a specific regulatory exception - not simply whether the provider uses AI or has a contract with the firm.
When Does AI Use With Client Tax Data Require Consent?
Different AI tax workflows can create different Section 7216 obligations, even when they involve the same software provider.
The following scenarios illustrate how the rules may apply.
Important: These examples are general compliance risk frameworks. They do not establish that any particular AI vendor, product, or processing arrangement complies with Section 7216.
AI tax workflow
General consent assessment
Key consideration
Researching tax laws using hypothetical facts
Generally not required
No protected taxpayer information involved
Using a genuinely internal AI model for return preparation
May qualify for permitted internal use
Authorized environment and personnel
Domestic third-party AI document processing
May qualify for an exception
Provider eligibility, service scope, and regulatory conditions
Uploading identifiable taxpayer information to a public AI chatbot
Consent or another valid authorization must be established
Potential third-party disclosure
Obtaining substantive tax advice from an external AI provider
Consent may be required
Substantive tax determination restrictions
Using protected taxpayer information for independent AI model training
Consent or another valid legal basis is generally necessary
Secondary use beyond the authorized engagement
Processing information through an offshore AI provider
Additional restrictions may apply
Overseas disclosure and SSN safeguards
Analyzing client facts after removing names and SSNs
Depends on the remaining information and use
De-identification is not an automatic exception
How Do Mechanical Processing and Substantive Tax Advice Differ Under Section 7216?
The distinction between mechanical processing and substantive tax advice is especially important when evaluating AI tax research tools. Lets understand these with two examples.
Example 1: Mechanical Tax Return Processing
A U.S. tax preparation firm sends taxpayer information to a qualifying domestic tax return processor. The processor transfers the information onto a tax return and performs mechanical processing without independently interpreting tax law or providing substantive tax advice.
When the regulatory requirements are satisfied, the disclosure may qualify for the exception under §301.7216-2(d)(1).
Example 2: AI-Assisted Substantive Tax Advice
A CPA submits client financial information to an outside provider and asks whether particular business expenses qualify for deductions under federal tax law.
The provider evaluates the facts, interprets tax rules, and recommends a treatment affecting the reported tax liability.
Because the activity involves substantive tax analysis, the preparer cannot automatically rely on the domestic preparer-to-preparer exception.
The IRS illustrates this distinction in Treasury Regulation §301.7216-2(d)(3), Example 4, involving a preparer who sends taxpayer information to another firm for advice about a business expense deduction.
For professionals using AI-assisted tax research, the relevant legal question is whether protected information is disclosed and whether the particular disclosure is authorized—not merely whether the AI tool assists with tax preparation.
How Do AI Data Processing Practices Affect Section 7216 Consent?
Three additional factors can change the compliance assessment of an AI workflow.
Does Anonymizing Client Tax Data Eliminate Consent Requirements?
Removing taxpayer names, addresses, and Social Security numbers can reduce direct identification risks.
However, anonymization is not an automatic Section 7216 exemption.
Other details, including transaction amounts, financial circumstances, and information obtained during return preparation, may still qualify as tax return information.
Although§301.7216-2(o) permits limited uses and disclosures of statistical compilations under specified conditions, it does not create a general exception allowing preparers to share de-identified client information with any AI provider.
Does AI Model Training Require Taxpayer Consent?
A provider processing information solely to perform an authorized service presents a different situation from one retaining information for independent model development.
Tax professionals should distinguish between processing information for a requested tax-related task and retaining it for model training, evaluation, fine-tuning, or unrelated product improvement.
Authorization for return preparation does not automatically extend to independent secondary processing.
When Does Offshore AI Processing Require Taxpayer Consent?
Location matters when evaluating permitted disclosures.
Under §301.7216-2(c)(2), disclosure of taxpayer information to another employee or member of the same preparer located outside the United States generally requires prior consent when the information was initially furnished to a U.S.-based preparer.
The preparer-to-preparer exception in §301.7216-2(d)(1) is also limited to qualifying U.S.-based recipients.
A U.S.-based server does not automatically eliminate offshore disclosure concerns.
