ChatGPT for Accountants: What Firms Can Use It For and What to Keep Out

TL;DR

• Accountants can use ChatGPT. The IRS says to treat what it writes as a draft and to check its facts, citations and calculations.
• Tax return information is protected by Section 7216 of the tax code. Get the taxpayer's written consent first, unless an exception in the regulations clearly applies.
• Under the FTC Safeguards Rule, a firm in the business of preparing income tax returns is a financial institution. Any AI tool that touches client data belongs in your written security plan.
• A ChatGPT Business workspace starts at 2 seats. Two Standard seats cost $40 a month on annual billing.
• No plan makes your firm compliant on its own. The rules apply to how your firm uses the tool.

Can accountants use ChatGPT for client work?

Yes, with limits. No rule bans it. The rules that apply are the ones you already follow: due diligence and competence under Circular 230, the Section 7216 limits on tax return information, the FTC Safeguards Rule and, for CPAs, the AICPA Code of Professional Conduct.

In June 2026 the IRS Office of Professional Responsibility published guidance on AI in tax practice (Alert 2026-19). Its core message: "Practitioners cannot rely solely on AI; human scrutiny and editing are essential to ensure correctness and compliance with IRS expectations." It also says due diligence "requires verifying the accuracy of facts, citations, and calculations produced by AI."

The IRS points to lawyers who were sanctioned for filing fake AI citations as a warning for tax professionals. It says cases against other tax professionals "are slowly emerging." Its example is Deloitte Australia, which reportedly refunded part of a government fee over a report with errors that appear to have come from AI.

The alert is guidance from the IRS, not a new rule. The duties it describes come from Circular 230.

What can accountants use ChatGPT for?

• Client emails and requests. Document request lists, organizer reminders, engagement letter first drafts, replies to routine questions. Edit for facts and tone before sending.
• Explaining notices. Turn an IRS or state notice into a plain-language summary for the client. Leave out names and taxpayer ID numbers unless your consent approach covers it.
• Spreadsheet work. ChatGPT Business includes add-ins for Excel and Google Sheets. Use them to explain variances, compare two exports and check formulas. Recalculate anything that goes to a client or into a return.
• Research starting points. Ask for the issues and the code sections to look at, then read the code, regulations and rulings yourself. Do not cite an answer you have not checked against the source.
• Bookkeeping clients on QuickBooks. The QuickBooks plugin can list overdue invoices, draft payment reminders for review and summarize profit and loss. See the data note below before you connect it.
• Firm admin and marketing. Meeting notes, internal procedures, job posts, newsletters and blog drafts. These need no client data, so they are a low-risk place to start.

For automation beyond ChatGPT, such as intake and document collection workflows, see our guide to AI automation for accounting firms.

What are the risks of getting it wrong?

The risk is professional discipline and penalties under rules that already exist:

• Circular 230. The IRS alert says practitioners must review every AI-created document before it goes to a client or the IRS. It warns that blind reliance on AI may be unreasonable under the rules for written advice (section 10.37), and that willful mishandling of taxpayer information through AI may lead to discipline.
• Billing. The alert says billing for time not actually spent, or double billing for AI-assisted tasks, may violate the fee rule (section 10.27), depending on the facts. It says cost savings "should be passed on openly."
• Section 7216 penalties. Knowingly or recklessly disclosing tax return information without authorization is a misdemeanor, with fines up to $1,000 (up to $100,000 in identity theft cases) and up to a year in prison. The civil penalty is $250 per disclosure or use, up to $10,000 a year ($1,000 and $50,000 in identity theft cases).
• OpenAI usage policies. OpenAI lists financial activities among the areas where high-stakes automated decisions need human review.

What do the rules say about client and taxpayer data?

Section 7216 (tax return information). The regulations define disclosure as "the act of making tax return information known to any person in any manner whatever." Tax return information is broad: names, addresses, ID numbers and anything furnished for, or derived from, preparing the return. The rules cover income tax returns.

