# Form 7216 consent for AI: do you need it to use ChatGPT or Claude?

> There's no IRS Form 7216 and no IRS ruling on AI. How to set up a 7216-safe AI workflow: what never to send, stripping identifiers, consent and logs.

- **URL**: https://www.nocodetalks.co/blog/irs-section-7216-ai-client-consent
- **Author**: Ankur Khandelwal, Nocodetalks
- **Updated**: Oct 7, 2026
- **Topic**: Security & compliance
- **Sources checked**: 27

---

_A practical guide for US tax preparers and CPA firms._ Which AI tasks never touch tax return information, how to strip identifiers, how to word consent for an AI provider, what to log, and prompts that need no client data.

## The short answer

There's no IRS Form 7216, and the IRS hasn't said whether sending tax return information to an AI tool needs client consent. A 7216-safe setup runs AI in three lanes: tasks with no tax return information at all; return data only after the client signs a consent naming the AI provider, purpose and data; and exceptions only with counsel's sign-off. Strip identifiers either way, and log every disclosure.

> General information, not legal or tax advice. Check the cited rules with your own CPA or attorney before acting.

## What's settled about 7216 consent and AI, and what isn't

Section 7216 bars preparers from disclosing or using tax return information without written client consent, unless the regulations allow it. As of October 7, 2026, no IRS regulation, revenue procedure or 7216 FAQ mentions AI. What is settled:

- **Tax return information is broad:** what the client or third parties give you for the return, what you derive from it, such as workpapers, and statistical compilations even when they identify no one.
- **Stripping identifiers doesn't take data outside the rule.** A de-identified W-2 extract is still tax return information. Redaction limits the damage of a leak; it doesn't replace consent.
- **Sending it to an outside AI company fits the definition of disclosure:** making it known to any person in any manner.
- **No exception names AI.** I'd rely on the closest fits, below, only with your attorney's written sign-off.

| Exception | What it allows | The limit for AI |
|---|---|---|
| Another US preparer: § 301.7216-2(d)(1) | Help preparing the return, or auxiliary services | Not "substantive determinations or advice affecting the tax liability". The IRS hasn't said whether an AI vendor is a preparer |
| Software contractors: § 301.7216-2(d)(2) | Programming, maintenance, repair, testing or procurement of tax software or equipment | Only what the service needs, plus written notice of §§ 6713 and 7216 to each recipient |
| Accountants: § 301.7216-2(h) | Using return data for the client's books, workpapers and statements | An AI vendor isn't obviously covered |

The IRS Office of Professional Responsibility's June 2026 guidance (Issue Number 2026-19) says to use only secure, enterprise-approved AI for client data and that §§ 6713 and 7216 apply, but not when AI needs consent. Two AICPA Tax Practice Responsibilities Committee members wrote in The Tax Adviser (February 2024) that a walled-off firm-owned system or a hosted tax research tool will likely count as auxiliary services. That's their view; it doesn't cover public chatbots.

## A 7216-safe AI workflow: three lanes

Sort every AI task into one of three lanes, and put the lanes in your firm's AI policy.

| Lane | What reaches the AI | Typical tasks | Before you start |
|---|---|---|---|
| 1. No return data | Nothing from a client file | Research, templates, checklists, formulas or scripts built on fake data | A [business plan](https://www.nocodetalks.co/blog/is-claude-safe-for-client-data) that doesn't train on your data |
| 2. Return data, with consent | The minimum, identifiers stripped | Summarizing source documents, missing-document checks, workpaper drafts | A signed consent naming the provider, purpose and data; a log entry |
| 3. Return data, under an exception | Whatever counsel approves | A firm-owned, walled-off system | Your attorney's written sign-off |

I'd start with lane 1. It covers more work than it looks.

## Lane 1: AI work that never touches tax return information

- **Research without client facts.** Ask the general question. I'd treat a fact pattern lifted from a client file as covered, even with names and numbers changed.
- **Templates and policies.** Organizer checklists, client emails with [PLACEHOLDERS], the AI section of your WISP.
- **Tools built on fake data.** Have AI write the Excel formulas, Power Query steps or Python script against a made-up sample, then run the tool on real files yourself, outside the AI. [Christine Payton shows this](https://youtu.be/HC7Eq90bR9Y?t=232) for PDFs in Claude Code.

