A five-page fillable worksheet for accounting, tax and advisory firms. It separates the task, the class of client information and the vendor evidence, then applies a transparent decision rule: approve, approve with limits, hold or do not approve. It is a planning aid, not legal advice or a compliance certification.
The decision this worksheet supports
Most firms already have staff using AI, some of it inside software the firm licenses. The practical question for a managing partner is narrower than whether to allow AI: may this tool be used for this task with this kind of client information, and who has checked? The IRS Office of Professional Responsibility notes that virtually all professional tax firms use some form of AI, whether they are aware of it or not (Issue 2026-19, June 24, 2026).
Existing policy templates are useful for setting rules in prose. This worksheet is built for the moment a specific request arrives: it produces a dated record of the decision, the evidence behind it and the conditions that must stay true.
What you need and how to use it
Complete one copy per combination of tool, task and data class. Have the vendor terms or contract, your engagement letter template, your written information security plan and the person who would use the tool. Allow roughly 45 minutes for a first pass when the vendor documents are at hand (a planning estimate, not a measured time); longer when you must ask the vendor for evidence.
- Describe the use. Name the exact plan, who administers the account and whether the tool drafts or can act on its own.
- Classify the information. Four classes run from no client information to credentials. Class 3 is tax return information as defined in 26 CFR 301.7216-1(b)(3), any information including a name, address or identifying number furnished in connection with preparing a return.
- Collect vendor evidence. Seven questions cover training use, retention, processing location, sign-in, encryption, activity records and exit terms. The FTC Safeguards Rule requires reasonable steps to select capable service providers, a contract requiring safeguards and periodic assessment, and IRS Publication 4557 says the rule covers professional tax preparers.
- Assign review and records. Name who verifies output and what is filed.
- Apply the decision rule. Write the limits and a review date.
The Section 7216 question is for your adviser
Preparers face civil and criminal penalties for unauthorized use or disclosure of tax return information, and Circular 230 section 10.51(a)(15) addresses willful unauthorized disclosure (OPR Issue 2026-19). The regulations let a preparer disclose to another preparer located in the United States only for services that are not substantive determinations, and let it share information with contractors for software programming, maintenance, repair, testing or procurement only to the extent necessary and with a written notice (26 CFR 301.7216-2(d)). Consent rules are in section 301.7216-3. Whether a particular AI product fits an exception or needs consent depends on facts the worksheet cannot see, so it records the path and who decided rather than choosing one for you.
A worked example, with constructed numbers
Three illustrative requests show how the rule operates; none is a client result. A personal chatbot account used to summarize a draft client memo is not approved: there is no firm administrator, the memo is Class 2 information and the training term is unknown. A feature inside licensed tax software that drafts a client email is approved with limits: draft only, the partner sends it, and training and retention terms were verified. A recorder that joins client calls where return details come up is a hold until retention and processing location are answered.
The billing check uses the same discipline. If a research memo that previously took 6.0 hours now takes 2.5 recorded hours including verification, the invoice should reflect the time actually spent or a fee basis your adviser has confirmed. OPR notes that billing for time not actually spent may violate section 10.27 depending on the facts.
What the worksheet does not do
It does not test whether a tool is accurate, certify that a firm complies with any rule, or replace advice from counsel on Section 7216, state requirements or your engagement letters. The decision rule is a planning default written by Clairvance; your firm sets its own thresholds. A vendor's security page describes advertised controls, so the worksheet marks an item verified only when you reviewed a term, setting, report or demonstration for your account type. Completing the file locally does not send anything to Clairvance. If you want help turning an approved use into a working, reviewed workflow, see how Clairvance works with accounting firms.
Sources & further reading
- Issue 2026-19. Introductory Guidelines for Responsible AI Use in Federal Tax Practice. IRS Office of Professional Responsibility, 2026-06-24. Accessed 2026-10-01.
- Publication 4557, Safeguarding Taxpayer Data (Rev. 6-2024). Internal Revenue Service, 2024-06. Accessed 2026-10-01.
- Publication 5708, Creating a Written Information Security Plan for Your Tax & Accounting Practice (Rev. 8-2024). Internal Revenue Service, 2024-08. Accessed 2026-10-01.
- 16 CFR 314.4 Elements (FTC Safeguards Rule). Electronic Code of Federal Regulations, Current text as accessed; amended 2023. Accessed 2026-10-01.
- 26 CFR 301.7216-2 Permissible disclosures or uses without consent. Legal Information Institute, Cornell Law School (CFR text), Current text as accessed. Accessed 2026-10-01.
- 26 CFR 301.7216-3 Consent requirements. Legal Information Institute, Cornell Law School (CFR text), Current text as accessed. Accessed 2026-10-01.