Can accountants put client files into ChatGPT?

26 U.S.C. § 7216 makes it a misdemeanor for a tax return preparer to knowingly or recklessly disclose “any information furnished to him for, or in connection with, the preparation of any such return”, or to use it “for any purpose other than to prepare, or assist in preparing, any such return”. The statute carries a fine and imprisonment. Its exceptions include a disclosure or use “permitted by regulations prescribed by the Secretary”.

Those regulations (26 CFR § 301.7216-2) set what a preparer may share with other preparers and with contractors, with conditions that depend on where the other party is located and on what services it performs. Whether sending a client file to an AI service fits those conditions is a question for your tax advisor and the regulation text, not for this page. The point for a firm is simple: an AI service that receives return information is an outside party, so the question has to be asked before the file goes in, not after.

The FTC's guide to the Safeguards Rule says the rule applies to financial institutions subject to the FTC's jurisdiction “and that aren't subject to the enforcement authority of another regulator”, and it lists tax preparation firms among its examples. Whether your firm is covered is for you and your advisor to confirm.

On service providers it says to “select service providers with the skills and experience to maintain appropriate safeguards”, and that “your contracts must spell out your security expectations, build in ways to monitor your service provider's work”. The guide defines a service provider as any person or entity that “receives, maintains, processes, or otherwise is permitted access to customer information”. An AI tool that sees client files fits that description.

• List every AI tool in use, including personal and free accounts. Business terms cover only the plan they come with.
• For each, find the sentence in its terms about training on your data and about how long prompts and files are kept, for the plan your staff actually use. For example, Microsoft's page on data protection for Copilot used by organisations says: “Your data isn't used to train foundation models”.
• Check the contract: does it state your security expectations and how you can monitor the provider?
• Write down which tool is approved for which job, so client files do not end up in a personal account.
• Decide what happens when the answer to “may an outside company process this file?” is no.

A business plan with proper contract terms can be enough for many tasks, especially where no client-identifiable information goes in. It is not enough when your rules, your client or the data itself say no outside processor may see the file. Then the AI model has to run on your firm's own hardware or in its own cloud account.

That is what we set up: Aether Core, private AI on your own machine or in your own cloud account. For accounting work we also build Aether Index, which reads receipts and invoices and prepares the data for a purchase book, with a person approving every document. We tell you plainly when you do not need either. This page is general information, not tax or legal advice.