WISP for Tax Preparers: Add Your AI Tools Without Gaps

To cover AI tools, add one section to your existing written information security plan (WISP): a register of approved tools, what client data each may touch, vendor checks, multi-factor authentication, rules for staff, and an incident step for AI mistakes. Then update the data inventory, risk assessment and training record that already sit in the plan.

The IRS template (Publication 5708) doesn't mention AI tools, and neither does the FTC's guidance on the Safeguards Rule that the template helps you meet. They don't need to. The rule asks you to know what customer information you hold and where it goes, to oversee the service providers that handle it, to control access and to plan for incidents. An AI tool that sees a return is a system, a service provider and a risk, all at once.

Follow me on Instagram@sagnikteaches

What the existing plan already requires, and where AI slots in

Publication 5708 (Rev. 8-2024) says the Safeguards Rule requires a firm to designate a qualified individual, assess risks, design and monitor safeguards, select and oversee service providers, adjust the programme as circumstances change, use multi-factor authentication for anyone accessing information systems (unless the qualified individual approves an equivalent in writing), and report a security event affecting 500 or more people to the FTC as soon as possible and within 30 days of discovery. The FTC's own guidance adds a written incident response plan and a written risk assessment. The FTC also says financial institutions holding information on fewer than five thousand consumers are exempt from certain provisions, so check which apply to you.

Connect on LinkedInSagnik Bhattacharya

AI doesn't create new categories of duty. It adds new places for old duties to bite:

Subscribe on YouTube@sagnikteaches

That is the whole job: one new section, and seven small edits elsewhere. The sections below give wording you can adapt, and a worked example for a practice of five people.

Step 1: find every AI tool, including the ones you didn't install

Start with the data inventory, because the rule expects you to keep an accurate list of systems, devices, platforms and personnel. Ask each person to list every AI tool they use for any work task, and check the places AI hides: the tax software itself (some packages now include assistants), the email app's summary or draft buttons, the video-meeting app's recap feature, the PDF reader's "ask this document", browser extensions, phone keyboard assistants and transcription tools.

Illustrative result for a five-person practice (two preparers, one reviewer, one admin, one owner):

• The owner's paid chat assistant account (individual plan), used for drafting client letters.
• A browser extension a preparer installed for rewriting emails.
• The built-in AI summary in the practice's email system.
• The meeting app's recap feature, switched on by default.
• The tax software's own assistant, not yet used.

Five tools, and the owner knew about two. That is a typical finding, and it is the reason the inventory comes first. For the "shadow" side of this problem, see how to stop staff pasting client data into free tools.

Step 2: the AI-tools section, ready to paste

Illustrative wording for a new section, to sit after your data-disclosure and electronic-exchange policies. Edit it to match what you actually do; a WISP that describes controls you don't operate is worse than none. Have your adviser or counsel read it.

Section [X]. Use of artificial-intelligence tools

X.1 Purpose and scope. This section governs any software that uses AI to generate, summarise, classify or transcribe content, including stand-alone assistants, features built into other software, browser extensions and meeting recorders. It applies to all employees, contractors and any other person who works with the firm's information.

X.2 Approved tools register. Only tools listed in Attachment [G] may be used with client information. The Qualified Individual approves additions in writing. Tools not on the register may be used only with information that contains no client or customer data.

X.3 Prohibited inputs. Social Security numbers, full account and routing numbers, dates of birth, full names with addresses, copies of identity documents and complete returns must not be entered into any AI tool unless the Qualified Individual has approved that tool in writing for that data type and the client has given any consent the law requires.

X.4 Accounts and access. Each user has a named account with multi-factor authentication. Shared logins are prohibited. Accounts are removed on the day a person leaves or a tool is retired.

X.5 Vendor requirements. Before approval, the firm records the vendor's data terms: whether inputs are used to train models, retention periods, where data is stored, the right to delete, security certifications and breach notice commitments. Terms are re-checked at least annually and when the vendor notifies a change.

