Every CPA firm has heard the pitch for AI. Fewer have heard that, as a tax preparer, the firm is a financial institution under the Gramm-Leach-Bliley Act, that the FTC Safeguards Rule requires a written information security plan, and that whatever AI tool the firm adopts has to fit inside it.
The Safeguards Rule is not new, and neither is IRS Publication 4557, which reinforces it for paid preparers. What is new is the number of tools asking for your clients' returns. This piece covers what the rule asks of a firm, how a cloud AI product and a local one each answer it, and what a local deployment looks like for an 8 to 25 person office.
Before anything else
This is a practical overview, not legal or compliance advice. The rule text is at the FTC, and the IRS guidance is Publication 4557. The October 2026 summary we draw on is from CPA Practice Advisor.
What the rule asks of a tax and accounting firm
- You are covered. The rule applies to financial institutions, and the definition explicitly includes tax preparers.
- A written information security plan. The centerpiece of the rule: a documented, firm-specific plan covering how client data is protected, including data handling, access controls, encryption in transit and at rest, an incident response plan, and a schedule for periodic review.
- A named person. Someone designated to oversee the security program, by name, not "IT" in the abstract.
- The IRS's six baseline protections in Publication 4557, which include multifactor authentication and drive encryption.
None of that mentions AI. All of it applies to AI the moment a return, a W-2 or a client's bank statement goes into one.
Where a cloud AI tool lands in the plan
A cloud AI product is a service provider handling client data. Under the plan, that means you document what it receives, under what contract, how it is encrypted, who at the vendor can see it, how long it is retained, and what happens if the vendor has an incident. For a consumer chatbot, the honest answer to several of those is "we do not know," which is not a sentence that belongs in a written security plan. For an enterprise tier, the answers exist in the contract and someone at the firm has to read it, and re-read it on renewal.
Where a local AI lands in the plan
A local model runs on a machine in your office, on your network, under the same access controls, encryption and MFA your plan already describes for the file server. There is no new service provider to document, because there is no service provider. The AI entry in your plan reads like the entry for any other internal system: who can access it, what it can read, where it logs, and how it is backed up.
| Plan requirement | Cloud AI tool | On-site AI |
|---|---|---|
| Service provider oversight | New vendor to vet, contract, and review | None added |
| Encryption in transit and at rest | Depends on vendor; verify | Your existing disk encryption and LAN controls |
| Access control and MFA | Vendor's identity system plus yours | Yours only |
| Incident response | Depends on vendor notification | Your own logs, your own timeline |
| Retention | Vendor policy | Your policy |
What the work actually is
The routine tier in a CPA office is document work: reading source documents, extracting fields, reconciling, drafting the first pass of a letter or a memo. That tier runs well on open-weight models on a single GPU workstation, and it is where the hours go during filing season. A few examples of what firms move first:
- Source document intake: W-2s, 1099s, K-1s and brokerage statements read into structured fields, each field traced to the page it came from
- Bank and credit card statement extraction for bookkeeping clients, with the reconciliation gate below
- Engagement letters and client correspondence drafted from a template and the file, for a person to review and send
- Meeting and call transcripts turned into decisions, owners and next steps
The gate that makes it safe to trust
Every workflow carries a deterministic acceptance test that runs outside the model. The reconciliation balances to the cent or the run fails. The extracted total matches the statement total or the run fails. The cited figure traces to a source page or it comes back flagged. This is plain code, not another AI's opinion, and the model has no write access to the files that grade it. A failed gate goes to a named person on your staff with the reason attached. Nothing is quietly filed.
In an accounting office, "the AI said it was right" is not an answer. "The reconciliation balanced" is.
Questions firms ask
Which local model is best for accounting? The one that passes your gates on your documents. We benchmark candidate open-weight models against the firm's real files before choosing, and re-benchmark when a stronger model ships before it replaces anything.
Is there a ChatGPT for accounting? There are many cloud products aimed at the profession. The question the Safeguards Rule makes you ask of each one is the same: where does the client data go, and can you document it?
What does it cost? Our published ranges are on the cost page, and the payback piece covers the four numbers that decide whether it pencils for your volumes. For a small office with light volume, it may not, and we will say so.