The IRS Office of Professional Responsibility (OPR) Alert 2026-19, issued June 24, 2026, did not create new rules for artificial intelligence. It confirms that your existing Circular 230 duties — due diligence, competence, confidentiality, and firm oversight — apply in full the moment you use AI. In practice that means one thing: you own every AI-assisted output, and you must verify it before it reaches a client or the IRS.
Last verified: September 12, 2026. Primary source: OPR Alert 2026-19, “Introductory Guidelines for Responsible AI Use in Federal Tax Practice” (June 24, 2026); Treasury Department Circular No. 230 (31 C.F.R. Part 10).
What is the “Circular 230 AI guidance”?
Circular 230 is Treasury Department Circular No. 230, formally “Regulations Governing Practice Before the Internal Revenue Service” (31 C.F.R. Part 10). It sets the professional-conduct standards for attorneys, CPAs, enrolled agents, and other practitioners, and it is enforced by the IRS Office of Professional Responsibility.
On June 24, 2026, the OPR issued Alert 2026-19, Introductory Guidelines for Responsible AI Use in Federal Tax Practice. According to the OPR, generative AI “does not alter a practitioner’s core professional duties” under Circular 230. The alert is guidance on how the rules you already follow apply to AI tools — not a new rulebook.
The headline: no new rules, just existing duties applied to AI
This is the part most summaries get wrong. There is no separate “AI section” of Circular 230 to comply with. Instead, the OPR walks through the duties that have always governed your practice and explains what each one now requires when an algorithm is involved. The obligations did not change; the surface area where they can be breached got larger.
Which Circular 230 duties apply when you use AI?
§10.22 — Due diligence
You must exercise due diligence in preparing returns and other submissions. The OPR is explicit that you “cannot rely solely on AI” and must thoroughly review all AI-created material, “verifying the accuracy of facts, citations, and calculations produced by AI.” Due diligence cannot be delegated to an algorithmic process.
§10.35 — Competence
Competent practice requires the appropriate knowledge, skill, thoroughness, and preparation for the matter. The OPR reads this to include technological competence: you must understand both the law and the AI tools you use — how a system generates content, and where bias or errors can arise. A related proposed amendment (REG-116610-20, published December 20, 2024) would write technological competence directly into §10.35, but that amendment is still proposed and not yet final.
§10.37 — Written advice
When you use AI to help draft written advice on a federal tax matter, the advice must still rest on reasonable factual and legal assumptions and account for all relevant facts. AI-generated projections, forecasts, and citations cannot be taken at face value — you must independently verify them before relying on them.
§10.27 — Fees
Circular 230 prohibits an unconscionable fee. The OPR flags a modern wrinkle: when AI genuinely cuts your research and drafting time, billing a client for the full manual hours you did not spend raises a fee-reasonableness problem.
§10.36 — Procedures to ensure compliance
If you have responsibility for a firm’s tax practice, §10.36 requires adequate procedures so that everyone follows Circular 230 — and the OPR says that extends to AI. Firms must adopt written internal policies covering staff training, secure data handling, accuracy monitoring, vendor vetting, and documentation that demonstrates adherence.
Circular 230 duties at a glance
| Section | Duty | What it means when you use AI |
|---|---|---|
| §10.22 | Due diligence | Review and verify every AI-produced fact, citation, and calculation before it goes out. |
| §10.35 | Competence | Understand how your AI tools work, their limits, and their failure modes — not just the tax law. |
| §10.37 | Written advice | Base advice on verified assumptions; never rely on unchecked AI projections or citations. |
| §10.27 | Fees | Bill for work actually performed; do not charge full manual hours for AI-accelerated work. |
| §10.36 | Firm procedures | Adopt written AI policies: training, secure data, accuracy checks, vendor vetting, documentation. |
The data-security line you cannot cross
The OPR bulletin underscores the risk to taxpayer data and points to Code provisions that impose civil and criminal penalties for unauthorized disclosure of return information — Internal Revenue Code §7216 and §6713. Public or unsecured generative-AI platforms can expose confidential data, so the guidance is blunt: handle client data using only secure, enterprise-approved AI, and never upload sensitive information to unsecured sites.
This sits on top of duties tax firms already carry. Under the FTC Safeguards Rule (Gramm-Leach-Bliley Act), a preparer must maintain a Written Information Security Plan — see IRS Publication 5708 for the template and IRS Publication 4557 for safeguarding basics. The proposed Circular 230 amendments would make a written data-security policy an explicit best practice under §10.33, aligning the rules with obligations firms already have.
A practical Circular 230 AI checklist for your firm
- Write an AI-use policy and fold it into your existing WISP and §10.36 procedures.
- Approve a short list of secure, enterprise-grade AI tools — and prohibit pasting taxpayer data into public chatbots.
- Require human review of every AI output, with a documented check of facts, citations, and calculations.
- Train staff on how your approved tools work, their limits, and their bias and error risks.
- Vet every third-party AI vendor before you buy, and keep records of that review.
- Document AI usage and your verification steps so you can show adherence if asked.
Where this leaves bilingual and Colorado firms
For firms in the Denver metro and across Colorado — especially those serving bilingual English- and Spanish-speaking clients — the practical takeaway is about which AI you let near client information. Client-facing AI that calls, texts, and messages taxpayers is now part of the same secure-handling and documentation expectations the OPR describes for firm procedures under §10.36. The tool you choose should be enterprise-grade and auditable, not a consumer chatbot.
That is the lane XyloDocs is built for. XyloDocs is an AI client communication platform for tax firms — bilingual (English and Spanish) calling, SMS, WhatsApp, proactive status updates, and secure document intake — with access controls and audit trails built to align with IRS Publication 1075 safeguards. It handles the client-communication layer so your firm keeps taxpayer data inside a secure, enterprise-approved system rather than a public tool. It does not replace your professional judgment on returns or advice — that responsibility, as the OPR makes clear, stays with you.
Frequently asked questions
Did Circular 230 change because of AI?
No. OPR Alert 2026-19 is guidance, not a new regulation. It explains how existing Circular 230 duties — due diligence, competence, confidentiality, and firm oversight — apply when practitioners use AI.
Can I use AI to help prepare returns or draft client advice?
Yes, as a drafting aid. But under §10.22 and §10.37 you must independently verify every fact, citation, and calculation and base written advice on reasonable, checked assumptions. You remain fully responsible for the final work.
Is “technological competence” now formally required?
The OPR reads the existing §10.35 competence standard to include understanding the AI tools you use. A proposed amendment (REG-116610-20) would make technological competence explicit in the rule text, but as of this writing that amendment is proposed, not final.
Can I use a public AI chatbot for client work?
Not with taxpayer data. The OPR warns that unsecured generative-AI platforms can expose confidential information, and IRC §7216 and §6713 carry civil and criminal penalties for unauthorized disclosure. Use secure, enterprise-approved tools only.
What does firm leadership specifically have to do?
Under §10.36, put written procedures in place: staff training, secure data-handling protocols, AI accuracy monitoring, third-party vendor vetting, and documentation of it all.
Get your firm’s AI house in order
The message from OPR Alert 2026-19 is reassuring and demanding at once: nothing about your duties changed, but the way you meet them now has to account for AI. Start with your written policy, your approved-tools list, and a hard rule against public chatbots touching client data. If bilingual client communication is part of that stack, see how XyloDocs supports Spanish- and English-speaking clients on secure infrastructure, or book a walkthrough to see it against your own workflow.
Leave a Comment
Your comment is private and will only be visible to the author. We'll send you an email confirmation.