For example, §301.7216-2(d)(3), Example 3 describes an overseas contractor accessing taxpayer information stored on a U.S. server. Even though the information is not downloaded or printed, the overseas access constitutes a disclosure requiring consent.
Specific restrictions also apply to offshore disclosures of taxpayer Social Security numbers.
Under §301.7216-3(b)(4), a U.S.-based preparer generally cannot obtain consent to disclose a Form 1040-series taxpayer's SSN to a foreign preparer unless the regulatory exception involving adequate data protection safeguards is satisfied.
Tax firms should therefore verify where AI providers, support personnel, and subprocessors can access taxpayer information—not just where the data centers are located.
How Can Tax Preparers Obtain Valid Section 7216 Consent for AI?
When consent is legally required, it must be obtained before the relevant use or disclosure occurs.
What Information Must a Section 7216 Consent Form Include?
A valid consent generally must identify the information and activity being authorized.
Depending on the taxpayer and type of consent, the required elements include:
Taxpayer and preparer identification: The parties associated with the authorization.
Information covered: The tax return information to be used or disclosed.
Specific purpose: The reason for the proposed use or disclosure.
Recipient identification: The person or organization receiving the information, where applicable.
Consent duration: The period for which authorization remains effective.
Affirmative authorization: The taxpayer's knowing, voluntary, signed and dated consent.
For taxpayers filing Form 1040 or another return in the Form 1040 series, Revenue Procedure 2013-14 prescribes additional formatting, content, and mandatory language requirements.
Under §301.7216-3(c)(1), multiple uses may be authorized within one consent document, and multiple disclosures may be authorized within another. However, a single document cannot authorize both uses and disclosures.
Can an Engagement Letter Satisfy Section 7216 Consent Requirements?
The answer depends partly on the taxpayer's return type.
For Form 1040-series taxpayers, consent must meet the prescribed IRS requirements. A properly formatted separate consent document may accompany an engagement letter, but a generic AI disclosure clause is insufficient.
For taxpayers not filing Form 1040-series returns, §301.7216-3(a)(3)(iii) permits consent in other formats, including a compliant engagement letter, provided the applicable requirements are satisfied.
When Must Taxpayer Consent Be Obtained and When Does It Expire?
A tax preparer must obtain valid consent before making a use or disclosure that requires authorization. Obtaining consent afterward does not retroactively authorize an earlier impermissible disclosure.
Other requirements include:
Section 7216 Consent Duration
Under §301.7216-3(b)(5), a consent document may specify its duration. If no duration is stated, consent to use or disclose tax return information generally remains effective for one year from the date the taxpayer signed it.
The specified duration must comply with the applicable regulatory requirements.
Electronic Consent and Signature Requirements
Electronic consent must meet the IRS's prescribed signature and affirmative authorization standards.
For Form 1040-series taxpayers, Revenue Procedure 2013-14 establishes additional requirements. A passive acknowledgment, preselected checkbox, or simple click-through that does not satisfy the required signature process may be insufficient.
Voluntary Taxpayer Authorization
Under §301.7216-3(a)(2), consent generally may not be conditioned on the taxpayer's use of the preparer's services, subject to a limited exception involving certain disclosures to another tax return preparer for preparation or auxiliary services.
Consent for an unrelated use or disclosure should not be presented as a prerequisite to receiving tax preparation services.
Consent Documentation and Recordkeeping
Preparers must comply with the applicable consent documentation and retention requirements. Under §301.7216-3(c)(3), the taxpayer must also receive a copy of the executed consent or an opportunity to print or save it electronically.
Revenue Procedure 2013-14 specifies additional requirements for Form 1040-series consents. The IRS subsequently issued Revenue Procedure 2013-19, modifying the effective date of certain mandatory-language provisions.
What are the Criminal and Civil Penalties for Section 7216 Violations?
Unauthorized use or disclosure of tax return information can result in criminal penalties under IRC Section 7216 and civil penalties under IRC Section 6713.
