AI Tools for Tax Advice: The Risks a Small Practice Must Manage

The main risks of using AI for tax advice are invented or out-of-date rules, client data leaving your control, and output going to clients unreviewed. A small practice reduces them by keeping AI to drafting and explaining, sourcing every rule from the official page, redacting or restricting client data, and requiring a named reviewer's sign-off.

The tools are useful, but the risk profile of tax is unusual: a confident wrong answer about a threshold, a deadline or a relief can cost a client real money months later, and you carry the professional responsibility. The controls below are cheap, mostly procedural and take a practice of two to ten people about a week to put in place.

Follow me on Instagram@sagnikteaches

Four ways AI goes wrong in tax work

Most coverage lists generic AI risks. For a tax practice, four failure types account for nearly everything, and each needs a different control.

Connect on LinkedInSagnik Bhattacharya

Rules that are invented or out of date

Language models predict plausible text. Ask for the deadline for a particular filing, a threshold for a relief or the conditions of a deduction and the answer often sounds exactly right. It may be a rule from a previous year, a rule from another jurisdiction or a blend of two. The model has no way to flag that its source is older than the current filing year. The mechanism is explained in how AI hallucinations happen; for tax the practical point is that every number, date and condition must be verified against the tax authority's own current page.

Subscribe on YouTube@sagnikteaches

Client data that goes somewhere you did not intend

Pasting a return, a payroll summary or a set of bank lines into a chat window sends that data to a third party. Whether that is acceptable depends on the plan (consumer plans and business plans differ on training and retention), your engagement terms, your professional obligations and, for some preparers, a specific consent rule. This is covered in its own section below.

Answers that fit the question but not the client

A tool answers the question as asked. A good adviser asks what was not said: is the client a sole trader or a company, resident in one place or two, is there a loss carried forward, is this the first year? AI will rarely probe unless you instruct it to, and a general answer given to a specific client is the typical way advice goes wrong without anyone lying.

Unreviewed output reaching the client

The most avoidable risk. A tired preparer in a busy season pastes the AI's explanation into an email, skims it and sends. Under time pressure, review is the first step to be skipped, which is why the control must be a defined sign-off rather than a good intention.

A risk register you can copy and fill in

Put the following in a shared document. Each row is a task where someone in the practice might use AI, with the risk rating, the control and the person who owns it. The ratings below are illustrative for a small practice.

Notice that the register does not say "never use AI for tax research". It says what AI may do in that task (suggest search terms, summarise your own notes) and where the answer must come from. That distinction is what keeps the policy used rather than ignored.

Illustration: a six-person practice and one wrong deadline

Say a six-person practice uses a general chatbot to draft client reminder emails before a filing deadline. A preparer asks for "a short reminder email for sole traders about the filing deadline". The draft gives a date. The date is the deadline for the previous year, because the model's training pre-dates the current rules. The preparer sends it to 40 clients.

Nothing about the draft looked wrong: the tone was right, the structure was right, and the date was formatted properly. Three clients called to ask whether the deadline had moved, which is how the practice noticed. The remedy was a correction email and an afternoon of phone calls. A one-line procedure would have prevented it: any date, rate or threshold in a client message is copied from the official page and the page address is noted in the file.

Now add the control. The practice's template prompt tells the tool: "Leave the deadline as [DATE TO BE ADDED] and do not state any figures." The preparer inserts the verified date. The draft arrives with a visible placeholder that cannot be missed, and the model cannot supply a wrong number because it was told not to supply one.

Prompt wording that lowers the risk

You cannot prompt your way to safety, but the right instructions remove one class of errors. Use a fixed block at the top of every tax-related prompt.

You are helping a small tax practice draft client communications.
Rules:
1. Do not state any tax rate, threshold, deadline, allowance or penalty.
   Write [CHECK: rate], [CHECK: date] and so on where one is needed.
2. Do not say whether a relief or deduction applies. List the questions
   a preparer should ask to decide.
3. If my facts are incomplete, list what is missing before drafting.
4. Write in plain English for a client with no accounting background.
5. Mark anything you are unsure about with [UNSURE].

