What is inside
Two pages that plug into the plan you already have
Each part names the rule behind it, so when someone asks why it is in your plan, the answer is right there.
The seven-part AI section
Inventory, approved tools, data rules, vendor review, client consent, access and logging, and review and training, laid out as a form with a sign-off box for your Qualified Individual.
A data rule for AI tools
What is fine in any approved tool, what goes only into enterprise tools with identifiers removed, and what never goes into an AI tool at all.
Before your first return
Ten things to finish before the season, from multi-factor authentication to a tested backup restore, each tied to the rule it comes from.
Your incident contact list
IRS Stakeholder Liaison, state agencies, your insurer, and your IT provider, filled in before you need them.
Why it matters now
AI is already covered by rules you follow
There is no new AI law for tax practices. Your existing duties already reach the AI tools your staff use.
The IRS applies your duties to AI
In June 2026 the IRS Office of Professional Responsibility released Alert 2026-19. It applies Circular 230 competence, diligence, firm procedures, and confidentiality to AI tools.
OPR Alert 2026-19 · Circular 230
Pasting client data can be a disclosure
Disclosing return information without consent carries civil and criminal penalties. A consumer AI tool that keeps or trains on what you paste is where that risk shows up.
IRC 6713 and 7216
The Safeguards Rule expects it
The FTC rule calls for knowing your systems, controlling access, overseeing vendors, and updating the program when the practice changes. A new AI tool is a change.
16 CFR 314.4
How to use it
One afternoon, four steps
Take inventory
Ask everyone who touches client data which AI tools they use, seasonal staff included.
Set the rules
Write your approved tools list and adapt the data rule to your actual tools and vendor terms.
Check consent and access
Know when a use needs Section 7216 consent. Individual logins only, with multi-factor on.
Sign it and file it
Your Qualified Individual signs off, and you set a review date before next season.
Questions
Before you download
Who is this for?
Tax preparers, CPAs, enrolled agents, and bookkeepers, especially solo and small firms that do not have a security team to write this for them.
Does this replace my WISP?
No. It adds an AI section to the written information security plan you already have. Each part plugs into a section the FTC Safeguards Rule already asks for.
We do not use AI. Do we still need this?
Ask your staff before you decide. If the answer really is none, write that down and set the data rule now, before someone starts.
Is this legal advice?
No. It is general information drawn from published IRS and FTC material. What applies to your practice depends on your facts.
Is it really free?
Yes. Enter your name and email and the download link appears right away. We also email you a copy.
Add the AI section before the season starts
Two pages, one afternoon, and a plan that matches what your staff actually do.
Get the free kitWant to see where your practice stands? Take the free PTIN Renewal Security Check.