COSO did not publish a new control framework in February 2026. Achieving Effective Internal Control Over Generative AI takes the five components and 17 principles of the 2013 Internal Control — Integrated Framework and shows how they apply when a firm uses generative AI. The practical move for the rest of 2026 is an inventory of those uses, a risk note on each one that touches client data, and a named owner. The publication does not set a compliance date.
Last verified: September 29, 2026. Primary source: COSO, Achieving Effective Internal Control Over Generative AI (news release February 23, 2026). Authors commissioned by COSO: Scott Emett, Marc Eulerich, Jason Guthrie, Jason Pikoos, and David A. Wood. AICPA is one of COSO's five sponsoring organizations.
What the February 2026 publication actually is
The report is written for people who run or assure AI processes: managers, controllers, risk teams, internal audit, boards, and external auditors looking at generative-AI controls. It says outright that it does not create a separate governance model. The five components stay Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring Activities. What changes is the terrain. Generative systems are probabilistic, they change when a vendor updates a model, they scale errors as fast as they scale useful work, and staff can turn them on without a procurement cycle.
COSO sorts common uses into eight capability types, in the order data moves toward a decision:
- Data extraction and ingestion
- Data transformation and integration
- Automated transaction processing and reconciliation
- Workflow orchestration and autonomous task execution
- Judgment, forecasting, and insight generation
- AI-powered monitoring and continuous review
- Knowledge retrieval and summarization
- Human–AI collaboration
A tax firm will recognize more than one of these without buying an "AI platform." Pulling figures off a client PDF is ingestion. A research copilot that summarizes a regulation is knowledge retrieval. A chatbot that drafts a client email is human–AI collaboration. The publication's point is to classify the use by what it does, then attach controls, instead of chasing product names.
The five components, in firm language
| Component | What COSO is asking you to show | A tax-firm reading |
|---|---|---|
| Control Environment | Tone, ownership, competence, and an acceptable-use boundary | A written rule for which tools may see client data, a named owner for each tool, and training that matches the role |
| Risk Assessment | Objectives for each use, then the ways it can fail | Hallucinated citations, a vendor model update, prompt injection, and a staff member pasting a return into a public chatbot |
| Control Activities | Preventive, detective, and corrective controls on the significant risks | Human review before an AI draft reaches a client or a workpaper, access limits, and a rollback when a model update changes results |
| Information and Communication | People know the rule, the limit, and where to escalate | The acceptable-use policy is findable, and reviewers know which outputs are drafts |
| Monitoring Activities | The firm checks whether the controls still work | Sample AI outputs, watch for drift after a vendor update, and keep an incident note when something goes out unchecked |
COSO's own examples under the control environment are an acceptable-use policy, a named owner with authority to change the system, role-based training, and a consequence for misuse. Under risk assessment, the report tells you to write the objective of the use before you score the risk, and to keep a living register when models, prompts, or data sources change. It also says to ask whether generative AI is the right tool. A deterministic check is sometimes the lower-risk choice.
Two traits COSO treats as design rules, not slogans: outputs are claims until a person validates them, and prompts, retrieval sources, and transformation rules are configurations with a version history and a way to roll back. That second point is how a firm answers an auditor who asks what changed between last month's result and this month's.
AICPA Section 9561 is a different document
On September 11, 2026, the AICPA posted TQA Section 9561, SOC Examinations: Effect of the Service Organization's Use of AI on SOC 1 and SOC 2 Examinations. The page describes technical questions and answers on how a service organization's use of AI affects a SOC 1 examination under AT-C section 320 and a SOC 2 examination under AT-C section 205. The questions themselves are an AICPA member download, so this summary rests on the AICPA's description of them.
That is examination guidance for service organizations and their service auditors. It does not replace the Trust Services Criteria, and it does not require every CPA firm to implement the COSO generative-AI publication before a 2027 audit. A firm that undergoes a SOC examination, or that relies on a vendor's SOC report, should ask the examiner how AI in the system description will be handled. A firm that does not issue or receive SOC reports still has the COSO publication as voluntary control guidance, and still has Circular 230 if the AI touches a federal tax matter. The due-diligence side of that duty is in IRS Circular 230 AI guidance for CPA firms.
