Skip to content
Zrico
Menu

For accounting firms

Circular 230 and AI: What Tax Practitioners Need to Know

How Circular 230 due diligence, competence, written advice and supervision rules apply when CPAs and EAs use AI, including the IRS OPR's 2026 AI alert.

Updated 7 min read

Yes, tax preparers can use AI. Nothing in Circular 230 forbids it. But the rules that govern practice before the IRS apply to AI-assisted work the same way they apply to work done by hand. This guide walks through the sections that matter most and what the IRS Office of Professional Responsibility (OPR) has said about AI.

Circular 230 is the set of Treasury regulations at 31 CFR Part 10. It governs attorneys, CPAs, enrolled agents and others who practice before the IRS. OPR enforces it.

What OPR said about AI

On June 24, 2026, OPR published Issue Number 2026-19, “Introductory Guidelines for Responsible AI Use in Federal Tax Practice.” It does not create new rules. It explains how existing Circular 230 duties apply to generative AI.

The main points:

  • Review everything. Practitioners must review all AI-created documents before they go to a client or the IRS, and verify facts, citations and calculations.
  • Know the tool. Competence includes understanding how the AI works, its limits and its risks.
  • Reliance can be unreasonable. OPR says that if a system’s logic is opaque, relying on it may be unreasonable under §10.37.
  • Firms need procedures. Firm leaders should put AI policies in place covering staff training, secure data handling, accuracy monitoring and vetting of outside AI tools, and document those steps.
  • Billing. Under §10.27, billing for time not actually spent, or double billing for AI-assisted tasks, may be an issue depending on the facts.
  • Confidentiality. OPR states that the civil and criminal preparer penalties in IRC §6713 and §7216(a) apply to unauthorized use or disclosure of tax return information, and points to §10.51(a)(15), which makes willful unauthorized disclosure a ground for discipline. It says practitioners must handle client data using only secure, enterprise-approved AI.

For the §7216 details, including the rules on disclosures outside the US, see our guide to IRC §7216 and AI tools.

§10.22: Diligence as to accuracy

Section 10.22(a) requires due diligence in preparing, approving and filing returns and other papers, and in checking the correctness of what you tell the IRS and your clients.

Section 10.22(b) lets you rely on someone else’s work if you used reasonable care in engaging, supervising, training and evaluating that person. AI is not a person, and no guidance says this presumption extends to software. The safer reading is OPR’s: AI output is a draft, and you are responsible for checking it.

In practice, that means:

  • Open and read every authority the AI cites. Fabricated or misdescribed citations are a known failure.
  • Recompute any number the AI produced.
  • Check that the facts in the output match the client’s actual facts.

§10.34: Standards for returns and documents

Section 10.34 does not mention technology, but it sets the floor for anything an AI helps you produce.

  • Returns. You may not willfully, recklessly or through gross incompetence sign a return, or advise a position, that you know or should know lacks a reasonable basis or is an unreasonable position under IRC §6694(a)(2).
  • Other documents. A position on a document submitted to the IRS must not be frivolous. This includes a response to an IRS notice.
  • Penalties. You must tell the client about penalties reasonably likely to apply, and about any chance to avoid them through disclosure.
  • Client information. You may generally rely in good faith on what the client gives you, but you must make reasonable inquiries if it looks incorrect, inconsistent or incomplete.

If an AI tool suggests a position, you still have to assess its strength yourself.

§10.35: Competence

Section 10.35 requires the knowledge, skill, thoroughness and preparation needed for the matter. You can become competent by studying the law or consulting experts.

OPR reads this to include the technology. You should know how your AI tool generates content, where it tends to fail, and whether its output is suitable for an IRS matter. A practitioner who cannot judge whether an AI answer is right is not in a position to use it.

§10.36: Firm procedures and supervision

Section 10.36 applies to whoever has principal authority for overseeing a firm’s tax practice. That person must take reasonable steps to make sure the firm has adequate procedures for all members, associates and employees to comply with Circular 230.

