Skip to content
Zrico
Menu

For accounting firms

AI for CPA Firms: What It Does Well and the Rules That Apply

How CPA and accounting firms can use AI for tax research, IRS notices and client letters, which rules apply to client data, and what to check in a tool.

Updated 6 min read

CPA and accounting firms can use AI today for first drafts of tax research memos, IRS notice replies, client letters, engagement letters and financial statement review notes. The tool must protect client data, and a professional must check every output. Four sets of rules shape how: the AICPA confidentiality rule, IRC section 7216, the FTC Safeguards Rule and Circular 230.

What can AI do for a CPA firm today?

AI is good at turning facts you supply into a clear first draft. It is not good at knowing your client’s facts, and it can state the law wrongly with confidence.

Tasks that work well with review:

  • Tax research memos. A draft that sets out the question, the authorities and the analysis, which you then check against the Code, regulations and IRS guidance.
  • IRS notice replies. A plain-English explanation of a notice and a draft response letter, built from the notice and your client’s records.
  • Client letters and emails. Explaining an estimated payment, a missing document or a filing deadline in the firm’s tone.
  • Engagement letters. A first draft from your standard terms and the scope of the job.
  • Financial statement review. A list of unusual balances, ratios and changes to ask about.
  • Meeting notes. Action items and follow-ups from a client meeting.

Our use-case pages show two of these in more detail: IRS notices and tax research.

Which rules apply when accountants use AI?

No rule bans AI in an accounting practice. The existing rules on confidentiality, data security and diligence apply to AI the same way they apply to any other tool or vendor.

  • AICPA Code of Professional Conduct. A member in public practice should not disclose confidential client information without the client’s specific consent. Before sharing it with a third-party service provider, the member should have a confidentiality agreement with the provider, with reasonable assurance about its safeguards, or get the client’s specific consent. See our AICPA guide.
  • IRC section 7216. A tax return preparer may not disclose or use tax return information except as the regulations allow. Sending client data to an AI provider is a disclosure. See our section 7216 guide.
  • FTC Safeguards Rule. Tax preparers are financial institutions under the rule and need a written information security program. An AI tool that receives client data is a service provider you must select, bind by contract and review. See our Safeguards Rule guide.
  • Circular 230. Due diligence, competence and written-advice standards apply to AI-assisted work. In June 2026, the IRS Office of Professional Responsibility published guidelines on responsible AI use in federal tax practice. See our Circular 230 guide.

Can a CPA firm put tax return information into an AI tool?

Sometimes, but only after you have checked the rules for that disclosure. The section 7216 regulations require the taxpayer’s written consent for a disclosure unless an exception applies, and no rule yet says exactly how the exceptions apply to AI providers.

Location matters. The regulations require the taxpayer’s consent before tax return information goes to a preparer outside the United States, and they set strict limits on disclosing a Form 1040 filer’s Social Security number abroad. If an AI tool may process data outside the US, treat that as a question to answer before you use it for return work.

The practical steps are simple. Leave out identifiers the model does not need, such as Social Security and account numbers. Prefer a tool that processes data in the US. Where the rules call for it, get the client’s consent in the form Rev. Proc. 2013-14 requires.

What should a CPA firm look for in an AI tool?

Look for a tool your firm controls, with terms you have read. These questions map to the rules above:

  1. No training. Does the provider train on prompts, files or answers? It should not.
  2. Location. Where are AI requests processed? US processing is simpler under section 7216.
  3. Retention. How long does the provider keep data, and can the firm set its own retention?
  4. Access. Who at the vendor can see client data, and in what cases?
  5. Sign-in. Does the tool support multi-factor authentication? The Safeguards Rule requires it for anyone accessing an information system, unless the firm’s Qualified Individual approves an equivalent control in writing.
  6. Records. Can a partner see who used AI, when and on what?
  7. Contract. Is there a written agreement covering confidentiality and safeguards, so you can rely on the AICPA’s service-provider route?

Our due-diligence checklist covers each one.

Should a CPA firm use ChatGPT, Copilot or a dedicated tool?

Any of them can work if the firm controls the account and the terms fit your duties. Personal accounts are the one option to rule out, because the firm has no contract and no control.

Microsoft 365 Copilot Business, as of October 2026, costs $21 per user a month billed annually ($18 promotional through the end of 2026), or $25.20 monthly. It requires a Microsoft 365 Business Standard or Business Premium plan. Microsoft says prompts, responses and data accessed through Microsoft Graph are not used to train foundation models. It suits firms that work in Outlook, Word and Excel all day.

ChatGPT Business is covered in our comparison with Enterprise. For all of these, including Zrico, see how Zrico compares.

What should AI not do in a CPA firm?

AI should not make the final call. It should not sign off a return position, decide a client’s filing status, or send anything to a client or the IRS without a CPA or EA reading it first.

The IRS Office of Professional Responsibility’s 2026 guidelines say practitioners must independently check the facts and law in AI-drafted advice and treat the draft as a starting point. Models can cite rulings that do not exist, miss recent changes and assume facts you never gave them.

How Zrico fits

Zrico gives each firm its own private workspace, with its own application and databases. Claude is the default and is processed only in the US. The firm owner can turn on GPT and Gemini, whose processing is not limited to the US, which matters for section 7216. No AI provider trains on prompts, files or answers. Ready-made assistants include Tax Research Memo, Client Letter (IRS Notices), Financial Statement Reviewer, Engagement Letter and Tax Season Client Checklist. Sign-in uses two-factor authentication, required for admins, and the owner gets a usage and audit report and retention settings. Zrico is $39 per seat per month, with a 5-seat minimum and a 30-day free trial; see pricing. It has no SOC 2, ISO or HIPAA certification, does not make a firm compliant, and its output must be reviewed by a professional.

Sources

General information, not tax or legal advice. Check the current rules and your own facts.

Give your firm a private place to use AI.

$39 per seat per month after a 30-day free trial, 5-seat minimum. Your workspace is ready minutes after you sign up.

Your card is charged when the trial ends. Cancel any time before then and you pay nothing.

Start 30-day free trial