Here is a realistic output from a prompt like that, with the points a reviewer should note. The request was an explanation of why a client's payment on account was higher than last year.

Draft: "Your payment is higher this year because it is based on last
year's total bill, which was larger than the year before. [CHECK: rate
of payment on account]. We have attached the working. Nothing has been
overpaid; any difference is settled when your return is filed.
[UNSURE: whether a reduction claim is available given your income this
year.]"

The reviewer's job: confirm the mechanism, replace the placeholder from the official page, and decide whether to raise the reduction question with the client. The draft has saved typing time without making a single technical decision, which is where AI belongs in tax work.

Client data, redaction and consent

Data protection and consent are separate questions that need separate answers.

Where does the data go? Read the privacy terms for the exact plan you use, not the vendor's home page. As a general pattern, business plans (ChatGPT Business or Enterprise, Claude Team or Enterprise, Microsoft 365 Copilot, Gemini in Workspace) do not train on your business content by default, whereas consumer plans have a training setting that you or the staff member must switch off, and the setting is easy to change back. Training is only one question. Retention, who at the vendor can view content for abuse monitoring, and where it is processed matter as much for a tax file, and those answers sit in the vendor's data-processing terms rather than its marketing page. Record in the register which plan every tool is on, who holds the admin account and the date you last read the terms.

Redact first. For tasks that need only the shape of the facts, strip names, taxpayer identifiers, addresses, bank details and employer names. Replace them with labels: "Client A, sole trader, income about $62,000". It takes two minutes and removes most of the exposure. If you cannot redact without losing what the task needs, the task belongs on a business-grade plan or outside AI.

Consent for preparers covered by Section 7216. Section 7216 is a criminal provision. A person in the business of preparing income tax returns, or providing services connected with preparing them, who knowingly or recklessly discloses information furnished for a return, or uses it for any purpose other than preparing the return, commits a misdemeanour: a fine of up to $1,000 ($100,000 in some cases), up to a year in prison, or both. A companion civil penalty of $250 (section 6713) applies to the same disclosures and uses without any need to show the preparer acted knowingly or recklessly.

The regulations then carve out disclosures that need no consent. Regulation 301.7216-2 allows a preparer to pass information to another preparer in the same country who assists with the return or provides auxiliary services, as long as that second party makes no substantive determinations (analysing or applying the law), and to contractors who program, maintain, repair, test or supply the software used for return preparation, provided each person receiving the data gets a written notice explaining the rules and penalties. The tax authority's Section 7216 FAQ states the default plainly: every disclosure not specifically authorised needs the taxpayer's signed consent in advance. Disclosures to a preparer located outside the country need consent even where the same disclosure at home would not, and the FAQ says consent generally cannot cover sending social security numbers to an offshore preparer.

Those rules were written before today's AI tools and do not name them. Whether a particular assistant fits one of the permitted categories, for example as a contractor supplying preparation software, depends on what the tool does with the data, where it is processed and what your contract says. Two practical points follow. A general chatbot asked to interpret the law for a client file looks closer to "substantive determinations" than to auxiliary processing. And a vendor that processes data or lets support staff view it in another country brings the offshore rules into play. The cautious default is a signed consent, in the format the regulations require, before return information goes into any AI service, unless your adviser confirms an exception covers your setup. The FAQ describes valid consents as paper or electronic documents that name the preparer and the taxpayer, state what will be disclosed and to whom, carry mandatory wording and warnings, and are signed and dated by the taxpayer; Revenue Procedures 2013-14 and 2013-19 set out the detail. Preparers working under other regimes should read their own confidentiality and data-protection rules in the same way. Never rely on a web page, including this one, for the final answer.

