IRC §7216 and AI Tools: What Tax Preparers Need to Know

Section 7216 of the Internal Revenue Code limits what tax return preparers can do with client information. It was written long before AI tools, but it applies to them all the same. This guide explains what the rule covers, where AI fits, and which questions are still open.

What §7216 prohibits

Section 7216 makes it a crime for a tax return preparer to knowingly or recklessly disclose tax return information, or use it for any purpose other than preparing the return. It is a misdemeanor. The penalty is a fine of up to $1,000 (up to $100,000 in identity theft cases covered by §6713(b)), up to one year in prison, or both.

Section 6713 adds a civil penalty. It is $250 for each unauthorized disclosure or use, up to $10,000 a year. In cases connected to identity theft, it rises to $1,000 each, up to $50,000 a year.

“Tax return preparer” is a broad term in the regulations (§301.7216-1(b)(2)). It covers anyone in the business of preparing or assisting in preparing returns, including CPA firms and their employees. It also covers people who provide auxiliary services, such as software developers whose software is used to prepare or file returns.

What counts as tax return information

The definition in §301.7216-1(b)(3) is wide. Tax return information is any information furnished in any form or manner for, or in connection with, preparing a return. That includes:

• Names, addresses and identifying numbers.
• Information from third parties, such as W-2s, 1099s and brokerage statements.
• Information you derive from the client’s data, such as your workpapers and computations.
• Statistical compilations, even when they cannot be tied to a particular taxpayer.

The regulation uses a “but for” test. If the client would not have given you the information except to have you prepare the return, it counts. So a client’s documents, a summary of them, and an AI answer built from them can all be tax return information.

Use and disclosure

A disclosure is making tax return information known to any person in any manner (§301.7216-1(b)(5)). A use is relying on or referring to the information as a basis for an action (§301.7216-1(b)(4)).

Uploading a client’s return to an AI tool sends it to the provider’s systems. That is a disclosure. The general rule in §301.7216-3 is that you need the taxpayer’s written consent for any disclosure or use, unless §301.7216-2 permits it.

Some permissions in §301.7216-2 help firms. For example, §301.7216-2(h) lets accountants and attorneys use a client’s return information to provide other accounting or legal services to that same client within the firm. These permissions do not reach a disclosure to an outside AI provider.

The auxiliary-services exception

The exception most relevant to AI is §301.7216-2(d). It has two parts.

Disclosure to another preparer, §301.7216-2(d)(1). You may disclose tax return information to another tax return preparer located in the United States, including its territories and possessions, for preparing the return or providing auxiliary services. The other preparer must not make substantive determinations or give advice. A substantive determination is any analysis, interpretation or application of the law. The regulation’s examples include sending data to a service that computes the tax, and sending a return to an authorized e-file provider.

Disclosure to contractors, §301.7216-2(d)(2). You may disclose information to a contractor for programming, maintenance, repair, testing or procurement of equipment or software used to prepare returns. You must make sure each person who receives the information gets written notice that §7216 and §6713 apply to them. The regulation’s Example 2 treats a disclosure without that notice as impermissible.

Disclosures outside the United States

The location rules are strict:

• Consent first. If the preparer receiving the information is located outside the US, you need the taxpayer’s consent before any disclosure (§301.7216-3(a)(3)(i)(D); §301.7216-2(c)(2) and (d)).
• Viewing counts. Example 3 in §301.7216-2(d)(3) describes data stored on a US server that a contractor abroad can view but not download. That is still a disclosure outside the US that needs consent.
• Social Security numbers. For Form 1040 filers, you generally cannot get consent to disclose the SSN to a preparer outside the US. You must redact or mask it (§301.7216-3(b)(4)). The narrow exception requires an “adequate data protection safeguard” that both preparers maintain, as defined in Rev. Proc. 2013-14 §5.07, and the consent must confirm it.