X.6 Human review. Output from an AI tool is a draft. A named staff member reviews all AI-assisted content before it is sent to a client or used in a return, and no tax position, figure or filing decision is taken from AI output alone.

X.7 Retention. Chat history, uploads and transcripts containing client information are deleted on the same schedule as other client records.

X.8 Incidents. Any suspected entry of prohibited data into a tool, any vendor breach notice and any loss of an account with AI access is a security event and is reported to the Qualified Individual at once, under the Incident Response section.

X.9 Training and review. Staff receive training on this section at onboarding and annually, and sign the acknowledgement in Attachment [D]. The Qualified Individual reviews this section and the register at least annually.

Nine short clauses; none requires a lawyer to understand. Notice that X.3 is not an outright ban: it creates a controlled exception, which is more honest for a practice that will inevitably want to use AI on real work.

Step 3: the register, filled in

The register is the most useful page in the whole plan, because it is what you'd show someone who asks which tools touch client information. Columns that matter, with illustrative entries:

The facts to record in the "plan and data terms" column come from each vendor's own pages: business plans for ChatGPT, Claude, Gemini in Workspace and Microsoft 365 Copilot (now listed as Microsoft Copilot in Microsoft's documentation) don't train on your content by default, while consumer plans have a setting you must switch off yourself. Write down the date you checked, because settings and plan names change. Note also that ChatGPT Business and Claude Team need at least two seats, so a very small practice may find the individual-plan route cheaper and then restrict it to the lowest-risk data.

Step 4: vendor due diligence a small practice can finish in 30 minutes

The rule expects you to select service providers able to maintain safeguards, require them by contract, and reassess them periodically. With a large AI vendor you usually can't negotiate the contract, so the practical test is reading the published terms and data-processing addendum and keeping a record. Questions to answer in writing for each tool:

1. Does the vendor use customer inputs or outputs to train models, by default and on this plan?
2. How long are inputs retained, and can you delete them on request?
3. Where is data processed and stored, and which sub-processors does the vendor use?
4. What security certifications does it publish (for example a recognised independent audit report), and can you see the summary?
5. Does it offer MFA, single sign-on and admin controls for named users?
6. What does it commit to if it has a breach affecting your data, and how fast?
7. Can you export or delete everything if you leave?
8. Do its terms allow you to use it with tax return information, or do they exclude regulated data?

Illustrative record for one tool: "Team chat assistant: reviewed [date] by [name]. No training on business content by default (vendor privacy page). Retention configurable; admin can delete. Independent security audit summary available on request. MFA supported. Breach notice commitment found in data-processing terms. Decision: approved for redacted data only." Thirty minutes, and a paper trail. If the terms are silent or unclear on any question, the answer for that tool is amber or red, not green. The longer question list in questions to ask before buying AI that touches client data goes deeper.

Step 5: update the risk assessment with AI-specific risks

The written risk assessment must name foreseeable internal and external threats to customer information. Add these, each with a likelihood, impact and the control that answers it:

• Wrong paste. A preparer pastes a full return or a list of clients into a tool not on the register. Control: X.3, redaction habit, training, short-term monitoring for use of unapproved sites.
• Vendor retains or trains on inputs. Control: plan selection, vendor review, deletion step.
• Account takeover. A stolen password gives an attacker the history of every client chat. Control: MFA, named accounts, password manager, deleting old chats.
• Prompt injection through documents. A document or web page carries hidden instructions that steer an AI agent with access to your files. Control: no agent access to client folders; human review of output.
• Wrong or invented output. A draft cites a rule that doesn't exist or gets a figure wrong. Control: X.6 human review, never take a position from AI alone.
• Features switched on by default. A meeting recorder or assistant is enabled in an update. Control: quarterly check of admin settings.

The risk of fraud against the practice is also changing, so note it where it fits: deepfake voices and convincing phishing messages make verification rules for client instructions more important than before. That sits in your existing access and identity controls.