Two practical rules follow whichever regime applies to you. First, consent is given before the disclosure, not after. Second, a line buried in the engagement terms is not the same as a consent document written to the format the rules require. Keep them separate and keep the signed copy in the client file.

Where the checking step sits in the workflow

A sign-off that nobody can see is easy to skip. Build it into the file itself. Add three lines to the end of your standard working paper or job template:

AI used on this file: Yes / No
If yes: tool and plan _______ ; purpose _______
Rules, dates and figures verified against official source: Yes / No
Source address or reference: ______________
Reviewed by: ________  Date: ________

That takes 30 seconds and does three things. It tells a future reviewer what was AI-assisted. It forces a source reference for every rule. It leaves a record if a client later disputes an answer.

For the review itself, use two passes with different purposes. The first pass is a "numbers and dates" pass: every figure, rate, date and threshold is traced to the official page. The second is a "does it fit this client" pass: the reviewer reads the draft with the client's file open and asks what the tool did not know. Splitting them stops a reviewer from reading for tone and thinking they have checked the content.

Ten questions to test a tool before you use it on client work

Keep a standing set of ten questions with answers you have confirmed against official sources. Include questions where the right answer is "it depends" or "I do not know", because a good tool should say so. Run the set each quarter and after any plan change, and record the result. A suitable mix:

1. Two questions whose answer changed this filing year.
2. Two questions about thresholds where a close number exists (so a near miss shows up).
3. One question that needs a fact the tool does not have, to see whether it asks or guesses.
4. One question about a rule in a different jurisdiction, to check it does not blend them.
5. One question where the answer is a penalty or a deadline.
6. Two requests to cite a source, then check that the source exists and says what the tool claims.
7. One scenario with an unusual twist, such as a loss carried forward in a first year of trading.

The citation tests matter most. Language models invent references that look genuine, with the right format and plausible titles. If a tool gives a reference you did not already know, open it before you believe it. The same habit is described for legal work in stopping AI inventing case law, and it transfers directly.

Staff rules that fit on one page

A policy only works if people remember it. Write the staff version in plain words and pin it where people work.

• AI may draft, summarise and explain. It may not decide.
• Rates, dates, thresholds and conditions come from the official page, noted on the file.
• No client names, identifiers or account numbers in any tool that is not on the approved list.
• Approved tools are listed with the plan and admin owner. New tools are requested, not tried on live files.
• Every AI-assisted client communication has a named reviewer before it goes out.
• If you are unsure whether something is allowed, ask before you paste.
• Do not press thumbs up or thumbs down on a conversation that contains client details. Anthropic, for one, says feedback sent from its business plans can be used for training, even though those plans are otherwise excluded.
• If you think you have pasted something you should not have, tell the practice lead the same day. Nobody is blamed for reporting.

The last two lines matter more than the rest. A practice that punishes mistakes gets concealed mistakes, and concealed data exposures are the expensive ones.

What to say to clients

Add a short passage to your engagement letter. For example:

We may use AI tools to help draft documents and explain technical
points. We use only business-grade tools that we have approved, and we
do not enter your identifying details into any other tool. Every client
document is reviewed by a named member of our team, and rates, dates and
figures are checked against official sources. Where the law or our
professional rules require your written consent to share information
with a service provider, we will ask for it separately.

Have your own adviser or professional body check this wording before you use it. The point is not the legal drafting but the honesty: it tells clients what you do, and it commits you to the controls you have just built. Our tutorial on AI engagement letters for accountants goes further on scope wording.

A second illustration: a bookkeeping rule that drifted

A solo adviser uses AI to categorise a client's transactions each month, with a rule that any payment to a certain supplier is a business expense. In month five the client begins buying personal items from the same supplier. The categorisation rule continues to treat them as business expenses, and nothing flags it because the totals look plausible. A month-six review of ten sampled transactions would have caught it; so would a rule that the tool flags new descriptions it has not seen.

