IRC 7216 and AI: what tax preparers should settle before tax season

You want AI to summarize a client's brokerage statement, or draft a letter about their return. Before you paste, one federal rule applies: Internal Revenue Code section 7216. This is the short version for a preparer, enrolled agent or CPA firm. It is based on the statute, the Treasury regulations and IRS documents, listed at the bottom.

What section 7216 says

• Who it covers. Anyone in the business of preparing returns, or of providing services in connection with preparing them, and anyone paid to prepare one.
• What it bans. Knowingly or recklessly disclosing information furnished for a return, or using it for anything other than preparing the return, unless an exception applies or the client consents.
• The criminal penalty. A misdemeanor, with a fine of up to $1,000, up to one year in prison, or both. The fine cap is $100,000 in identity theft cases. The statute text is on Cornell LII.
• The civil penalty. Section 6713 adds $250 per disclosure or use, up to $10,000 a year. In identity theft cases it is $1,000 each, up to $50,000.
• Software counts too. The regulations treat a person providing auxiliary services, including someone who develops tax software, as a tax return preparer.

What counts as tax return information

The definition is wide. Treasury Regulation 301.7216-1(b)(3) says it is:

"any information, including, but not limited to, a taxpayer's name, address, or identifying number, which is furnished in any form or manner for, or in connection with, the preparation of a tax return"

It also covers information you derive from that data while preparing the return. And a "disclosure" is making it known to any person, in any manner.

Taking names out does not take data outside the rule

This catches people. The regulations say tax return information includes statistical compilations, "even in a form that cannot be associated with, or otherwise identify, directly or indirectly, a particular taxpayer." So de-identified return data is still tax return information. Removing identifiers lowers what is exposed. It does not end the 7216 question.

What is unsettled about AI

We found no IRS guidance that says whether sending return information to an AI tool is a "disclosure" under section 7216. A CPA Practice Advisor article from October 12, 2026 says the same. Three open questions follow:

• Is the AI vendor a contractor under the exceptions? Regulation 301.7216-2(d) lets you disclose to other preparers and to contractors in the United States who help prepare the return, with a written notice of sections 6713 and 7216. Those contractors become preparers under the rule. Whether a general AI company fits is a question for your counsel.
• Where is the data processed? Disclosure to someone outside the United States needs the client's consent. For Form 1040 filers, the preparer must also mask the SSN before return information leaves the country, unless an adequate data protection safeguard is in place. Ask your vendor where your inputs go.
• What does the vendor do with your inputs? Keeping them, training on them, or letting staff review them each widen who knows the information.

What the IRS has said about AI

On June 24, 2026, the IRS Office of Professional Responsibility issued Issue Number 2026-19, "Introductory Guidelines for Responsible AI Use in Federal Tax Practice." It says:

"GAI platforms may present risks regarding the unauthorized disclosure of sensitive taxpayer information, especially when data is uploaded to unsecured or public systems."

It tells practitioners to handle client data only with secure AI tools cleared by their firm. It does not mention section 7216 consent.

How 7216 consent works

If you decide a use or disclosure needs consent, Regulation 301.7216-3 and Revenue Procedure 2013-14 set the form:

• Written, and before. You get the signed consent before you disclose or use the information. It must be knowing and voluntary.
• Separate. Each separate disclosure or use goes on its own document. Disclosure consents and use consents are separate documents too.
• Signed by the taxpayer. An opt-out consent is not allowed. Paper consents use at least 12-point type.
• Mandatory wording. Rev. Proc. 2013-14 lists statements every consent must carry, plus extra wording for disclosure outside the United States.
• One year by default. A consent with no stated duration lasts one year from the date it is signed.

The CPA Practice Advisor article suggests a standalone, signed AI consent, worded with your counsel. Plan for the client who says no, too. Have a way to do their work without AI.

Your security plan should name your AI tools

IRS Publication 4557 says that under the FTC Safeguards Rule, tax return preparers must create and enact security plans to protect client data. If staff use AI tools, those tools belong in your written information security plan: which tools, for what, and what may go into them.

Five steps before tax season

1. List the AI tools in your office. Include browser extensions and AI built into your tax, document or email software.
2. Read each tool's terms. Where is data processed? Is it kept, trained on, or reviewed by staff? Can you turn that off?
3. Decide where you need consent. Work it out with counsel. Where you do, use a standalone signed consent in the Rev. Proc. 2013-14 format, signed before the data goes in.
4. Take identifiers out first. Before anything is pasted, replace SSNs, names, addresses, account numbers and dates of birth. Keep only the numbers the task needs.
5. Write it into your security plan. Name the tools you allow and what may go into each. Keep a note of what went where.

How to do step 4 with KeptPDF

Anonymize for AI looks for names, dates of birth, Social Security numbers, driver's license numbers, account numbers, addresses and phone numbers. It swaps each one for a numbered placeholder like [PERSON_1]. It runs in your browser. The file is not uploaded to KeptPDF.

It does not catch every kind of detail on a return. Check the rest of the text yourself for anything that points to the client.

1. Open Anonymize for AI and drop in a PDF or Word file, or paste text.
2. Review what it found. Add anything it missed.
3. Copy the anonymized text into ChatGPT, Claude or whatever you use.
4. Put the real values back. Paste the AI's answer into the restore box. Keep the tab open until you have done this.

One honest note. The cleaned text you paste does go to the AI company. That is the point. And as above, anonymized return data is still tax return information under the regulations, so this step reduces what is exposed. It does not answer the consent question for you. If a detail does not need to reach anyone, the Redact tool removes it from the PDF for good.

Sources

The primary sources are the statute, the regulations and IRS documents. The CPA Practice Advisor article is commentary. Outside the short quotes above, we summarize in our own words.

• 26 U.S.C. 7216: Disclosure or use of information by preparers of returns (Cornell LII)
• 26 U.S.C. 6713: Disclosure or use of information by preparers of returns, civil penalty (Cornell LII)
• 26 CFR 301.7216-1: definitions (Cornell LII)
• 26 CFR 301.7216-2: permitted disclosures and uses without consent (Cornell LII)
• 26 CFR 301.7216-3: disclosure or use permitted only with consent (Cornell LII)
• IRS: Revenue Procedure 2013-14, consent format
• IRS: Section 7216 frequently asked questions. The IRS marks this page as historical content.
• IRS Office of Professional Responsibility: Issue Number 2026-19, Introductory Guidelines for Responsible AI Use in Federal Tax Practice (June 24, 2026)
• IRS Publication 4557: Safeguarding Taxpayer Data
• CPA Practice Advisor: What to settle before client tax data touches AI (October 12, 2026). Commentary, not IRS guidance.

This is not tax or legal advice. It is a plain-English summary for general information. Talk to your own counsel about your practice before you set an AI policy.