The Rev. Proc. 2013-14 consent format

Rev. Proc. 2013-14 sets the format for consents covering Form 1040 series returns. Other filers may use it or any consent that meets §301.7216-3. The main points:

• Each consent goes on a separate written document, paper or electronic. It may be attached to an engagement letter.
• Paper consents must use at least 12-point type on 8½ by 11 inch or larger paper.
• The consent must include the mandatory statements in §5.04(1), including the TIGTA complaint statement.
• For disclosure outside the US, §5.04(1)(e) adds a statement that the consent may result in your tax return information being disclosed to a tax return preparer located outside the United States. A longer version applies if an SSN is included.
• The taxpayer must opt in. Opt-out consents are not allowed, and the taxpayer must sign.
• If no duration is stated, the consent lasts one year from signing (§301.7216-3(b)).

You also cannot make your services conditional on the consent, except for a disclosure to another preparer who assists with the return (§301.7216-3(a)).

What is settled and what is not

Settled:

• Client information you put into an AI tool is almost always tax return information.
• Sending it to an AI provider is a disclosure.
• Disclosure to a preparer outside the US needs prior written consent, and SSNs face extra limits.
• §7216 and §6713 apply to AI use. The IRS Office of Professional Responsibility said so in its June 2026 guidance on AI in tax practice, which also tells practitioners to use only secure, enterprise-approved AI with client data.

Not settled:

• No regulation or IRS guidance says whether an AI provider is a “tax return preparer” providing auxiliary services under §301.7216-2(d).
• If the tool analyzes or applies tax law, that may be a substantive determination. If so, the (d)(1) exception would not apply even inside the US.
• The examples about location involve people viewing data. No guidance says how the rules apply when software processes data on servers in another country.

Given these gaps, many firms take the cautious reading. They treat the AI provider as a recipient of a disclosure and plan around it.

Practical options

1. Keep tax return information out. Use AI for general research and drafting that needs no client data.
2. Reduce what you send. Mask SSNs, names and account numbers. Masked data can still be tax return information, so this lowers risk without removing §7216.
3. Use a tool processed only in the US. Pair it with written terms that rule out training on your data, and send the (d)(2) notice if you treat the provider as a contractor. Write down your reasoning, since the exception’s fit is not confirmed.
4. Get consent. If data may be processed outside the US, or you want certainty, get a Rev. Proc. 2013-14 consent with the §5.04(1)(e) statement. Leave SSNs out.
5. Ask your counsel. For a firm-wide approach, get advice on your specific tools and workflows.

How Zrico fits

Zrico gives each firm its own private workspace, and no AI provider trains on your prompts, files or answers. By default every AI request goes to Claude and is processed only in the US. GPT and Gemini are off unless the firm owner turns them on; their processing is not limited to the US, so for tax return information keep them off or get the consent the rules require. Automatic masking of common client identifiers is coming soon. None of this makes a firm compliant, and a professional must review all output.

Sources

• 26 U.S.C. §7216, Disclosure or use of information by preparers of returns: https://www.law.cornell.edu/uscode/text/26/7216
• 26 U.S.C. §6713, Disclosure or use of information by preparers of returns (civil penalty): https://www.law.cornell.edu/uscode/text/26/6713
• 26 CFR §301.7216-1, Penalty for disclosure or use of tax return information (definitions): https://www.law.cornell.edu/cfr/text/26/301.7216-1
• 26 CFR §301.7216-2, Permissible disclosures or uses without consent: https://www.law.cornell.edu/cfr/text/26/301.7216-2
• 26 CFR §301.7216-3, Disclosure or use permitted only with the taxpayer’s consent: https://www.law.cornell.edu/cfr/text/26/301.7216-3
• Rev. Proc. 2013-14: https://www.irs.gov/pub/irs-drop/rp-13-14.pdf
• IRS Office of Professional Responsibility, Issue Number 2026-19, Introductory Guidelines for Responsible AI Use in Federal Tax Practice (June 24, 2026): https://www.irs.gov/pub/opr-taxpros/issue-number-2026-19-introductory-guidelines-for-responsible-ai-use-in-federal-tax-practice.pdf

General information, not tax or legal advice. Check the current rules and your own facts.