Skip to content
Zrico
Menu

For accounting firms

The FTC Safeguards Rule, Your WISP and AI Tools

What the FTC Safeguards Rule requires of tax preparers, how IRS Publications 4557 and 5708 help with your WISP, and how to add an AI tool to it.

Updated 7 min read

If your firm prepares tax returns, federal law already requires a written security plan for client data. Adding an AI tool does not create a new rule, but it does add a new service provider and a new place where client data goes. This guide explains the FTC Safeguards Rule and how to fold an AI tool into your plan.

Who the rule covers

The Safeguards Rule is the FTC’s rule under the Gramm-Leach-Bliley Act. It is at 16 CFR Part 314. It applies to financial institutions under the FTC’s jurisdiction.

The rule’s definitions answer the question for accountants directly. An accountant or other tax preparation service that is in the business of completing income tax returns is a financial institution (§314.2(h)(2)(viii)). IRS Publication 5708 adds that tax and accounting professionals are covered regardless of size.

The rule protects “customer information,” meaning records with nonpublic personal information about a customer (§314.2(d)). In practice, that means information about individual clients, such as names, SSNs, income and bank details.

What the rule requires

Section 314.3(a) requires a comprehensive information security program that is written in one or more readily accessible parts. It must fit your size and complexity, the nature of your work and the sensitivity of the data. Section 314.4 lists the required elements:

  • (a) A Qualified Individual who oversees and enforces the program.
  • (b) A written risk assessment of risks to customer information, repeated periodically.
  • (c) Safeguards, including access controls, an inventory of data and systems, encryption in transit and at rest, multi-factor authentication for anyone accessing any information system, secure disposal within two years of last use (with exceptions), change management, and logging of user activity.
  • (d) Testing and monitoring of your safeguards.
  • (e) Staff training in security awareness.
  • (f) Service provider oversight.
  • (g) Updating the program when your business or risks change.
  • (h) A written incident response plan.
  • (i) A written report from the Qualified Individual to the board or a senior officer, at least once a year.
  • (j) Notice to the FTC of certain security events.

The small-firm exemption

Section 314.6 exempts firms that keep customer information on fewer than 5,000 consumers from four items: the written risk assessment in §314.4(b)(1), continuous monitoring or penetration testing in §314.4(d)(2), the written incident response plan in §314.4(h), and the annual report in §314.4(i). Everything else still applies, including multi-factor authentication, encryption, training, vendor oversight and FTC notification.

The 2024 notification requirement

An amendment added §314.4(j), effective May 13, 2024. You must notify the FTC as soon as possible, and no later than 30 days after discovery, of a notification event involving the information of at least 500 consumers.

A notification event is the acquisition of unencrypted customer information without the authorization of the person it relates to (§314.2(m)). Two details matter:

  • Encrypted data counts as unencrypted if the encryption key was accessed by an unauthorized person.
  • Unauthorized access to unencrypted data is presumed to be acquisition, unless you have reliable evidence that acquisition did not or could not reasonably have happened.

You report through an online form on the FTC website. The notice includes your firm’s name and contact details, the types of information involved, the date or date range, the number of consumers affected, a general description and whether law enforcement asked for a delay. The small-firm exemption does not cover this requirement.

Your WISP: IRS Publications 4557 and 5708

The IRS and its Security Summit partners publish two free resources.

Publication 4557, Safeguarding Taxpayer Data (Rev. 6-2024), explains the Safeguards Rule in plain terms. It covers basic security steps and includes a checklist for creating a plan.

Publication 5708, Creating a Written Information Security Plan for your Tax & Accounting Practice (Rev. 8-2024), includes a sample WISP template. It also has sample attachments for record retention, rules of behavior for staff, and breach procedures and notifications. It states that your WISP must be written and accessible.

The IRS also asks about this at PTIN time. Form W-12 (Rev. October 2025) asks paid preparers to acknowledge that they must keep a written information security plan, and it points to Publications 5708 and 4557.

Vendor oversight under §314.4(f)

A service provider is any person or entity that receives, maintains, processes or otherwise has access to customer information by providing services directly to you (§314.2(r)). An AI tool that receives client data fits that definition.

Section 314.4(f) requires you to oversee service providers in three ways:

  1. Take reasonable steps to select and retain providers that can maintain appropriate safeguards for the customer information.
  2. Require them by contract to implement and maintain those safeguards.
  3. Periodically assess them based on the risk they present and whether their safeguards remain adequate.

The FTC’s business guide makes the point that responsibility stays with your firm even when a provider does the work. The IRS Office of Professional Responsibility’s June 2026 guidance on AI also tells practitioners to vet third-party AI offerings and to never upload sensitive data to unsecured sites.

How to add an AI tool to your WISP

Use the structure of Publication 5708 and add the tool in each place it touches.

  1. Inventory. Add the tool to your list of systems and data locations (§314.4(c)(2)). Add the provider to the list of third parties that may access client PII.
  2. Risk assessment. Write down what client data may go into the tool, where the provider processes and stores it, how long it keeps it and who at your firm can use it. Note the risks, such as data exposure, account takeover and wrong answers.
  3. Selection record. Keep the security information you reviewed and the reasons you chose the provider (§314.4(f)(1)).
  4. Contract terms. Confirm the agreement requires the provider to maintain safeguards (§314.4(f)(2)). Look for confidentiality, no training on your data, encryption, deletion on request and prompt notice of security incidents. Prompt notice helps you meet the 30-day FTC deadline.
  5. Access and MFA. Limit accounts to staff who need them and require multi-factor authentication for every user (§314.4(c)(1) and (c)(5)). Remove access when someone leaves.
  6. Logging. Record how you monitor use of the tool, such as an audit or usage report (§314.4(c)(8)).
  7. Retention and disposal. Set retention to match your record retention policy and the two-year disposal rule (§314.4(c)(6)).
  8. Rules of behavior and training. Add AI rules to your staff conduct policy: approved tools only, what data is allowed and who reviews output (§314.4(e)).
  9. Incident response. Add the provider’s security contact to your breach procedures.
  10. Annual review. Reassess the provider when you review the WISP, and after any material change (§314.4(f)(3) and (g)).

Remember that other rules apply to the same data. IRC §7216 limits disclosures of tax return information, and the AICPA Code has its own third-party provider rules.

How Zrico fits

Zrico gives each firm its own private workspace with its own application and databases, and no AI provider trains on your prompts, files or answers. Sign-in is invite-only with two-factor authentication, which is required for admins, so set your WISP’s MFA rule for every user. The owner gets a usage and audit report and retention settings, and backups are encrypted nightly. Zrico has no SOC 2, ISO or HIPAA certification and does not make a firm compliant, so document your own §314.4(f) review and have a professional review all output.

Sources

General information, not tax or legal advice. Check the current rules and your own facts.

Give your firm a private place to use AI.

$39 per seat per month after a 30-day free trial, 5-seat minimum. Your workspace is ready minutes after you sign up.

Your card is charged when the trial ends. Cancel any time before then and you pay nothing.

Start 30-day free trial