Evolve AI Institute home

Guide for tax and accounting professionals

Section 7216 and AI: before you paste client data into a chatbot

Federal law limits how tax return preparers disclose and use their clients’ information. Here is what the rules say, the questions they raise for AI tools, and the options that keep client data in your office.

Published October 10, 2026 · Sources checked October 10, 2026

What Section 7216 covers

Section 7216 of the Internal Revenue Code applies to anyone in the business of preparing tax returns or providing services in connection with preparing them, and to anyone who prepares a return for someone else for compensation. A preparer who knowingly or recklessly discloses information furnished for preparing a return, or uses it for any purpose other than preparing or assisting with the return, is guilty of a misdemeanor.

The statute sets a fine of up to $1,000 ($100,000 where the identity-theft provisions of section 6713(b) apply), imprisonment of up to one year, or both, together with the costs of prosecution. A separate civil penalty in section 6713 is $250 for each improper disclosure or use, up to $10,000 per calendar year, rising to $1,000 and $50,000 when the disclosure or use is connected with identity theft.

The statute allows disclosures required by other provisions of the tax code or by court order, and it lets the Treasury permit others by regulation. Those permitted disclosures and uses are in 26 CFR 301.7216-2. Anything outside them generally needs the taxpayer’s written consent under 26 CFR 301.7216-3.

Key definitions in the regulations

The definitions in 26 CFR 301.7216-1 are broad, and they matter for AI tools:

  • Tax return information is information furnished in any form or manner for, or in connection with, preparing a taxpayer’s return.
  • Disclosure is making tax return information known to any person in any manner whatever.
  • Use covers referring to or relying on tax return information as the basis to take or permit an action.
  • Tax return preparer includes people who provide auxiliary services in connection with preparing returns, and the regulation names software developers as an example.

The IRS Section 7216 FAQ adds that contractors who receive tax return information from preparers are treated as preparers subject to the same rules. The IRS marks that FAQ page as historical, so read it alongside the current regulations.

Questions a chatbot prompt raises

The regulations do not mention AI chat services by name. Typing a client’s wage figures, dependents, or Social Security number into a cloud chatbot sends that information to the provider’s systems, so the rules above raise several questions worth answering before you do it:

  1. Is this a disclosure? Given the definition of “making known to any person in any manner,” assume that sending client details to an outside service is one, and ask whether an exception covers it.
  2. Does an exception fit the provider’s role? Section 301.7216-2(d) allows disclosures to other preparers in the United States for auxiliary services, and to contractors for work on tax software and equipment, under conditions. One condition for contractors is a written notice of sections 6713 and 7216 to each person who receives the information.
  3. Is the AI making substantive determinations? The same paragraph excludes services that involve substantive determinations or advice affecting the tax liability. Asking an AI whether a client qualifies for a deduction looks closer to advice than to processing. One of the regulation’s examples requires consent before sending data to another firm for advice on a deduction.
  4. Where is the information processed? Disclosure to a preparer outside the United States requires the taxpayer’s consent, and the regulations treat viewing data on a U.S. server from abroad as a disclosure outside the United States. The IRS FAQ describes extra limits on Social Security numbers. Check whether the AI provider commits to where your prompts are processed and viewed.
  5. Does the provider keep or reuse the text? If an AI service stores prompts or uses them to improve its models, ask how that squares with the limits on use and disclosure.
  6. Do you have valid consent? Consent must be knowing, voluntary, signed, and dated, in advance. For Form 1040-series returns, the IRS FAQ points to Revenue Procedure 2013-14, as modified by Revenue Procedure 2013-19, for required wording and format.

Reasonable professionals may answer these differently for different tools and contracts, which is why this belongs with your attorney or professional advisers.

Your data security duties apply too

Separate from Section 7216, the IRS states in Publication 4557, Safeguarding Taxpayer Data that under the FTC Safeguards Rule, tax return preparers must create and enact security plans to protect client data. The FTC’s guide to the Safeguards Rule lists tax preparation firms among the businesses it covers. IRS Publication 5708 explains how to create a written information security plan.

Any AI tool that touches client data belongs in that plan: what it receives, where the data goes, who can access it, and how you would know if something went wrong.

Options that keep client data in your office

  • Leave identifying details out. Ask general questions about a rule or a form, with no client facts. A question about how a credit phases out needs no names or Social Security numbers.
  • Get consent where the rules call for it, with the wording and format the regulations and revenue procedures require.
  • Use a business agreement that addresses retention, training, data location, and the written notice the regulations require, if your advisers conclude a cloud provider can fit an exception.
  • Run the AI on your own computer. A local AI model processes the text on your machine, so the client data never reaches an AI provider. That removes one outside recipient from the picture. Your other obligations, including securing the computer and following your written security plan, stay the same.

Evolve AI drives take the last approach. The AI server listens only at 127.0.0.1, the address of your own computer, and it keeps working with the internet switched off. You can verify where requests go yourself in a few minutes.

Where the Finance & Accounting Edition fits

The Finance & Accounting Edition is built for bookkeepers, accountants, and finance staff who work with client records. It reconciles bank statements to the books, reviews transactions by month, category, and counterparty, and projects cash for up to 36 months. The app calculates every number, and the local AI drafts memos from the app’s figures, with any figure it did not supply flagged for you.

It does not prepare or file tax returns, and it makes no tax, audit, or legal determinations. AI memos are drafts for your review. The edition is available to order and has been tested so far on one Windows 11 computer. See the drive prices, or read the details on the Finance & Accounting Edition page.

Using a local tool is one part of protecting client information. It does not by itself establish compliance with Section 7216, the Safeguards Rule, or any other obligation, and Evolve AI Institute makes no compliance or certification claims.

Sources

Keep client records on your own computer

The Finance & Accounting Edition runs from a portable drive on your Windows computer, with a local AI that drafts from the app’s own figures. See the prices, or check your computer first.

See pricing Check compatibility