Can an accounting firm license its business records to AI companies?
Only in a very limited way. Federal law restricts tax preparers from disclosing or using tax return information beyond preparing returns, the rules of the American Institute of Certified Public Accountants (AICPA) bar CPAs in public practice from disclosing confidential client information without the client's specific consent, and data-security rules apply on top. Client material is generally off the table, so any firm should check its state board rules and talk to counsel before considering even firm-operational records.
Why is an accounting firm different from other businesses?
Tax return information. Federal law makes it a crime for a tax return preparer to knowingly or recklessly disclose information given for preparing a return, or to use it for anything else, unless an exception applies. Penalties include fines and up to a year in prison. Treasury regulations set out consent requirements and limited exceptions.
Professional confidentiality. The AICPA's Confidential Client Information Rule generally prohibits a CPA in public practice from disclosing confidential client information without the client's specific consent. That covers any non-public information obtained from the client, which is broader than tax return information. State boards of accountancy have their own rules.
Data security. The FTC (Federal Trade Commission) lists tax preparation firms among the businesses covered by its Safeguards Rule, which requires protecting customer information.
This page is not legal or ethics advice. Talk to your lawyer and check your state board of accountancy's rules before doing anything.
Usually in scope
- Work conversations about operations
- Tickets, tasks and project histories
- Process documents and SOPs
- Orders, invoices and workflow records, de-identified
- Code repositories you own outright
Commonly left out
- HR, payroll and personnel files
- Board, legal and M&A material
- Direct messages and private channels
- Data you hold for customers under contract
- Health, financial-account or other regulated personal data
What systems does an accounting firm usually run on?
Firms commonly use practice management software for workflow and due dates, time tracking and billing, a client portal, document management and e-signatures. Add tax preparation software, client accounting files, email and the firm's own accounting and payroll systems.
Almost all of this relates to client engagements. That leaves a small share of records that might ever be considered.
What, if anything, might be in scope?
Only firm-operational records with no client information, and only after review. Possible candidates, subject to counsel's advice:
- Internal firm policies and procedures that contain no client details
- Generic workflow templates and checklists the firm wrote
- Training material built without client examples
- Firm-written published content, such as newsletters or articles
What has to stay out?
Written consent from each client is the main route the rules describe for using client information beyond the engagement, and collecting it from every client is rarely practical for an AI license.
- Tax returns and anything provided to prepare them
- Client financial statements, ledgers, workpapers and audit files
- Client email, portal messages and engagement letters
- Time entries and billing descriptions that describe client work
- Client lists and contact details
- Employee personal and payroll records
Does anonymizing client data make it usable?
Do not assume so. The IRS (Internal Revenue Service) notes that the tax preparer rules allow some anonymous statistical compilations (for example, ones drawn from at least 10 returns), but those come with conditions and prohibitions set in regulations, and they do not automatically cover licensing to a third party for AI training. The AICPA rule and state board rules apply separately. Any use of de-identified client data needs a specific legal opinion, not a general assumption.
How should an accounting firm get started, if at all?
Start with counsel and your state board's rules, not with data. If that review leaves room for purely internal records, inventory them and check each one for client details.
Many firms will decide the remaining material is too small to pursue. That is a sound outcome. Be cautious of any approach that asks for client files, tax data or workpapers, whatever the stated purpose or price.
- Check rights: see Does your company actually own the data it wants to license?
- Plan exclusions: see What can be excluded?
- Vet the approach: see Is this offer legitimate?
Common questions
Can a CPA firm license anonymized tax data?
Treat this as off-limits unless a lawyer gives a specific opinion. Federal tax preparer rules restrict use and disclosure, and the IRS's statistical exceptions have conditions that do not automatically cover AI licensing.
Is a bookkeeping firm covered too?
Federal tax preparer rules apply to anyone who prepares returns or helps prepare them for pay. Non-CPA firms still face contract, privacy and data-security duties. Ask your lawyer.
What could a firm realistically license?
At most, internal policies, generic templates and training material with no client details. The volume is usually small.
Does the client portal count as firm data?
Messages and files in a client portal relate to client engagements and should be treated as client information.
Sources
- 26 U.S. Code 7216 - Disclosure or use of information by preparers of returns (LII), accessed 2026-10-15
- Section 7216 information center - Internal Revenue Service, accessed 2026-10-15
- AICPA's revised confidentiality rule and Sec. 7216 - Journal of Accountancy, accessed 2026-10-15
- FTC Safeguards Rule: What Your Business Needs to Know - Federal Trade Commission, accessed 2026-10-15
- Run Your Practice with Accounting Firm Software - Mango Practice Management, accessed 2026-10-15
General information, not legal, tax or financial advice.