AI and the §7216 Disclosure and Use Rules

§7216 prohibits the disclosure and use of certain information by tax return preparers

Many tax professionals are experimenting with artificial intelligence (AI) tools, such as ChatGPT and Claude, in their tax practices to help with client and administrative tasks.

There are important disclosure issues arising from the use of AI; therefore, it is important to review the law governing how tax professionals can disclose and use client tax information.

§7216 Overview

Under §7216, a tax return preparer who knowingly or recklessly discloses tax return information or uses tax return information for any purpose other than preparing or assisting in preparing a tax return, unless an exception applies, can be subject to a fine of up to $1,000, imprisonment of up to one year, or both.

These terms have specific definitions in Treas. Reg. §301.7216-1:

• A tax return preparer is typically any person engaged in the business of preparing or assisting in preparing tax returns, or providing auxiliary services in connection with their preparation. See Treas. Reg. §301.7216-1(b)(2).

• Tax return information is any information, including, but not limited to, a taxpayer’s name, address, or identifying number, which is furnished in any form or manner for, or in connection with, the preparation of a tax return of the taxpayer. Tax return information also includes information the tax return preparer derives or generates from tax return information in connection with the preparation of a taxpayer’s return. Even the fact that someone is a client can be tax return information. See Treas. Reg. §301.7216-1(b)(3).

• Disclosure of tax return information is the act of making tax return information known to any person in any manner whatever. See Treas. Reg. §301.7216-1(b)(5).

• Use of tax return information includes any circumstance in which a tax return preparer refers to, or relies upon, tax return information as the basis to take or permit an action. See Treas. Reg. §301.7216-1(b)(4).

There are many exceptions to the disclosure and use prohibitions; however, the tax return preparer must meet the strict requirements of each exception. Treas. Reg. §301.7216-2 lists the exceptions that do not require a taxpayer’s consent. Some examples include disclosures to the IRS, certain disclosures to other tax return preparers, certain disclosures to contractors, and certain disclosures for quality or peer review.

If an exception does not apply, the tax return preparer must get the taxpayer’s consent to disclose or use their tax return information, and Treas. Reg. §301.7216-3 lists the requirements to obtain consent from the taxpayer.

Rev. Proc. 2013-14 contains the required language, format, and procedures for obtaining consent for Form 1040 series returns. For all other taxpayers, the consent may be in any format, including an engagement letter to a client, provided it complies with all requirements. See Treas. Reg. §301.7216-3(a)(3)(iii).

Where AI Enters the Picture

With the legal framework in mind, let’s talk about what this looks like in practice when AI tools are involved.

Every AI tool operates on a simple model: you provide input, the tool processes it, and it generates output. That input typically does not remain on your machine. It travels to a server operated by the AI provider. In some cases, the input may be stored, logged, reviewed by human trainers, or used to improve future versions of the model.

When a tax return preparer enters tax return information into a third-party AI tool, that is a disclosure under Treas. Reg. §301.7216-1(b)(5) to another person, specifically the AI provider, and potentially to its employees, contractors, and systems.

This disclosure occurs regardless of the AI provider’s privacy promises. The §7216 analysis does not hinge on whether the provider retains or deletes the data; the disclosure occurred the moment the data left the tax return preparer’s control.

The scenarios below are not hypothetical — they are typical for tax return preparers.

The research question. A tax return preparation client tells you about a previously unreported foreign bank account. You're not sure how to approach the disclosure, so you open an AI tool and start working through it. Your first prompt is general enough: “What are the current options for resolving unreported foreign bank accounts with the IRS?” No client data, no issue. But then you want to get specific, so you follow up with: “My client, Sarah, is a pediatric dentist in Midland, making about $350,000. She has a UBS account in Zurich with roughly $120,000 that she hasn’t reported on FBARs or Form 8938 for the last five years. Can she qualify for Streamlined?” You started with a clean general question. Two messages later, you’ve given an AI provider your client’s name, a specific occupation in a small city, income, foreign bank details, and a non-filing position. This action is a §7216 disclosure.

The innocent shortcut. You paste three pages of notes from a tax return preparation client meeting into an AI tool and ask it to “summarize the key issues.” Those notes refer to the client by name, mention their spouse’s employer, list the estimated income from two rental properties, and repeatedly mention the name of the LLC that the spouses jointly own. This action is a §7216 disclosure.