Violation
Statutory penalty
General criminal violation — IRC §7216(a)
Fine up to $1,000, imprisonment up to one year, or both, plus prosecution costs
General civil violation — IRC §6713(a)
$250 per unauthorized use or disclosure, generally capped at $10,000 per person per calendar year
Qualifying identity-theft-related criminal violation — IRC §7216(a)
Fine up to $100,000, imprisonment up to one year, or both, plus prosecution costs
Qualifying identity-theft-related civil violation — IRC §6713(b)
$1,000 per violation, subject to a separate $50,000 annual cap per person
Under IRC §7216(a), the criminal offense involves knowing or reckless unauthorized use or disclosure of taxpayer information.
For qualifying identity-theft-related conduct, §7216(a) increases the maximum criminal fine to $100,000 while retaining the one-year maximum imprisonment term.
IRC §6713(b) separately establishes enhanced civil penalties for qualifying identity-theft-related violations.
These figures are statutory penalty amounts, not statistics about AI-specific enforcement cases.
The IRS's 2026 responsible AI guidance also discusses potential professional disciplinary concerns under Circular 230, including §10.51(a)(15), which addresses willful unauthorized use or disclosure of tax return information.
How Can Tax Preparers Assess AI Software for Section 7216 Compliance?
Before submitting taxpayer information to an AI platform, tax professionals should evaluate both the legal authority for the workflow and the provider's actual data-handling practices.
The following checklist can support that assessment.
Question
What the firm should verify
What taxpayer information will the AI receive?
Whether protected tax return information is involved
Is the AI system internal or externally hosted?
Whether information remains within an authorized environment or is disclosed externally
What will the provider do with the information?
Whether processing is limited to an authorized purpose
Recipient eligibility, permitted services, and regulatory conditions
Is taxpayer consent required?
Whether valid prior authorization has been obtained and documented
Security controls and legal authorization should be evaluated separately.
Encryption, access restrictions, anonymization, and contractual limitations can reduce confidentiality risks. They do not, by themselves, create an exception under Section 7216.
The IRS's 2026 generative AI guidelines recommend secure, enterprise-approved AI systems, vendor evaluation, confidentiality safeguards, and independent professional verification of AI-generated tax advice.
For firms adopting AI, the appropriate approach is to assess both documented data protection controls and the legal basis for the intended processing arrangement.
How CPA Pilot Protects Client Tax Data in AI-Assisted Workflows
At CPA Pilot, we built an AI tax assistant for CPAs, Enrolled Agents (EAs), and U.S. tax firms. Our tax-focused workflows support professional research, return review, client communications, planning, and other tax-related activities.
For firms evaluating Section 7216 requirements, we offer documented data protection measures designed to reduce the exposure of sensitive client information.
These include:
Local anonymization: We anonymize client-identifying information on the user’s computer before it is transmitted to CPA Pilot.
TLS encryption: We use TLS encryption to protect information transmitted between users and our platform.
AES-256 encryption: We use AES-256 encryption to protect information stored on our platform.
No client-data model training: We do not use client documents, prompts, or generated outputs to train CPA Pilot’s AI models.
Provider data restrictions: We contractually restrict our AI processing providers from using client information for model training.
Access controls and audit logging: We use access controls and audit logging to support oversight of platform access and activity.
These safeguards are intended to reduce data-handling risk. They should not, however, be confused with automatic legal authorization under Section 7216.
Local anonymization, encryption, and no-training commitments are data protection controls - not statutory exceptions under Section 7216. Whether an exception applies depends on the nature of the service provided, the recipient’s eligibility, the information involved, and the firm’s actual data flow.
Tax professionals remain responsible for determining whether their use of CPA Pilot involves protected tax return information, whether that information is disclosed to another person or organization, whether a regulatory exception applies, and whether prior taxpayer consent is required.
Disclaimer: This section describes CPA Pilot’s data protection practices and does not constitute legal advice. It does not determine whether a particular AI workflow requires taxpayer consent under Section 7216.
Section 7216 does not automatically prohibit AI-assisted tax preparation or require taxpayer consent for every AI task.
