Asking "what are the depreciation rules for residential rental property?" is a knowledge question. It is safe for a cloud AI assistant that never sees a client file. Uploading that client's Schedule E — with their name, address, EIN, rental income, and depreciation schedule — is a document question. It is not safe for a public model, and it is a serious disclosure even to a polished tax-AI cloud. Most offices use the same chat window for both. That single-bar design is the problem.
Split the work and most of the risk in this series becomes manageable. Keep mixing the work and no privacy policy will save you. Definition of the local side: what private AI is.
A simple test before you hit send
Before entering any prompt into an AI tool during client work, apply this filter:
| If the prompt still works after you delete every name, SSN, EIN, and dollar amount… | Then it is probably |
|---|---|
| Yes — the question is about rules, mechanics, or deadlines | A knowledge question — cloud assistant is eligible |
| No — the question requires specific client data to make sense | A document question — do not use Level 1; prefer local processing |
Examples that fail the test (document questions): "Read this W-2 and extract the employer EIN." "Find the missing 1099s in this zip file." "Translate this client's letter and keep the facts." "Summarize this organized return." Each of these requires the client file — they are document questions and they belong on local infrastructure.
Examples that pass the test (knowledge questions): "What is Form 8867 for?" "How does the residential energy credit phase out in 2026?" "Draft a generic organizer reminder email with placeholder fields." "What is the standard mileage rate?" These are all public knowledge that lives in IRS publications and regulations.
Why one tool feels efficient and is not
Tax season is a blender. The same browser tab that explained bonus depreciation this morning is still open when the stubborn PDF arrives in the afternoon. Muscle memory pastes. The model is helpful. The WISP never hears about it. That is how Level 1 usage happens to careful people — not through a policy decision, but through a workflow habit that nobody wrote down.
The single-bar design of most AI chat products encourages this mixing. There is one input box. It handles research, document analysis, writing, and file uploads interchangeably. The product is designed for convenience, not for information-classification discipline. A tax firm needs discipline the product does not impose — or a different architecture that separates the pipes.
Pause rule from the think-twice-before-upload post: before any paste that includes client data, ask whether the question still works without the file. If it does, rephrase. If it does not, use a different tool.
Two AIs, one desk — not two subscriptions of chaos
The split does not mean twice the complexity. It means two channels with a clear routing rule:
- Knowledge AI: Internet-connected, great at publications and explainers, trained on publicly available tax law. Forbidden to receive return images, client PDFs, or any file containing PII. This can be any cloud assistant you trust for general research — the security risk is low because no client data enters the channel.
- Document AI: Local extraction, classification, translation, and letter drafts from files that stay in the office. The file never crosses a third-party model API. This is Level 3 in the three-level framework.
The routing rule is simple: if the prompt needs a client file to work, it goes to the document pipe. If it works without a file, it goes to the knowledge pipe. That is the entire decision tree.
Common gray-area prompts and where they belong
| Prompt | Pipe | Why |
|---|---|---|
| "Is this wage too high for EITC?" | Knowledge — if you type the number generically | Use "wage is $X, AGI is $Y" — never the W-2 image |
| "Read this PDF and extract all box 12 codes" | Document — local only | The PDF contains the client's SSN, name, and wages |
| "Draft a letter reminding clients about missing documents" | Knowledge — if no client names are included | Use placeholder fields: "[Client Name], [Missing Items]" |
| "Translate this client's W-2 explanation into Spanish" | Document — local only | Client-specific facts and figures are in the text |
| "What deductions can a Colorado landlord take?" | Knowledge — cloud is fine | No client data needed — pure research question |
| "Compare these two 1099s for discrepancies" | Document — local only | Both files contain payer EINs, amounts, and recipient SSNs |
Enforcing the split before 2027 software ships
XyloDocs' intended 2027 tax-software architecture separates these two pipes by design: documents on local hardware, knowledge from the cloud. But the 2027 product is not shipping this week. Until it does, firms can enforce the split by policy:
- Written staff handbook rule: No client PDFs, images, or return information in public AI tools. Knowledge questions only.
- Separate tools for research vs. documents: Use a cloud assistant for research; use the firm's internal software for document processing. If no local AI tool is available for document tasks, do them manually rather than pasting into a consumer chatbot.
- WISP update: Add the split to the information-security plan. Document which AI tools are approved for knowledge questions, and make clear that no AI tool is currently approved for client-document processing outside of inventoried vendor products.
- Intake through controlled channels: XyloDocs' communication platform — SMS, WhatsApp, portal, calling — gets documents onto a client record you operate, not into a chat history. Available now at $49/month.
Frequently asked questions
Can I redact client data and then upload?
Better than raw, worse than not sending. Names hide in metadata, page headers, employer names, and sometimes OCR artifacts. If the task is extraction — pulling numbers from a document — run it locally. Redaction is a partial mitigation, not a complete solution.
What about questions that need real numbers?
Use the numbers, not the document. "Wage is $52,000, AGI is $48,000, filing status is MFJ — does this qualify for EITC?" answers the question without sending the W-2. Even then, do not include the client's actual SSN in a public prompt. Rounded or synthetic examples teach the rule just as well.
Is XyloDocs' knowledge AI live for IRS research today?
Do not invent a research-chatbot SKU. What is live is client communication and document intake on the CRM platform. Cloud knowledge plus local documents is the 2027 architecture story — not a present-tense "IRS research bot" claim.
What if my staff ignores the policy?
That is the shadow-AI problem. Enforce it the same way you enforce other WISP controls: written policy, periodic review, access controls on firm devices, and consequences for violations. A policy that nobody monitors is not a policy — it is a wish.
The bottom line
General tax questions and client documents need different AI. Same window is how SSNs travel to servers you do not own. Split the pipes; most of "AI risk" becomes a routing problem you can actually manage — and the routing rule fits on an index card: if it needs the file, keep it local.
Next: 5 things you can do with private AI without uploading anything to the cloud.
Leave a Comment
Your comment is private and will only be visible to the author. We'll send you an email confirmation.