Key takeaways:
- Staff at your firm are likely already using AI tools you have not approved.
- Client returns, bank statements, and Social Security numbers should never go into consumer chatbots.
- The FTC Safeguards Rule expects a written security program and oversight of vendors, and AI vendors can fall under that.
- A short policy, approved tools, and basic monitoring close most of the gap.
This is Step 5 in our “How to Get Breached” series, where we hand out bad advice so you can do the opposite.
This week’s tip: when busy season gets heavy, let your team paste client returns, bank statements, and Social Security numbers into any free AI tool that offers a quick answer. Deadlines are tight, and the chatbot is right there.
It is a tempting shortcut. It is also a fast way to lose control of the most sensitive records your clients ever hand you.
Recommended Articles
Technology October 19, 2026
Click Every Link. What’s the Worst That Could Happen?
Technology September 28, 2026
Token Limits Are Creating a Shadow AI Problem for Accounting Firms
Why accounting firms are exposed
Your files hold what attackers and data brokers want most: Social Security numbers, bank details, income records, and business financials. Clients hand all of it over because they trust you.
Shadow AI is any AI tool used for work without firm review or approval. In accounting offices it often looks like this:
- Staff using personal AI accounts to summarize returns or explain a deduction.
- AI assistants connected to the firm’s email or document storage without approval.
- AI tools given access to client mailboxes or shared folders without a partner ever deciding they should have it.
Many accounting and tax firms fall under the FTC Safeguards Rule, which expects a written information security program, a risk assessment, and oversight of service providers that touch customer information. An AI vendor that handles client data can be one of those providers. The IRS also offers guidance for tax professionals in Publication 4557, Safeguarding Taxpayer Data, and Section 7216 limits how preparers may use and disclose tax return information. Confirm how these apply to your firm with your advisors.
A hypothetical example
A midsized firm is deep in busy season. A junior preparer is stuck on a treatment question and uploads a client’s full return PDF into a free chatbot from her personal account. The answer is helpful, so she does it again the next day with a different client.
No one reviewed the tool’s data terms. The firm has no record of what was uploaded and cannot confirm whether it was retained. If a client asks where their return went, the firm has no good answer.
Nothing dramatic happened, and that is the problem. This kind of exposure is quiet, and it tends to surface only when a client, insurer, or regulator asks a question.
What to do instead
For firm leadership and whoever manages your IT:
- Classify your data: Tax returns, Social Security numbers, bank records, and client financials are off limits for unapproved tools.
- Update your written security program to cover AI: Add an acceptable use policy that names what can and cannot be entered into AI tools.
- Choose approved tools deliberately: Look for business plans with admin controls, multifactor authentication, activity logging, and written terms on data retention and training use. Review the vendor as you would any service provider.
- Take inventory now, ideally before the next filing deadline. Ask staff what they already use, and make it safe to answer honestly.
- Restrict integrations: Require admin approval before any AI app can connect to email, document storage, or practice management software.
- Use DNS filtering to block or flag unapproved AI services on firm devices and networks.
- Monitor for unusual activity: Log monitoring helps you catch what a written policy cannot.
- Train staff before busy season, and cover offboarding so departing employees lose access to every tool tied to client data.
- Document everything: If a client, insurer, or regulator asks, written records are your best answer.
Questions your clients may ask
Clients are increasingly aware of AI, and some will ask directly how you handle their information. Prepare answers in advance.
Q: Is my tax return being run through AI?
A: Be ready to say which tools, if any, the firm has approved and how client data is protected.
Q: Do you need my consent to use AI on my documents?
A: Check disclosure and consent rules for tax return information with your professional advisors, and state your position in your engagement letter.
Q: How do you know your staff are not using personal AI accounts?
A: Explain your written policy, your network controls, and your monitoring.
The bottom line
Clients do not need a firm that avoids AI. They need a firm that can explain how it uses AI and why their data stays protected. A short policy, a short list of approved tools, and basic monitoring let you answer with confidence, and they protect the reputation you have spent years building.
ABOUT THE AUTHOR:
Scott Carr, owner of Farmhouse Networking in Grants Pass, Oregon, is a veteran Network & Computer Systems Architect with over 30 years of IT experience. For over a decade, he’s led his team in delivering proactive, secure, and fully managed IT services to more than 80 businesses—including accounting and finance firms that rely on data security, compliance, and efficiency. Scott’s hands-on, jargon-free approach ensures every client understands their technology and gains confidence in their systems. His firm is known for fast, responsive support—most issues are resolved within 15 minutes—and deep expertise in cybersecurity, network design, and IT compliance. Learn more about how Farmhouse Networking supports the accounting industry at https://www.farmhousenetworking.com/finance-it-support/.
Photo credit: logturnal/Freepik
Sign in to get access to this free resource, and all of our whitepapers and reports.
Download this content today!
Register Now Already registered? Click here to Log In
