IRS Expectations for AI and Client Tax Data

Last verified: August 16, 2026.

The IRS does not publish a special "AI exception" that lets client data travel wherever a chatbot is convenient. When you use AI with taxpayer information, you are still the party who must safeguard it, limit use and disclosure, and be able to explain where it went. Publication 4557, the FTC Safeguards Rule (including the WISP requirement), and Internal Revenue Code §§7216 and 6713 apply to the work — not to the logo on the tool.

This article names duties, not vendors. If any platform receives a W-2, you still have to account for that disclosure. For the physics of the upload, see what happens when you upload a W-2 to an AI tool.

Pub 4557 — you are in the safeguarding business

IRS Publication 4557, Safeguarding Taxpayer Data, is the baseline the Service points preparers to for protecting taxpayer information in a modern office: access control, encryption in transit and at rest, secure disposal, incident response, employee training, and vendor awareness.¹ It is written for people who handle tax data professionally — not only for government agencies that receive it through official channels.

AI does not appear as a magic safe harbor anywhere in that publication. An AI vendor is another place taxpayer data can live — another system in your data-flow inventory. If you cannot describe that system in your security plan with the same specificity you use for Drake or your portal, you are behind the publication's intent even if no examiner has noticed yet.

Key Pub 4557 concepts that apply directly to AI tools:

Access control. Who at the AI vendor can see the file? Is it the model, the support team, a quality-assurance reviewer, or all of the above?
Data disposition. When is the file actually deleted — not just removed from the UI, but purged from backups, logs, and DR snapshots?
Vendor due diligence. Have you reviewed the vendor's security posture the way you would review a subcontractor who handles client files?
Incident response. If the AI vendor has a breach, do they notify you? On what timeline? Is your incident-response plan updated to include that scenario?

FTC Safeguards Rule and the WISP you already need

The FTC Safeguards Rule under the Gramm-Leach-Bliley Act requires many financial institutions — including tax-preparation businesses that meet the definition — to develop, implement, and maintain a written information security program. The IRS WISP template in Publication 5708 exists because examiners and EFIN renewal conversations actually ask whether you have one.²

A WISP that lists "laptops, Drake, and our portal" but not "staff paste returns into a public AI tool every Tuesday during crunch" is incomplete. Shadow AI is still an information system. It still receives, processes, and retains taxpayer data. It belongs in the inventory even if nobody wrote it down.

What a WISP entry for an AI tool should document:

The tool name, vendor, and contract or terms-of-service version
What data flows into it (client documents? general questions? both?)
Who in the firm has access (firm accounts or personal logins?)
The vendor's retention and deletion commitments
The incident-notification procedure if the vendor has a breach
The risk assessment: is this a Level 1, 2, or 3 tool per the three levels of AI security?

If you cannot complete that entry for a tool your staff uses, the tool is not yet inventoried — and an un-inventoried tool is a WISP gap. Practical WISP framing for firms is in WISP requirements for tax firms.

§7216 and §6713 — use and disclosure are the words that matter

Section 7216 of the Internal Revenue Code makes it a crime for a tax return preparer to knowingly or recklessly use or disclose tax return information other than to prepare that taxpayer's return, unless a specific exception or proper consent applies. Section 6713 adds civil money penalties for prohibited use or disclosure — penalties that do not require proving criminal intent.³

Uploading a client's organized file to an outside AI system is, in substance, making return information available to a third party. The third party is the entity that operates the server — regardless of what brand name appears on the chat window. Whether a particular product fits an exception under the regulations is a facts-and-consents question — not a feeling about the vendor's reputation.

Key §7216 / §6713 implications for AI usage:

The upload is a disclosure. Once the file reaches the vendor's server, return information has been disclosed to a party outside the engagement. That disclosure must be defensible.
Consent must be specific. Client consent to "using technology in the engagement" is not the same as consent to "disclosing your W-2 to a third-party AI vendor for processing." Specific facts and specific consent.
Software developers and e-file providers are in scope. §7216 does not only cover the preparer sitting at the desk. It covers the chain of entities that handle return information. The AI vendor is part of that chain the moment the file arrives.
"They promised not to look" is not a defense. The disclosure happened when the file was transmitted. Whether the vendor actually viewed it is a separate question from whether the disclosure occurred.

The firm-facing explainer is §7216: tax preparer client data rules.

