What should an AI policy for an accounting firm cover?

Which AI tools and accounts are approved, what data may go into them, how AI output is reviewed before it's relied on, how vendors are vetted, how clients are told, and what to do if client data is exposed. Tax firms also need rules for tax return information under Section 7216, and firms covered by the FTC Safeguards Rule should tie the policy to their written information security plan.

Do accounting firms need an AI policy?

No rule we found requires a standalone AI policy, but the obligations it records apply to many firms: Section 7216 limits on tax return information, the Safeguards Rule's service-provider oversight, and, for AICPA members, the Code's rules on third-party service providers. A written policy is how staff know the rules and how the firm shows it follows them.

Can staff use ChatGPT or other AI assistants at work?

That's the firm's decision. If it allows them, the template limits use to firm business accounts on plans whose terms exclude customer content from model training by default, and to the data listed in the approved tools register. See AI chatbots for accounting for each provider's terms.

Is this template legal advice?

No. It's a starting draft built from the regulations and guidance listed below. Have it reviewed against your state rules, engagement letters and insurance requirements before you adopt it.

AI acceptable use policy template for accounting firms

A starting draft of an AI policy for an accounting or tax practice. Tell it what applies to your firm, then copy the text into your policy document or print it. The guides linked below explain the rules the clauses refer to.

Reviewed October 15, 2026. By AI Accounting Vendors. Not legal advice.

10 sections, 33 clauses.

[Firm name]: AI acceptable use policy

Policy owner: [Policy owner]. Effective date: [date].

1. Purpose and scope

1.1This policy sets out how partners, employees and contractors of [Firm name] may use artificial intelligence (AI) tools in firm and client work.
1.2It covers general-purpose AI assistants, AI features built into accounting, tax, audit and practice management software, and any other software that generates text, figures or decisions from data the firm provides.
1.3Where this policy and a client's engagement terms differ, the stricter rule applies.

2. Responsibilities

2.1[Policy owner] owns this policy, keeps the approved tools register in Appendix A, and approves exceptions in writing.
2.2The firm's Qualified Individual under the FTC Safeguards Rule reviews each AI tool that will receive client information as a service provider under the firm's written information security plan (WISP).
2.3Each person using an AI tool is responsible for the data they enter and for reviewing what it produces.

3. Approved tools and accounts

3.1Only AI tools listed in Appendix A may be used for firm or client work, and only for the uses and data types listed there.
3.2Personal accounts, free tiers and browser extensions that are not on the register may not be used with firm or client information.
3.3General AI assistants may be used only through the firm's business accounts listed in Appendix A, on plans whose terms say customer content is not used to train the provider's models by default.
3.4New tools and new AI features in existing software are added to the register only after the vendor review described under "Vendor review" below.

4. What may and may not be entered

4.1Enter only the minimum information needed for the task. Remove or mask client names and identifiers where the task doesn't need them.
4.2Never enter passwords, multi-factor codes, full bank or card account numbers, or taxpayer identification numbers into an AI tool unless Appendix A specifically approves that tool for that data.
4.3Client confidential information may be entered only into tools approved in Appendix A for client data.
4.4Do not upload documents received from a client into a tool that is not approved for client data, including for summarizing or translation.

5. Tax return information (Section 7216)

5.1Tax return information, as defined in 26 CFR 301.7216-1, may be disclosed to or used in an AI tool only where 26 CFR 301.7216-2 permits it without consent, or the taxpayer has first given written consent that meets 26 CFR 301.7216-3 (and Rev. Proc. 2013-14 for Form 1040-series filers).
5.2Where a tool is used under the contractor rule in 301.7216-2(d)(2), disclosure is limited to what is necessary, and each individual at the vendor who receives the information is given written notice of the penalties under sections 7216 and 6713.
5.3No tax return information goes to a tool that processes it outside the United States without the taxpayer's prior consent. Social Security numbers of Form 1040-series taxpayers are masked before any disclosure outside the United States unless the taxpayer consents to disclosure through an adequate data protection safeguard as defined in Rev. Proc. 2013-14.
5.4Tax return information is never used in an AI tool for marketing or any purpose other than preparing the return without the taxpayer's written consent.