But — “It’s Just Software”

A common objection: “How is this different from using tax preparation software? Drake has my client’s data.”

Tax preparation software serves a direct, necessary role in preparing the return, and disclosure to those providers generally falls under the auxiliary services exception in Treas. Reg. §301.7216-2(d). The software exists to prepare the tax return.

The use of ChatGPT, Claude, or another AI tool is unlikely to constitute an auxiliary service under Treas. Reg. §301.7216-1(b)(3)(iii); however, there is no guidance from the IRS. Some AI providers are developing tax-specific products with dedicated data-handling agreements, which require a different analysis, but this does not apply to the general-purpose AI tools most tax return preparers use today.

Consent Challenges for AI Tools

If no exception applies, the tax return preparer needs the taxpayer’s consent under Treas. Reg. §301.7216-3. For Form 1040 filers, the practitioner must follow Rev. Proc. 2013-14 to obtain valid consent; for all other taxpayers, the format may vary, provided the tax return preparer meets all requirements. In the context of AI tools, obtaining consent presents some specific challenges.

The consent must identify the recipient of the disclosure. “Various AI tools” is not sufficient. The tax return preparer needs to name the specific provider: OpenAI, Anthropic, Google, or whichever company operates the tool. A change in providers requires a new consent.

The consent must describe the tax return information to be disclosed. The tax return preparer must think carefully about what data will actually be entered into the tool, not just in general terms, but specifically enough for the client to make an informed decision.

The consent must state the purpose of the disclosure. “To help with your tax situation” is vague. A more defensible approach would describe the specific use: drafting correspondence, researching a tax position, etc.

The consent must include a statement that the taxpayer is not required to sign it. The client’s participation must be voluntary.

What About Redacted Data?

Many tax return preparers believe stripping the client’s name and Social Security number solves the problem. It helps, but it may not be enough.

Remember the regulatory definition: tax return information includes any information furnished in connection with the preparation of a tax return. If the combination of the remaining details could reasonably identify the taxpayer, the concern under §7216 would persist.

However, the more the tax return preparer sanitizes the data, the less useful the AI output becomes. That is a tension everyone using AI tools has to navigate.

Practical Steps

None of this means you should stop using AI. It means you need to use it deliberately.

Get proper consent. If you’re going to use AI tools with Form 1040 client data, build a standalone consent form that meets the requirements of Rev. Proc. 2013-14. Name the specific tools. Describe the data. Explain the purpose. Make the client’s choice voluntary. Get it signed before you disclose anything.

Sanitize before you type. Remove names, SSNs, EINs, addresses, and any other identifying information before entering anything into an AI tool. Be sure to change identifying details. If you’re drafting a penalty abatement request, “taxpayer” works just as well as the client’s name.

Know your provider’s policies. Read the terms of service and privacy policy for every AI tool you use. Key questions: Does the provider use your input to train future models? Can you opt out? Does the provider offer a business or enterprise tier with stronger data protections? Is there a data processing agreement available? These policies change frequently — check them regularly.

Document your process. Keep records of what tools you use, what consent you obtained, what data was entered, and what steps you took to protect client information. A documented, deliberate process is your best defense.

Update your WISP. Your written information security plan (WISP) should specifically address AI tools. Which tools are approved? Who is authorized to use them? What data can and cannot be entered? Under what circumstances? And remember, your obligations here aren't limited to §7216. The FTC Safeguards Rule, issued under the Gramm-Leach-Bliley Act, requires tax preparers to maintain comprehensive security programs that protect client information. That includes having written policies governing how new technologies are evaluated and adopted. If your WISP does not address AI, you have a problem.

The Bottom Line

AI tools offer real value to tax practitioners. The efficiency gains are significant, and the technology is only getting better. But the rules governing our use of client data do not disappear because the technology has changed.

Congress enacted §7216 in 1971, and the Treasury Department last updated its regulations in 2012. The current rules do not contemplate current technological advancements. But the same principle applies: clients trust us with their most sensitive financial information, and we have a legal and moral obligation to protect it.

While there is no specific IRS guidance on AI tools and §7216 yet, that absence does not mean a free-for-all is permitted. When in doubt, apply best practices: get consent, sanitize your inputs, know your tools, and protect your clients. The technology is worth using, but it is also worth using carefully.

Join the Conversation

If you are a paid subscriber, you can talk about this topic in the comments section. Please keep the discussion related to this edition’s topic.