Discipline under §10.36(b) requires willfulness, recklessness or gross incompetence, combined with a pattern or practice of noncompliance in the firm, or a failure to act promptly once you know or should know about one. If the firm names no one, the IRS may identify the responsible person.

In a small firm, this is usually the owner. If staff paste client data into free chatbots or send AI drafts without review, the owner can be exposed. A short written AI policy is the simplest way to show reasonable steps. See how to write an AI policy for a small firm.

§10.37: Written advice

Section 10.37(a)(2) applies to written advice on federal tax matters, including email. You must:

  • Base the advice on reasonable factual and legal assumptions.
  • Reasonably consider all relevant facts you know or should know.
  • Use reasonable efforts to identify the relevant facts.
  • Not rely on representations or findings of any person if that reliance would be unreasonable.
  • Relate the law and authorities to the facts.
  • Not take into account the chance that a return will not be audited.

Section 10.37(b) adds that you may rely on another person’s advice only if it was reasonable and your reliance is in good faith.

An AI research memo touches each of these. It may assume facts you never gave it, skip facts that matter, or state the law without tying it to your client’s situation. OPR says practitioners must independently check all factual and legal information in AI-drafted advice, and treat the draft as a starting point.

AICPA Statements on Standards for Tax Services

CPAs who are AICPA members also follow the Statements on Standards for Tax Services (SSTSs). The revised SSTSs took effect January 1, 2024, and many state boards have adopted them.

Two new sections in SSTS No. 1 bear directly on AI:

  • Section 1.4, Reliance on Tools. You may reasonably rely on tools, including AI, while exercising professional judgment and care. You must take reasonable steps to determine that a tool is appropriate for its purpose, and tools do not replace professional judgment.
  • Section 1.3, Data Protection. You should make reasonable efforts to protect taxpayer data, including data sent or stored electronically.

The AICPA confidentiality rules also apply when client data goes to an outside provider. See AICPA confidentiality rules and AI tools.

Checklist for a small CPA or EA firm

  1. Name the responsible person. Write down who has principal authority under §10.36.
  2. Approve specific tools. List which AI tools staff may use and for what. Ban consumer chatbots for client data.
  3. Vet each tool. Check where data is processed, whether the provider trains on it, how long it is kept, and who can see it. Keep the notes in a file. Our AI tool due diligence checklist can help.
  4. Plan for §7216. Decide whether you need taxpayer consent before data reaches a provider, especially one that may process data outside the US.
  5. Require review. No AI-drafted return position, notice response or advice letter leaves the firm until a qualified person has read every cited authority and checked every number and fact.
  6. Train staff. Cover the tools’ limits, what data may go in, and the review steps. Repeat when tools change.
  7. Keep a record. Note which matters used AI and who reviewed the output.
  8. Bill honestly. Do not bill for time that was not spent. Consider telling clients how you use AI.
  9. Plan for errors. Decide what happens if AI output with a mistake reaches a client or the IRS, or if data goes where it should not.
  10. Revisit the policy. Review it at least twice a year, and when OPR or the AICPA issues new guidance.

How Zrico fits

Zrico gives each firm its own private workspace with its own application and databases, and includes ready-made Tax Research Memo and IRS Notice Response assistants (see tax research and IRS notices). Web search shows its sources so a reviewer can open each one. By default every AI request goes to Claude and is processed only in the US. GPT and Gemini are off unless the firm owner turns them on; their processing is not limited to the US, so for tax return information keep them off or get the consent §7216 requires. No AI provider trains on your prompts, files or answers, and the owner gets a usage and audit report and retention settings, which can support the compliance procedures §10.36 expects firms to have. Client-name masking is coming soon. Zrico has no SOC 2, ISO or HIPAA certification and does not make a firm compliant, and a professional must review all output.

Sources

General information, not tax or legal advice. Check the current rules and your own facts.

Give your firm a private place to use AI.

$39 per seat per month after a 30-day free trial, 5-seat minimum. Your workspace is ready minutes after you sign up.

Your card is charged when the trial ends. Cancel any time before then and you pay nothing.

Start 30-day free trial