Step 6: consent, redaction and what tax-return information needs

Client information from a return has its own consent rules on use and disclosure, separate from the security duty. If a tool or a vendor is outside your firm, check what the client must sign before their return information is disclosed or used, and keep the signed form in the file. The practical guide is Section 7216 consent for AI tools: what clients must sign. For the daily habit of removing identifiers before anything leaves your systems, use how to redact a return before you paste it into ChatGPT.

A before-and-after to share with staff. Before: "Summarise this client's return: [name], SSN [number], wages $84,200, interest $312, two dependants, address [address]." After: "Summarise the following facts for a letter: single filer with two dependants, wages around $84,000, small interest income. Do not ask for identifiers." The second version gives the assistant enough to draft a letter and keeps every identifier inside your own systems.

Step 7: the incident plan, with AI events added

The FTC says an incident response plan must cover its goals, the internal processes you'll activate, clear roles and decision authority, communications inside and outside the firm, a process to fix identified weaknesses, documenting and reporting, and a post mortem. You already have one. Add AI examples to the definition of a security event and a short playbook:

1. Stop. Tell the Qualified Individual as soon as you notice; don't try to quietly fix it.
2. Contain. Delete the conversation or upload in the tool, revoke the session, change the password and revoke connected apps.
3. Record. Time, tool, user, what data, which clients, what you've done. Screenshots of settings help.
4. Assess. Did data go to a tool whose terms allow training or retention? How many clients? Does the number reach the threshold for notifying the FTC (500 or more people, within 30 days of discovery per Publication 5708)?
5. Tell the right people. Clients affected, your insurer if your policy requires, and any authority your adviser says applies.
6. Learn. What control failed? Update the register, the training and the plan.

An illustrative case. Say a preparer pastes a spreadsheet of 40 clients' names and refund amounts into a free assistant to sort them by size. She notices the same afternoon, deletes the chat and reports it, and the log shows: one tool not on the register, no SSNs, 40 clients, consumer terms that allow training unless switched off. The firm treats it as a security event, tells the 40 clients plainly, switches off the setting, blocks the site on office devices and adds a line to training. Forty is far below 500, but the record is what protects the firm. A fuller template is in the AI incident response plan for small businesses.

Step 8: training, acknowledgement and proof you did it

Publication 5708 suggests an employee and contractor acknowledgement signed and dated at annual training. Add a one-page AI rules sheet to that session: the register, the prohibited inputs, the redaction habit, the report-at-once rule. Walk through three real scenarios and ask what each person would do. Illustrative scenarios: a client emails a photo of their ID and asks you to "just summarise it"; your tax software adds an AI helper in an update; a colleague offers a browser extension that "saves loads of time". Sign, date and file.

Proof matters. If something ever goes wrong, the questions will be whether you had a plan, whether staff knew it, and whether you followed it. A dated register, a vendor review record, signed acknowledgements and an incident log answer all three. Keep them with the WISP in a format others can read, and store a copy off-site as the IRS template recommends.

A review rhythm that fits busy season

Annual review is the minimum, but tax season changes behaviour: people take shortcuts when the queue is long. A light rhythm helps:

• Before season (January): review the register, re-check vendor terms, retrain, re-sign acknowledgements.
• Mid-season (once): ten-minute check of admin settings and connected apps, and one question to staff: "Is anyone using a tool that isn't on the list?"
• After season: review incidents and near-misses, delete old chats and uploads, update the risk assessment.
• Any time: a new tool, a vendor terms change or an incident triggers an unscheduled review.

Illustrative time cost for the five-person practice: two hours to build the inventory, an hour to write the section, ninety minutes to review three vendors, an hour of training and ten minutes a month after that. That is about six hours of set-up and some two hours a year, small beside the cost of a client conversation after an incident.