6. Review of AI output

6.1AI output is a draft. A qualified person reviews it before it is relied on, posted to a ledger, filed, or sent to a client.
6.2Reviewers check figures against source records, citations and tax or accounting positions against primary sources, and calculations by recomputing them.
6.3AI output is not presented to clients as the firm's professional judgment until a qualified person has adopted it as their own.

7. Vendor review

7.1Before an AI tool is approved for client data, the firm obtains and reviews: a current SOC 2 Type 2 report and its scope; the vendor's data-use and model-training terms; its subprocessors and model providers and where they process data; retention and deletion terms; and what the AI can do without approval.
7.2Approved AI vendors are treated as service providers under the firm's WISP: selected for their ability to maintain appropriate safeguards, required by contract to maintain them, and reassessed periodically.
7.3Before disclosing confidential client information to an AI vendor, the firm either has a contractual agreement with the vendor to maintain confidentiality and reasonable assurance that it has appropriate procedures, or obtains the client's specific consent, consistent with the AICPA Code (ET 1.700.040).
7.4Each approved tool is reviewed again at least annually and whenever its terms or AI features change.

8. Clients

8.1The firm informs clients about its use of third-party service providers, including AI vendors, in line with the AICPA Code's "Use of a Third-Party Service Provider" interpretation, for example in the engagement letter.
8.2Where a client's engagement terms restrict AI use, those restrictions are recorded on the client file and followed.

9. Incidents

9.1Anyone who believes client or firm information has been entered into an unapproved tool, or exposed through an AI tool, reports it to [Policy owner] the same day.
9.2Incidents are handled under the firm's incident response plan, including notice to the FTC within 30 days of discovery where a notification event involves the information of 500 or more consumers.
9.3Data theft or loss involving tax information is also reported to the firm's IRS Stakeholder Liaison.

10. Training and review of this policy

10.1Everyone covered by this policy completes training on it before using AI tools for firm work, and again each year, and acknowledges it in writing.
10.2[Policy owner] reviews this policy at least annually and when laws, professional standards or the firm's tools change.
10.3Breaches of this policy are handled under the firm's disciplinary procedures.

Appendix A: Approved AI tools register

List each approved tool, the account or plan, and the data it may receive.
Tool	Plan or account	Approved uses	Data allowed	Owner	Last reviewed

Adopting the policy

Fill in Appendix A first. List each AI tool the firm already uses, including AI features in existing software, with the account type and the data each may receive.
Vet the vendors on the list. Use the AI vendor questionnaire and check SOC 2 reports with the SOC 1 vs SOC 2 guide.
Check the tax rules. If you prepare returns, read the Section 7216 consent guide before client return data goes into any tool.
Link it to your WISP. Add approved AI vendors to the service-provider section of your written information security plan.
Train and collect acknowledgments. Walk staff through it, have each person sign, and set a date to review it.

AI policy template: questions

What should an AI policy for an accounting firm cover?: Which AI tools and accounts are approved, what data may go into them, how AI output is reviewed before it's relied on, how vendors are vetted, how clients are told, and what to do if client data is exposed. Tax firms also need rules for tax return information under Section 7216, and firms covered by the FTC Safeguards Rule should tie the policy to their written information security plan.
Do accounting firms need an AI policy?: No rule we found requires a standalone AI policy, but the obligations it records apply to many firms: Section 7216 limits on tax return information, the Safeguards Rule's service-provider oversight, and, for AICPA members, the Code's rules on third-party service providers. A written policy is how staff know the rules and how the firm shows it follows them.
Can staff use ChatGPT or other AI assistants at work?: That's the firm's decision. If it allows them, the template limits use to firm business accounts on plans whose terms exclude customer content from model training by default, and to the data listed in the approved tools register. See AI chatbots for accounting for each provider's terms.
Is this template legal advice?: No. It's a starting draft built from the regulations and guidance listed below. Have it reviewed against your state rules, engagement letters and insurance requirements before you adopt it.

Sources

Official documents read on October 15, 2026. Vendor facts are sourced on each listing.