Before using an AI tool with client information, tax preparers should determine whether the workflow involves protected tax return information, identify external disclosures, evaluate applicable regulatory exceptions, and obtain valid prior consent when necessary.
Choosing AI software with documented confidentiality controls can support responsible adoption, but professional judgment and legal authorization remain essential.
Explore CPA Pilot's AI Tax Research and Data Protection Features
CPA Pilot combines tax-specific AI workflows with local anonymization, encryption, and model-training restrictions to help tax professionals evaluate data protection risks while maintaining professional oversight.
Can Tax Preparers Use ChatGPT Without Taxpayer Consent?
Yes, for general research without protected taxpayer information. Public chatbots should not receive actual client tax data unless the firm establishes a valid Section 7216 basis and appropriate security controls. Even client facts without names or SSNs may remain protected.
Does an Engagement Letter Qualify as Section 7216 Consent?
Sometimes. A compliant engagement letter may establish consent for non-Form 1040-series taxpayers. Form 1040-series consents must satisfy additional IRS requirements, and a generic AI disclosure clause is insufficient.
Does Removing Names and SSNs Exempt AI Use From Section 7216?
No. Removing identifiers reduces exposure but does not automatically eliminate Section 7216 obligations. Remaining financial facts or return-related information may still qualify as protected tax return information.
Does Section 7216 Require Separate Client Consent for Each AI Tool?
Section 7216 allows one consent document to authorize multiple disclosures if each recipient, purpose, and information category is properly identified. Tax preparers must obtain new consent when an AI disclosure falls outside existing authorization.
Can Tax Preparers Continue Preparing Returns if Clients Refuse AI Consent?
Tax preparers can generally provide tax preparation services without optional AI consent. Section 7216 requires voluntary authorization, except for certain qualifying preparer-to-preparer disclosures necessary for preparation or auxiliary services.
Does Section 7216 Apply to AI-Generated Tax Reports and Client Summaries?
Section 7216 can protect AI-generated tax reports, summaries, and recommendations derived from client return information. Tax preparers must evaluate whether subsequent use or disclosure is authorized, even when AI creates the output.
Does Section 7216 Require Tax Preparers to Obtain Consent for AI-Powered Client Marketing?
Section 7216 generally requires taxpayer consent before tax preparers use protected return information for unrelated marketing. AI-generated promotional emails, personalized offers, and cross-selling based on client tax data may require consent.
Can Tax Preparers Use One Section 7216 Consent Form for Multiple Tax Years?
Section 7216 permits consent documents to specify their duration. Without a stated period, consent generally expires after one year. Multi-year AI disclosures must remain within the consent's authorized information, recipients, purposes, and duration.
Key Takeaways
5 essential insights
AI use does not automatically require client consent: Section 7216 requires taxpayer consent when AI-related use or disclosure of tax return information is not covered by an applicable regulatory exception.
Tax return information extends beyond personal identifiers: Removing names, Social Security numbers, or other identifying details does not automatically exempt client financial data from Section 7216 protections.
Third-party AI processing requires careful evaluation: Tax preparers must assess external AI providers, model training practices, offshore access, and the purpose of data processing before sharing protected taxpayer information.
Valid taxpayer consent must meet IRS requirements: When consent is required, tax preparers must obtain it before the use or disclosure, clearly identify the authorized information and purpose, and comply with applicable consent and documentation rules.
AI security safeguards do not replace legal compliance: Encryption, anonymization, and no-training policies help protect client data but do not independently authorize disclosures. Unauthorized use or disclosure may result in civil and criminal penalties under Sections 6713 and 7216.
I’m Harsh Mody, CPA, founder of CPA Pilot—an AI Tax Assistant for CPAs, Enrolled Agents, and U.S. tax firms. With 18+ years in accounting, tax auditing, consulting, and product management, I’ve seen how compliance-heavy work limits true advisory impact. I built CPA Pilot to change that—by applying AI-driven tax research, deduction optimization, and IRS/state code automation to help firms unlock tax savings and scale advisory services with speed and accuracy.