Prompt for Any AI chat · Tax research with no client facts:

```
I'm a US tax preparer with a general question. No client facts are included.
Question: [GENERAL QUESTION, e.g. how the QBI deduction phases in for a specified service business]
1. Look up the answer in the Internal Revenue Code, Treasury regulations and IRS publications, and cite each by section.
2. Give me links to the current IRS pages so I can open them.
3. Separate what the law says from your interpretation.
4. Flag recent changes, uncertainty, and where the answer depends on facts I haven't given.
```

Prompt for Claude Code · Build the extractor on fake data:

```
Create a fake [1099-B / W-2] PDF with made-up names, SSNs and amounts in [SAMPLE FOLDER].
Then write extract.py to pull [FIELDS] into a CSV that matches [WORKPAPER LAYOUT].
Rules:
- Work only with the fake sample. Never open files in [CLIENT FOLDER].
- When the script runs, print row counts and column totals, not values.
- Check that extracted totals tie to the document's stated totals and print PASS or FAIL.
List any layouts or fields the script may not handle.
```

Then run it on the real files yourself, outside the Claude session.

## Lane 2: strip identifiers before a prompt

With consent in place, still send the least you can. Strip on your own machine, before anything is uploaded.

1. **Work on a copy,** never the file in your tax software or document system.
2. **Delete what the task doesn't need:** names, SSNs, ITINs and EINs, addresses, dates of birth, account numbers, dependents' names, IP PINs, and employer or payer names unless needed.
3. **Replace with stable codes,** such as C-014 for the client and EMP-1 for an employer. Keep the key off the AI tool.
4. **Check the hiding places:** file and folder names, tab names, headers, comments, hidden rows and sheets, document properties. In Excel, File > Info > Check for Issues > Inspect Document finds most. Rekey scanned PDFs into a spreadsheet first.
5. **Look before you send.** Open the final file yourself.

Prompt for Claude · Missing-documents check on a stripped extract:

```
Use only for a client whose signed 7216 consent covers [AI PROVIDER] and this purpose.
Attached: this year's and last year's source-document lists for client [CLIENT CODE]. Names and ID numbers are removed.
1. List documents that appeared last year but not this year, and any new ones.
2. For each gap, say what it could mean and what I should ask the client.
3. Don't guess amounts or invent documents.
4. If you see a name, SSN, EIN or account number anywhere, stop and tell me where.
```

## How to word a 7216 consent for an AI provider

Every consent needs the elements in § 301.7216-3(a)(3). Here's how I'd fill each one for an AI tool:

| Required element | For an AI provider |
|---|---|
| Your firm's name and the client's name | As usual |
| Purpose of the disclosure | Specific, e.g. summarizing source documents and drafting workpapers for the 2026 return |
| The specific recipient | The company, such as Anthropic, OpenAI or Microsoft. I'd name each provider you'll use |
| The tax return information covered | A list, e.g. W-2 and 1099 amounts and descriptions, no SSNs |
| Signature and date | Before anything is sent. There's no retroactive consent |
| Duration (optional) | One year from signing if the consent says nothing |

- **Form 1040 clients** need a separate document under Rev. Proc. 2013-14, with the mandatory statements in section 5.04(1) word for word and in order, the TIGTA statement, and an affirmative signature. Copy that language from the revenue procedure itself.
- **Keep it voluntary.** You generally can't make your services depend on it.
- **Location.** Disclosure to a preparer outside the US always needs consent, and Form 1040 SSNs face extra limits. Anthropic's API runs inference in any geography unless you pick US-only (1.1 times the standard price). Ask counsel how this applies.
- **Subprocessors.** Copilot can route requests to Anthropic's models, with Anthropic as a Microsoft subprocessor. Ask counsel whether the consent should name both.

> Note: This isn't a ready-to-use consent form or legal advice. Have your attorney or a CPA who handles preparer compliance review your form before you use it.

## What to log, and how to repeat it next season

The FTC Safeguards Rule (16 CFR Part 314) requires logging authorized users' activity, and OPR recommends documenting AI use. Log one row per AI task:

- Client code and tax year
- Lane, and for lane 2 the consent's date, scope and expiry
- Tool, account and plan used
- What was sent: document types and fields, not the data
- Who ran it, who reviewed the output, and where it was saved

Keep the log beside your consent tracker and renew consents before they lapse. Save your stripping steps and scripts so next season starts from them.

