CPAs & AI Security: Protecting Tax Data in the Age of Copilot

Essential security rules for accounting firms using generative AI without violating FTC Safeguards or client confidentiality.

The Intersection of AI and FTC Safeguards

As accounting firms adopt AI assistants for drafting tax memos, summarizing audit notes, and processing financial statements, new security risks emerge. Feeding raw client tax data or Social Security numbers into public consumer AI models can constitute an unauthorized disclosure under IRS regulations and FTC Safeguards.

Core AI Security Guardrails for CPAs

• Enforce Zero Data Retention: Ensure enterprise AI licenses do not use your inputs or client data to train public models.
• Anonymize Client Data: Strip personally identifiable information (PII) before using AI models for document drafting.
• Role-Based Cloud Access: Restrict AI tool access to authenticated firm staff using Multi-Factor Authentication (MFA).