This is the "answers that fit the question but not the client" failure again, in a repeated task rather than a single question. The control is sampling: ten transactions per client per month, chosen at random rather than the top ten by value, with errors fed back into the rules. Record the error rate. If it rises above the level you set (say two in ten), stop auto-categorising for that client until you have fixed the rule.

A third illustration: summarising a long notice

A tax authority letter runs to six pages. The preparer asks AI for a summary. The summary correctly lists the amount and the payment date but leaves out a paragraph stating that interest runs from an earlier date. The omission is invisible unless someone compares the summary to the letter. The control: the reviewer reads the original, not only the summary, for any letter that carries a money amount or a deadline. The summary is for the client's convenience; the letter is the source.

When to keep AI out of the task

Some tasks should stay with a qualified human, whatever the tool can do:

• Choosing a filing position where the law is unclear.
• Advising on a transaction with large or irreversible consequences.
• Responding to an enquiry or investigation by a tax authority.
• Anything where the client would reasonably expect your professional judgement and signature to stand behind the words.

In these cases AI can still help around the edges, for example by organising your notes or drafting a list of documents to request, but the thinking and the conclusion are yours. For the lower-risk tasks where AI does earn its place, see how small tax practices use AI through the busy season. For business owners asking what they can do without a practice at all, can AI do my business taxes covers that side.

A one-week rollout plan

Day one: list every AI tool anyone in the practice already uses, including personal accounts, and note the plan. Day two: write the register above with your own tasks. Day three: set up the approved tool list and move people off any unapproved consumer account. Day four: add the three file lines to your job template and write the ten test questions. Day five: brief the team on the one-page rules and agree who reviews what. A fortnight later, run the test set and sample some files. If you want help deciding which tasks are worth handing to AI in the first place, that is what my AI implementation consultation covers, and you can reach me through the contact page.

Questions small tax practices ask about AI risk

Can I paste a client's tax return into ChatGPT or Claude?

Only if your agreement with the vendor, your engagement terms and any consent rule that applies to you all allow it. Safer first steps: remove names, identification numbers and addresses, use a business plan that does not train on your content, and ask your professional body or adviser about consent.

Which tax questions are safest to give an AI tool?

Drafting and explaining: a plain-language cover note, a checklist of documents to request, a summary of a letter you have already read. Least safe are questions where the answer is a rule, a rate, a threshold or a deadline, because those must come from the official source.

Does a disclaimer on my advice cover AI mistakes?

No. You remain responsible for what you sign and send. A disclaimer helps set expectations, but it does not replace a review step, and it will not help if a client acted on a wrong figure you did not check.

Should I tell clients I use AI?

Yes, in the engagement letter, in plain words: what the tool is used for, that a named person reviews all output, and what happens to their data. If a consent form is needed for your work, that is a separate document, not a line in the terms.

How often should I re-test the tools?

Every quarter, and after any big update or change of plan. Keep ten sample questions with known answers, run them, and record the date and result. Rules change each filing year, so a tool that was right in March can be wrong in November.

Further reads

• How Should Consultants Use AI? A Client-Data Checklist — A client-data checklist you can adapt for tax files.
• Best AI Accounting Agents: QuickBooks, Xero JAX and Sage Copilot — AI agents inside the accounting software you may use.
• How Accountants Use AI to Explain Tax to Clients in Plain English — Low-risk drafting use: explaining tax to clients.
• Accounting Software for CPA Firms: Automation Features Compared — Practice software with automation compared.
• AI Readiness Checklist for Accountants, Solicitors, Consultants — A wider readiness check for professional firms.
• Tax Software With AI: What a Small Business Should Check — What to check in tax software that has AI built in.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: the text of Section 7216 and regulation 301.7216-2 (Cornell Legal Information Institute), the tax authority's Section 7216 FAQ, OpenAI's business data page, Anthropic's commercial-products training article, Microsoft's Copilot privacy page and Google's Workspace generative AI privacy hub, all checked in November 2026. Check your own tax authority's current guidance before relying on any point here.