Prompt for Any AI chat · Check a draft consent against the rule text:

```
I've pasted two texts below: (A) 26 CFR 301.7216-3 and Rev. Proc. 2013-14 section 5; (B) my draft consent to disclose tax return information to [AI PROVIDER], with no client data in it.
Using only text A, list each required element and whether B has it. Quote the part of A you rely on.
Don't rewrite mandatory statements or add requirements that aren't in A.
Flag anything unclear for my attorney.
[PASTE A]
[PASTE B]
```

## Where this breaks down

> When you add AI into your workflows, how do you roll out consent forms?
> — a poster on r/Accounting (February 2026) (https://www.reddit.com/r/Accounting/comments/1rfs82b/when_you_add_ai_into_your_workflows_how_do_you/)

- **Staff skip the stripping** under deadline pressure. [Jason Staats argues](https://youtu.be/W3PAxJOVqQY?t=500) a redact-first policy won't hold, so lean on lane 1 tools and scripts that strip for people.
- **The answer still needs a preparer.** OPR keeps final judgment with the practitioner. Check every figure against the source document.

What preparers say
- One reply to OPR's AI guidance wished it had taken a clear stance on 7216 consent. Another defined "enterprise-approved" as a no-training contract, but said that doesn't make uploading whole returns a good idea. (commenters on r/taxpros (August 2026), https://www.reddit.com/r/taxpros/comments/1w3seof/irs_office_of_professional_responsibility/)
- A 300-client firm said it told every client it was adopting Claude Enterprise and got no complaints. (a poster at a small firm on r/Accounting (August 2026), https://www.reddit.com/r/Accounting/comments/1vvmkwr/what_weve_learned_after_six_months_of_using_ai_in/)
- On engagement letters, one reply said to add nothing about AI until the AICPA or your insurer weighs in; another said 7216 and AI needs a WISP and a written policy. (commenters on r/taxpros (April 2026), https://www.reddit.com/r/taxpros/comments/1ss2xs8/ai_disclosure_on_engagement_letters/)
- In his opinion, AI that doesn't train on your data is like other firm software for 7216 purposes. He tells viewers to decide for themselves. (Jason Staats on YouTube (April 2026), https://youtu.be/W3PAxJOVqQY?t=771)

## Penalties

| Rule | Penalty | Notes |
|---|---|---|
| IRC § 7216 (criminal) | Misdemeanor: fine up to $1,000, up to 1 year in prison, or both, plus costs | Knowing or reckless conduct. Fine up to $100,000 when tied to identity theft |
| IRC § 6713 (civil) | $250 per disclosure or use, up to $10,000 a year | $1,000 each, up to $50,000 a year, with identity theft. The IRS says no knowing or reckless conduct is required |
| Circular 230 § 10.51(a)(15) | Discipline by the IRS Office of Professional Responsibility | Willful unauthorized disclosure or use |

> Note: General information, not legal advice, based on §§ 7216 and 6713, 26 CFR 301.7216-1 to -3 and Rev. Proc. 2013-14 as of October 7, 2026. Talk to your attorney before relying on any exception.

## Common questions

**Is there an official IRS Form 7216?**

No. As of October 2026 the IRS publishes no Form 7216. You draft a consent that meets § 301.7216-3 and, for Form 1040 clients, Rev. Proc. 2013-14. AICPA members can start from the Tax Section's 2019 sample forms, which don't mention AI.

**Does using ChatGPT or Claude on a client's return violate Section 7216?**

The IRS hasn't said. Sending tax return information to an outside AI company fits the regulation's definition of disclosure, and no exception names AI. A valid consent, signed before you send and covering that provider and that information, answers the 7216 question for that disclosure.

**Is redacted or anonymized data still covered by 7216?**

It can be. The regulation counts statistical compilations as tax return information even when they can't identify a taxpayer. Redaction still lowers your risk, so do it under consent too.

**Can I use AI for tax research without a 7216 consent?**

If no tax return information goes in, 7216 doesn't come into play. Keep the question generic. I'd treat a fact pattern lifted from a client file as covered.

