AI and client data security for accounting firms
A tax practice that puts client data into an AI tool is extending its security plan, whether or not the plan says so. This is what the rules require and what to ask vendors.
Contents
Accounting firms named data security and client confidentiality as the second most common barrier to using AI, after accuracy, in Financial Cents' 2026 survey. In the same survey, 90% of firms had no written AI policy1. For tax preparers, the gap is not only a matter of policy but of federal rules.
What the rules already require
The IRS is direct about it. Publication 4557 states that under the FTC Safeguards Rule, tax return preparers must create and enact security plans to protect client data, and that failure to do so may result in an FTC investigation2. The Safeguards Rule applies because the Gramm-Leach-Bliley Act's definition of a financial institution includes professional tax preparers2.
Publication 5708 sets out what the written information security plan (WISP) must contain. Among the FTC requirements it lists, a firm must3:
- designate a qualified individual to coordinate its information security program;
- identify and assess the risks to customer information in each relevant area of its operation;
- implement multi-factor authentication for anyone accessing any information system, unless the qualified individual approves an equivalent control in writing;
- report a security event affecting 500 or more people to the FTC as soon as possible and no later than 30 days after discovery.
Publication 5708 also recommends requiring that new software be approved before it is installed on the firm's network3. An AI tool that reads client email, documents or ledgers is exactly such a system.
What vendors say about data
We read each vendor's own statements. Where a vendor did not address a question on the pages we read, we say so.
| Tool | What it states about client data |
|---|---|
| Karbon | Firm data stays within Karbon, is not shared externally or used to train models, and stays in-region; built on the Azure OpenAI Service4 |
| OpenLazarus | Mail, documents, calls and the AI's work run on the firm's own server; access follows roles; every action is logged; nothing is used to train anyone's model5 |
| Botkeeper | SOC 2 Type 2 compliance6 |
| Dext | AI decisions are applied only after the practice approves them7 |
| Canopy, Financial Cents, Basis, Digits | Not addressed on the pages we read |
OpenLazarus also says European firms can run on servers in the EU, under EU law8, and that its accounting setup goes into the written security plan a preparer already keeps5.
Questions to put to every vendor
Ask in writing
- Where is client data stored, in which country, and on whose infrastructure?
- Which AI models process it, and is any of it retained or used for training?
- Which security attestations do you hold (for example SOC 2 Type 2), and can we see the report?
- Does every user, including the AI, sign in with multi-factor authentication?
- Is every action by the AI logged, and can we export the log?
- What do you do, and how fast do you tell us, if there is a breach?
- What happens to our data if we leave?
Adding AI to the WISP
- List every AI tool already in use, including general assistants staff use on their own. In the 2026 survey, 96% of firms using AI used general assistants1.
- Decide what may and may not go into each one. A general assistant with no data agreement should never receive taxpayer data.
- Assess each approved tool as the plan requires: what it stores, who can access it, and how access is authenticated.
- Set permissions for the AI itself. What it may do alone, what needs approval and who reviews its log.
- Write it down and train staff. A one-page AI policy attached to the WISP closes the gap 90% of firms reported.
- Review it yearly, and whenever a tool or vendor changes.
Done properly, a client could ask where their return documents went and the firm could answer precisely: which system, which country, who opened them and what the AI did with them. For the tools that handle that data, see the main guide.
Questions buyers ask
Do accounting firms need a written information security plan?
Yes, if they prepare tax returns. IRS Publication 4557 says that under the FTC Safeguards Rule tax return preparers must create and enact security plans to protect client data, and points to Publication 5708 for how to write one. Failure to do so may result in an FTC investigation.
Does an AI tool need to be in the WISP?
Any system that stores or processes customer information belongs in the risk assessment and access controls the plan describes. Publication 5708 also asks firms to approve new software before it is installed on the firm’s network. An AI tool that reads client documents or email is such a system.
Which AI vendors say client data is not used to train models?
Of the tools in our guide, Karbon states that firm data stays within Karbon, is never shared externally and is not used to train AI models. OpenLazarus states that nothing the firm holds is used to train anyone’s model and that everything runs on the firm’s own server. For the others, ask in writing.
Sources
- The State of AI in Accounting and Bookkeeping 2026. Financial Cents. Accessed 8 Nov 2026.
- Publication 4557: Safeguarding Taxpayer Data, a guide for your business. Internal Revenue Service. Accessed 8 Nov 2026.
- Publication 5708 (Rev. 8-2024): Creating a Written Information Security Plan for your Tax and Accounting Practice. Internal Revenue Service. Accessed 8 Nov 2026.
- AI-powered practice management for accounting firms. Karbon. Accessed 8 Nov 2026.
- Accounting firms: clients, returns and every filing date, on one system. OpenLazarus. Accessed 8 Nov 2026.
- AI accounting, built for accounting firms. Botkeeper. Accessed 8 Nov 2026.
- Dext AI Assist: the AI agent for accounting practices. Dext. Accessed 8 Nov 2026.
- Questions about OpenLazarus. OpenLazarus. Accessed 8 Nov 2026.
Updated 8 Nov 2026: First published.