What "the IRS expects" in practical terms

Strip away the publication numbers and code sections, and the IRS is asking you six things:

Know where the data is. Inventory AI tools the way you inventory portals, cloud storage, and backup drives. If you cannot list where client data lives, you cannot protect it.
Limit who sees it. Personal ChatGPT logins are not role-based access. Firm-issued accounts with audit trails are the minimum. Better: tools where the file does not leave your infrastructure at all.
Do not treat a privacy policy as client consent. Your clickwrap with a model vendor is your consent to their terms. It is not the client's consent to the disclosure of their information. Those are different agreements between different parties.
Encrypt, but do not stop there. TLS in transit and AES at rest are hygiene, not strategy. They do not decide who can decrypt at the application layer, who reviews files for quality, or which subprocessors handle the data.
Plan the incident. If a prompt history is exposed, that is a taxpayer-data event — not an IT inconvenience. Have a response plan that includes AI-specific scenarios: vendor breach, prompt-history leak, model-training contamination.
You remain on the hook. Outsourcing processing to an AI vendor does not outsource your §7216 obligations. The PTIN is yours. The professional responsibility is yours. The vendor does not sit for your ethics exam.

Pub 1345 — when you become an online provider

Publication 1345 governs Authorized IRS e-file Providers with taxpayer-facing online portals. Its security expectations — MFA, weekly vulnerability scans, 24-hour incident reporting — apply once XyloDocs or any other platform operates as an e-file provider with a public-facing portal for taxpayers.⁴

These controls are part of XyloDocs' 2027 roadmap — they are not claimed as met today. Pub 1345 is included here because firms evaluating AI tools should understand that the bar goes up, not down, as more of the workflow goes online. A tool that cannot meet Pub 1345 requirements should not be handling return information that will eventually flow through an e-file submission.

How this maps to the three levels

Level	What the rules are asking you	Your documentation burden
Level 1: Public AI + client file	Can you even list this in the WISP? Usually the answer is stop.	High — consumer terms, no contract, personal logins
Level 2: Cloud tax AI	Named recipient, specific consents, contract with retention terms, audit trail	Moderate — documentable with vendor cooperation
Level 3: On-premise processing	Fewer third-party disclosures for the document itself; simpler WISP entry	Lower — the data stayed on your hardware

Framework: three levels of AI security.

Frequently asked questions

Does the IRS ban ChatGPT?

No. The IRS does not name or ban specific products. It publishes safeguarding expectations (Pub 4557), requires a WISP (via the FTC Safeguards Rule and Pub 5708), and enforces use-and-disclosure rules (§7216 / §6713). You do not need a product ban for §7216 to apply to a reckless disclosure — the statute applies to the act, not the tool.

If my AI vendor is "SOC 2," am I done?

A SOC 2 report is a meaningful signal about a vendor's operational controls at a point in time. It is an input to your vendor-review process. It is not your WISP, not client consent, and not a claim that XyloDocs or anyone else is "SOC 2 certified" without an attestation you can point to. Use it — do not lean on it as a substitute for your own program.

Does using XyloDocs communication tools count as an AI disclosure of returns?

Intake onto a client record is a vendor relationship you must understand and document. It is a different pattern from pasting a W-2 into a public chatbot — different controls, different contractual terms, different data lifecycle. Read the security overview and evaluate it against your own WISP and engagement process. Do not skip the inventory step for any vendor, including this one.

What about AI tools that process data in the browser without uploading?

If the processing genuinely happens client-side (in your browser, on your hardware) and the file never traverses the vendor's API, that is closer to Level 3 for that specific operation. Verify the claim: use browser developer tools to confirm no outbound requests carry the file. Marketing claims about "local processing" do not always match the actual network behavior.

The bottom line

Pub 4557, the Safeguards Rule / WISP requirement, and §7216/§6713 do not care which AI brand you liked this season. They care that you know where taxpayer data goes, that you can defend each disclosure, and that you do not treat an irreversible upload as a harmless shortcut. The IRS holds you responsible — the PTIN is yours. The tool does not sit for the exam, and it does not answer the examiner's questions about your data-flow inventory.

Talk to us about running communication and document intake on records you control, or continue with the three levels of AI security to frame your firm's current posture.

Sources

IRS Publication 4557 — Safeguarding Taxpayer Data
IRS Publication 5708 — WISP template (use with FTC Safeguards Rule obligations)
26 U.S.C. §7216; 26 U.S.C. §6713; see also XyloDocs explainer
IRS Publication 1345 — Handbook for Authorized IRS e-file Providers

What the IRS expects from you when you use AI with client data