**How long does a 7216 consent last?**

As long as the consent says. If it doesn't say, one year from the date the client signed.

## Sources

- [26 U.S.C. § 7216, Disclosure or use of information by preparers of returns](https://www.law.cornell.edu/uscode/text/26/7216)
- [26 U.S.C. § 6713, Disclosure or use of information by preparers of returns](https://www.law.cornell.edu/uscode/text/26/6713)
- [26 CFR 301.7216-1, Penalty for disclosure or use of tax return information](https://www.ecfr.gov/current/title-26/section-301.7216-1)
- [26 CFR 301.7216-2, Permissible disclosures or uses without consent](https://www.ecfr.gov/current/title-26/section-301.7216-2)
- [26 CFR 301.7216-3, Disclosure or use permitted only with the taxpayer's consent](https://www.ecfr.gov/current/title-26/section-301.7216-3)
- [26 CFR 301.7216-1 (mirror)](https://www.law.cornell.edu/cfr/text/26/301.7216-1)
- [26 CFR 301.7216-2 (mirror)](https://www.law.cornell.edu/cfr/text/26/301.7216-2)
- [26 CFR 301.7216-3 (mirror; eCFR blocks automated fetches)](https://www.law.cornell.edu/cfr/text/26/301.7216-3)
- [Rev. Proc. 2013-14 (Internal Revenue Bulletin 2013-3)](https://www.irs.gov/irb/2013-03_IRB)
- [Section 7216 frequently asked questions (marked historical)](https://www.irs.gov/tax-professionals/section-7216-frequently-asked-questions)
- [Section 7216 information center](https://www.irs.gov/tax-professionals/section-7216-information-center)
- [Forms, instructions and publications search: 7216](https://www.irs.gov/forms-instructions-and-publications?find=7216)
- [Issue Number 2026-19: Introductory Guidelines for Responsible AI Use in Federal Tax Practice (June 24, 2026)](https://www.irs.gov/pub/opr-taxpros/issue-number-2026-19-introductory-guidelines-for-responsible-ai-use-in-federal-tax-practice.pdf)
- [Section 7216 Guidance and Sample Consent Forms](https://www.aicpa-cima.com/resources/download/section-7216-guidance-and-sample-consent-forms)
- [Tax ethics and use of generative AI systems (Feb. 1, 2024)](https://www.thetaxadviser.com/issues/2024/feb/tax-ethics-and-use-of-generative-ai-systems/)
- [16 CFR Part 314 (FTC Safeguards Rule)](https://www.ecfr.gov/current/title-16/part-314)
- [Data residency](https://platform.claude.com/docs/en/manage-claude/data-residency)
- [Anthropic models in Microsoft Online Services](https://learn.microsoft.com/en-us/microsoft-365/copilot/connect-to-ai-subprocessor)
- [Remove hidden data and personal information by inspecting documents, presentations, or workbooks](https://support.microsoft.com/en-us/office/remove-hidden-data-and-personal-information-by-inspecting-documents-presentations-or-workbooks-356b7b5d-77af-44fe-a07f-9aa4d085966f)
- [Is my data used for model training? (commercial)](https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-model-training)
- [ChatGPT Work cloud security](https://learn.chatgpt.com/docs/enterprise/chatgpt-work-cloud-security)
- [Extract from PDFs with Claude (super easy!)](https://youtu.be/HC7Eq90bR9Y?t=232)
- [A Claude Cowork SECURITY Guide for your Accounting Firm](https://youtu.be/W3PAxJOVqQY?t=500)
- [When you add AI into your workflows, how do you roll out consent forms?](https://www.reddit.com/r/Accounting/comments/1rfs82b/when_you_add_ai_into_your_workflows_how_do_you/)
- [IRS Office of Professional Responsibility Releases AI Guidelines - Alert 2026-19](https://www.reddit.com/r/taxpros/comments/1w3seof/irs_office_of_professional_responsibility/)
- [What we've learned after six months of using AI in a 300-client accounting firm](https://www.reddit.com/r/Accounting/comments/1vvmkwr/what_weve_learned_after_six_months_of_using_ai_in/)
- [AI disclosure on engagement letters?](https://www.reddit.com/r/taxpros/comments/1ss2xs8/ai_disclosure_on_engagement_letters/)