A Q4 cycle, taken from COSO's six steps
COSO's implementation section is a loop, not a deadline: set governance, inventory uses, assess risk by component, design and map controls, implement and tell people, then monitor and start again. The dates below are a pace for a firm that has not written this down yet. They are not in the publication.
| When | Step | Done when |
|---|---|---|
| October 2026 | Inventory | Every generative tool in use or planned is listed, including the ones staff opened on their own. Each row has an owner, a capability type from the list of eight, the data it can see, and whether a vendor hosts the model |
| November 2026 | Assess | Each row that can touch client data has a short risk note: what a wrong or leaked output would do, and what already stops that |
| December 2026 | Map | Significant risks have a preventive control and a detective control, each pointed at a COSO component. Acceptable-use language is in a place staff can open |
| First quarter 2027 | Monitor | Someone samples outputs, records vendor model changes, and brings exceptions to the owner. Then the inventory gets another pass |
The inventory is the step firms skip, and it is the one COSO puts second for a reason. Shadow use — a browser chatbot, an add-in inside the tax software, a transcription tool on client calls — is still a use. If it can receive a name, an identifying number, or a figure from a return, it belongs on the list next to anything the firm bought on purpose. Where that file is allowed to go is the subject of what the IRS expects when you use AI with client data.
What software can and cannot carry
COSO says the five components do not prescribe a technology product. They describe what has to be true for the firm to rely on a process. A client portal can support two of those truths for the communication channel: who was allowed in, and what they did.
XyloDocs is an AI client communication platform for tax firms. Client portal access, document intake, e-signature, and bilingual calling, SMS, and WhatsApp run with AES-256 encryption, individual logins, one-time passcodes, and an audit trail. Those records are evidence a firm can put in the control file for access and activity on that system. They line up with Control Activities and Monitoring Activities for the channel. They do not assign an owner, write the acceptable-use rule, validate a generated citation, or score model drift. Those stay in the six-step cycle above. The same boundary applies to the Written Information Security Plan: logging supports it, and the plan itself is still the firm's. See WISP requirements for tax firms and how XyloDocs handles tax-document security.
The platform is available now, on its own, without tax software. Client accounts are included.
Frequently asked questions
What is the COSO generative AI framework?
Achieving Effective Internal Control Over Generative AI, released February 23, 2026, applies COSO's 2013 Internal Control — Integrated Framework to generative AI. It keeps the five components and sorts common uses into eight capability types, with example controls and a six-step implementation loop.
Did COSO replace the 2013 internal control framework?
No. The publication says it adapts the 2013 framework's five components and 17 principles. It does not create a separate governance model, and it does not prescribe a software product.
What is AICPA Section 9561?
TQA Section 9561, posted September 11, 2026, is technical guidance on how a service organization's use of AI affects SOC 1 and SOC 2 examinations. It is not a new set of Trust Services Criteria, and it is not a deadline for every CPA firm to adopt the COSO publication.
Does an accounting firm have to finish this before 2027 audits?
The publication does not set a date. External auditors and SOC examiners can ask how generative AI is governed when it is relevant to a control or a system description. A Q4 inventory and a named owner put the firm in a position to answer. They are a management choice, not a COSO mandate.
Can client-portal logs satisfy the five COSO components?
Logs, access rules, and encryption are evidence for parts of Control Activities and Monitoring on that system. Ownership, acceptable use, risk assessment, staff communication, and review of AI outputs are still firm responsibilities. One product does not complete the framework.
Sources and related reading
- COSO, Achieving Effective Internal Control Over Generative AI (news release February 23, 2026)
- COSO news release (February 23, 2026)
- Journal of Accountancy, February 26, 2026
- AICPA, TQA Section 9561 (posted September 11, 2026)
- Deloitte DART note on TQA Section 9561 (September 21, 2026)
- IRS Circular 230 AI guidance for CPA firms
- What the IRS expects when you use AI with client data
Leave a Comment
Your comment is private and will only be visible to the author. We'll send you an email confirmation.