• Consent. Before you disclose, the taxpayer must give written, voluntary consent, signed and dated, that names your firm and the taxpayer, the information covered, who receives it and why. In most cases you cannot make your services conditional on it. There is no retroactive consent. Using the information for anything other than preparing the return also needs consent. For individual (Form 1040) clients the consent must follow the format in Revenue Procedure 2013-14, as a separate document.
• Software exception. The regulations allow disclosure to a contractor that programs, maintains, tests or supplies the software you use to prepare returns, only to the extent necessary, and only if everyone who receives the information gets a written notice of the Section 6713 and 7216 penalties. Another exception covers other preparers in the US who provide support services that are not substantive tax determinations.
• Outside the US. The rules add consent requirements when tax return information goes outside the United States, and they limit sending the Social Security numbers of Form 1040 clients abroad. Ask any vendor where your data is processed and stored.
• What the rules do not say. The regulations never mention AI. They do not say whether a general AI assistant fits either exception. Ask your tax counsel which route applies before tax return information goes into any AI tool, and get consent if in doubt.
• Within the firm. A preparer who is also engaged in accountancy may use the information, or share it within the firm, to provide other accounting services to the same client.

FTC Safeguards Rule. The rule says "an accountant or other tax preparation service that is in the business of completing income tax returns is a financial institution" because tax preparation is a financial activity. That means a written information security program, a qualified individual in charge of it, a risk assessment, encryption, multi-factor authentication and oversight of service providers by contract.

Firms with information on fewer than 5,000 consumers skip four requirements: a written risk assessment (a risk assessment is still required), continuous monitoring or penetration testing and vulnerability scans, a written incident response plan and the annual written report. Everything else still applies. If unencrypted client data is taken without authorization and it affects 500 or more people, you must notify the FTC within 30 days. That applies to small firms too.

The IRS publishes a free plan template (Publication 5708), and paid preparers confirm they are aware of the written plan duty on every PTIN application and renewal (Form W-12). Add any AI tool to your plan before it touches client data.

AICPA Code. CPAs may not disclose confidential client information "without the specific consent of the client." Before disclosing to a third-party service provider, the Code says a member should either sign an agreement that the provider will keep it confidential, with reasonable assurance it has procedures to prevent release, or get the client's specific consent. The Code also says to tell the client, preferably in writing, before sharing confidential client information with a third-party provider, and not to use the provider for that work if the client objects. The AICPA tax standards list artificial intelligence as a tool and say: "Use of a tool does not absolve the member of professional obligations under AICPA or other applicable ethical standards."

Section 7216, the FTC Safeguards Rule, the AICPA Code and Circular 230 at a glance for AI tools

Rule	Who it covers	What it means for AI tools
Section 7216 and Treas. Reg. 301.7216	Anyone who prepares tax returns	Disclosure is defined broadly. Get the taxpayer's written consent first, unless an exception clearly applies.
FTC Safeguards Rule (16 CFR Part 314)	Firms that prepare income tax returns, as financial institutions	Put AI tools in your written security plan. Encrypt, use multi-factor authentication and oversee providers by contract.
AICPA Code, Confidential Client Information Rule	CPAs who are AICPA members	Confidentiality agreement with reasonable assurance, or the client's specific consent, before sharing with a provider.
Circular 230 and IRS Alert 2026-19	Tax professionals who practice before the IRS	Verify facts, citations and calculations. Use secure, enterprise-approved AI. Keep written firm AI procedures.

State boards of accountancy and state privacy laws can add their own rules. This page is general information, not legal or tax advice.

Which ChatGPT plan fits an accounting firm?