What to ask your adviser, and what this does not replace

A written plan is one part of the duties tax preparers carry. This tutorial doesn't give legal or compliance advice, and the IRS template itself says it's not exhaustive and doesn't replace your own research. Ask a qualified adviser about: whether the fewer-than-5,000-consumers exemption affects you, how your cyber insurance treats AI-related incidents, whether your engagement letter needs an AI paragraph, and whether any other rules that apply to you add requirements. For how a practice might use AI day to day once the plan is in place, see how small tax practices use AI through the busy season. If you would rather map your own tool list with someone, that's what my AI implementation consultation covers, and you can contact me here.

Questions tax preparers ask about the WISP and AI

Do I need a separate WISP for AI?

No. Keep one written plan and add an AI-tools section, plus entries in the places that already list systems, risks and rules. A separate document drifts out of date and is easy to forget at review time.

Does the plan need to name each AI tool?

Yes, in practice. A register naming each tool, its purpose, the data it may touch and the approver is what shows you know where client information goes. Tools you have banned should be listed too, so staff know the rule.

Are AI vendors 'service providers' under the Safeguards Rule?

If a vendor receives, stores or processes customer information for you, treat it as one. The rule expects you to pick providers able to keep safeguards in place, require them by contract and review them periodically. Ask your adviser how it applies to a given tool.

How often should the AI section be reviewed?

At least annually with the rest of the plan, and whenever you add a tool, a tool changes its data terms, or something goes wrong. In busy season, a short monthly check of the register is cheap and catches creeping tools.

Further reads

• ChatGPT Prompts for Tax Preparers: Client Emails and Checklists — Prompts for client emails and checklists, safely.
• Form 8867 Due Diligence With AI: Interview Notes and Checklists — Keep diligence notes with AI and stay in control.
• Is It Safe for an Accountant to Use ChatGPT With Client Data? — How an accountant weighs the same risk.
• Does ChatGPT Train on Client Data? Business vs Free Plans — Business versus free plans on training.
• How to Redact Personal Data From Documents With AI Before Sharing — Redact personal data from documents before sharing.
• GLBA Safeguards for Insurance Agencies: An AI Tool Checklist — The same safeguards duty worked through for an insurance agency.
• Tax Preparation AI Software: TaxDome, Canopy and ChatGPT Compared — TaxDome, Canopy and ChatGPT sit in different product categories. Compare their AI, their cost models and the consent step before return data goes in.
• TaxDome Pricing: Plans, Seasonal Seats and What to Ask on the Demo — TaxDome's new client-based price against the old seats: four practices modelled, active-account rules, the AI add-on and the questions to ask on the demo.
• AI Tax Organiser: Build One That Chases Missing Documents — Turn a prior-year return into a client document list, track uploads row by row, and send reminders that name exactly what is still missing.
• AI Tax Return Prep for Small Practices: Extract, Review, Sign Off — A three-stage workflow for AI-assisted return prep: extract with page references, tie out with a spreadsheet, then review and sign off in writing.
• AI Tax Return Review vs Software Diagnostics: What Each One Catches — Ten planted errors and two decoys on one sample return show what diagnostics catch, what an AI review adds and what both still miss.
• Circular 230 and AI: Due Diligence When a Tool Drafts the Work — A per-return checklist and sign-off sheet that turns the IRS's June 2026 AI alert and Circular 230 diligence rules into a routine.
• n8n for Accountants: Client Document Flows, Cost and Hosting Choice — Choose between n8n Cloud and self-hosting for client document workflows, with plan costs, execution counts and where your data ends up.
• ALTA Best Practices and AI: What a Small Title Agency Should Document — Write the AI-use log for a small title agency: what Best Practices 5.0 says about AI, vendors and the written security plan, with a filled-in log.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: IRS Publication 5708 (Rev. 8-2024), Creating a Written Information Security Plan for your Tax and Accounting Practice; FTC, FTC Safeguards Rule: What Your Business Needs to Know; IRS Section 7216 information page for tax professionals; OpenAI ChatGPT Business pricing page; Claude pricing page; Google Workspace generative AI privacy hub; Microsoft Copilot data, privacy and security documentation.