ChatGPT Plus, Business and Enterprise compared for accounting firms

What you get	ChatGPT Plus	ChatGPT Business	ChatGPT Enterprise
Price	$20 per month per person	Standard seat: $20 per month on annual billing, $25 monthly	Custom, through sales
Training on your data	May be used unless the user opts out	OpenAI says it does not train on Business data by default	OpenAI says it does not train on business data by default
Admin controls	None	Admin console, admin roles, SSO, MFA, plugin controls	Adds SCIM, role-based access controls, custom data retention, data residency
Seats	1	2 to 200	Larger firms
Fits	One person, no client data	Small and mid-size firms with a written AI policy	Firms that need retention and audit controls

Business costs this much on list prices (Standard seats, OpenAI pricing as of October 2026):

ChatGPT Business Standard seat cost by firm size, as of October 2026

Seats	Annual billing, per month	Monthly billing, per month
2	$40	$50
5	$100	$125
10	$200	$250
20	$400	$500

Premium seats cost $100 per month on annual billing ($125 monthly) and give five times the usage. Prices can vary by country. See OpenAI's pricing page for current numbers.

OpenAI lists SOC 2 Type 2 for Business. Custom data retention, SCIM and data residency are Enterprise features. A plan choice does not settle your Section 7216 or Safeguards Rule duties. It is one input to them.

What does ChatGPT connect to?

ChatGPT Business can connect to tools many firms already use, including Outlook, SharePoint, Teams, Gmail, Google Drive, Box and Dropbox. It includes add-ins for Excel, Word, PowerPoint and Google Sheets. Admins decide which plugins are allowed and, where supported, can limit them to read-only or require approval before ChatGPT makes changes.

QuickBooks. OpenAI offers an Intuit QuickBooks plugin for ChatGPT Business. It can show invoices, payroll and profit and loss data and draft invoices and reminders for your approval. OpenAI says that when a plugin needs information, "that information is shared with the provider and handled under its privacy and data-retention policies." Read Intuit's terms and check them against your Section 7216 and AICPA analysis before you connect client books.

Do not connect any tool to client files until your firm policy says so.

What should a firm AI policy cover?

The IRS alert says firms should have documented AI procedures to meet Circular 230 section 10.36, which applies to those who oversee the firm's tax practice. A workable policy covers:

• Which plan and accounts are approved. No personal accounts for client work.
• What may go in: no tax return information until your 7216 consent or exception analysis is done.
• Consent forms and engagement letter language, reviewed by counsel.
• Verification: every number recalculated, every citation read at the source, by a professional.
• Billing for AI-assisted work.
• Vetting of AI vendors and plugins, with contracts that cover confidentiality.
• Staff training.
• Your written security plan, updated to list each AI tool.
• What to do if data goes somewhere it should not, including the FTC notice when 500 or more people are affected.

Can 360 Automation AI set this up for an accounting firm?

360 Automation AI is an OpenAI Select Partner. ChatGPT Business is the workspace our Team plan runs on. We set it up and manage it for up to 20 employees, cover the seat costs, train the team and automate up to two business processes a month. The Team plan is $2,899 per month (promotional price) plus a $4,997 onboarding fee. See the plans page.

Those automations can include workflows that touch client data, with the right setup. We build them only after your consent approach and written security plan cover them.

We also write the firm's AI policy with you and train your staff on it. If your firm needs a different OpenAI product, such as an Enterprise workspace for retention controls, we set that up too. We are an OpenAI Select Partner.

Want help setting this up for your firm?

360 Automation AI sets up ChatGPT workspaces for businesses. Book a free 30-minute call. We look at what your firm needs and tell you honestly which OpenAI plan fits.

Sources

• IRS Office of Professional Responsibility, Alert 2026-19, Introductory Guidelines for Responsible AI Use in Federal Tax Practice (June 24, 2026)
• 26 U.S.C. 7216 and 26 U.S.C. 6713
• Treas. Reg. 301.7216-1, 301.7216-2 and 301.7216-3
• Revenue Procedure 2013-14, Internal Revenue Bulletin 2013-3
• FTC Standards for Safeguarding Customer Information, 16 CFR Part 314
• IRS Publication 4557, Safeguarding Taxpayer Data and Publication 5708, Creating a Written Information Security Plan
• Circular 230, 31 CFR Part 10
• AICPA Code of Professional Conduct (1.700.001, 1.700.040, 1.150.040)
• AICPA Statements on Standards for Tax Services (effective January 1, 2024)
• OpenAI: Business pricing; How your data is used to improve model performance; Plugins; QuickBooks in ChatGPT; Usage policies