Tools for Accounting

Article

AI Tool Security Checklist for Accounting Firms

By the AI Tools for Accounting team ·

The short answer

Before an accounting firm puts client data into an AI tool, treat the vendor like any other service provider that touches customer information. The FTC Safeguards Rule requires covered firms to pick service providers that can maintain appropriate safeguards, require those safeguards by contract and periodically reassess them [1]. IRS Publication 5708 says tax and accounting professionals are financial institutions under the Gramm-Leach-Bliley Act regardless of size, and must keep a written information security plan (WISP) [2]. So the practical checklist for accountants, CPA firms, tax professionals and bookkeepers is: read the SOC 2 report, confirm how long the vendor keeps your data and whether it trains models on it, check where tax return information goes, limit what AI agents can change, and write all of it into your WISP. This is a research summary, not legal advice; confirm your obligations with counsel.

What changed this fall

  • October 19, 2026: The AICPA and the Artificial Intelligence Underwriting Company (AIUC) announced a joint SOC 2 plus AIUC-1 certification for AI systems and agents, delivered as one CPA-led engagement. AIUC-1 adds live testing of agent behavior, including hallucinations, data leakage and prompt injection. Several CPA firms are piloting it, with a full launch expected in early 2027 [3][4].
  • October 28, 2026: The AICPA asked for comments on proposed 2027 SOC 2 Trust Services Criteria. New points of focus cover AI governance, model monitoring, prompt manipulation, data poisoning, training data management and automated decision-making. Comments are due January 15, 2027, and if approved the criteria would apply to engagements beginning on or after December 31, 2027 [5].
  • Earlier in 2026: The Journal of Accountancy and the AICPA warned about "quick-turn" SOC 2 engagements, where tool vendors promise fast, cheap reports. A peer review guide describes identical reports, risk assessments and sample sizes across clients as a red flag [6][7].

The Safeguards Rule lists what a covered firm's program must include. Several items apply directly to buying an AI tool [1]:

  • A written risk assessment that covers the new system.
  • Encryption of customer information in transit over external networks and at rest.
  • Procedures for evaluating the security of externally developed applications you use to store or transmit customer information.
  • Multi-factor authentication for anyone accessing an information system.
  • Secure disposal of customer information no later than two years after its last use, with exceptions such as legal retention requirements, plus a periodic review of your retention policy.
  • Logging and monitoring of authorized users' activity.
  • Oversight of service providers: select capable providers, require safeguards by contract and reassess them periodically.
  • A written incident response plan, and FTC notice within 30 days of discovering a notification event involving the information of at least 500 consumers.

IRS Publication 5708 turns these duties into a sample WISP for tax and accounting practices, including service provider oversight and record retention policies [2]. Add each AI tool to that plan as a named service provider.

2. Read the SOC 2 report, not the badge

A SOC 2 report is an examination by a licensed CPA under AICPA attestation standards of controls relevant to security, availability, processing integrity, confidentiality or privacy, with an opinion on whether those controls are designed and operating effectively [3]. A report can cover one category or all five, so ask which categories are in scope, and check that the AI features you plan to use sit inside the system the report describes [6].

The AICPA's warnings about quick-turn engagements give buyers a few practical checks. A SOC 2 should be renewed annually, so ask for the latest report period [3][6]. Read the exceptions and the complementary user entity controls, since those are the controls the vendor expects you to run. A logo on a website is not the report. In the Journal of Accountancy discussion, a boilerplate report signed by a CPA who did no testing is described as having zero value, and peer reviewers are told to look for identical reports across clients [6][7].

3. Ask how your data is used, kept and deleted

The AI-specific questions are about training, retention and access. As one example of what to look for, OpenAI's enterprise privacy page says it does not train models on business data from ChatGPT Business, Enterprise or its API by default, lets ChatGPT Enterprise and Business admins control retention, and removes deleted conversations within 30 days unless legally required to keep them. It also says API inputs and outputs may be kept for up to 30 days to provide the service and identify abuse, with zero data retention available for eligible use cases [8]. Those terms apply to business plans; the same page says data from versions of ChatGPT for individuals can be used for training [8].

Ask every vendor, including accounting tools that run on someone else's model:

  • Do you or your model provider train on our inputs, outputs or connected files, and is that off by default?
  • How long do you keep prompts, outputs, uploaded documents and logs, and can we set or shorten that period?
  • Which subprocessors, including model providers, receive our data, and in which countries?
  • Who at the vendor can view our data, and for what reasons?
  • Will you sign a data processing agreement, and what happens to our data on cancellation?

Match the answers against your own retention policy and the Safeguards Rule's two-year disposal requirement [1][2].

4. Check where tax return information goes

Tax preparers have an extra rule. Section 7216 regulations restrict how tax return preparers use and disclose tax return information. A preparer may disclose it to a U.S. contractor that programs, maintains, tests or procures software used for return preparation, but only to the extent needed for that work, and only if the individuals receiving it get written notice of sections 6713 and 7216 [9]. Disclosure to a preparer or contractor outside the United States generally requires the taxpayer's prior consent, and the regulation's example notes that a preparer may not obtain consent to disclose a taxpayer's Social Security number to a preparer located outside the United States [9]. Ask any AI tax vendor where data is processed and stored, and whether its model providers process data outside the U.S., then have counsel confirm whether consent is needed.

5. Limit what AI agents can do

Tools that connect AI assistants to your books add a new kind of risk: the AI can act, not just answer. The AICPA-AIUC announcement notes that AI agents now hold credentials, call APIs and act inside core systems, so an AI failure is increasingly a security breach [3]. Several tools in our directory now connect to Claude or ChatGPT, including Digits, BILL, Financial Cents and Levvy; our MCP guide covers what each connection can read or change. For any agent, confirm:

  • Read-only versus write access, and whether you can turn off create, update or delete actions.
  • Whether changes need human approval, and whether locked periods are protected.
  • That the agent uses each person's own login and permissions, with MFA, rather than a shared key [1].
  • That every AI action is logged so you can review it, which also supports the Safeguards Rule's monitoring requirement [1].

A one-page checklist

  1. Named in your WISP and risk assessment as a service provider [1][2]
  2. Current SOC 2 report reviewed, with scope covering the AI features you use [3][6]
  3. Contract requires safeguards, breach notice and data return or deletion [1]
  4. No training on your data by default, in writing [8]
  5. Retention period known and compatible with your disposal policy [1]
  6. Subprocessors and data locations listed, including for tax return information [9]
  7. Section 7216 consent reviewed for any tax return information [9]
  8. MFA and per-user permissions enforced [1]
  9. Agent write access limited, approved and logged
  10. Reassessed at least annually, or when the vendor ships major AI changes [1][3]

FAQ

Does a small firm really need a written security plan? Yes, per the IRS. Publication 5708 says tax and accounting professionals are treated as financial institutions regardless of size, and that a WISP is required by law [2].

Is a SOC 2 enough to approve an AI tool? No. It is strong evidence about controls, but you still need to confirm scope, data training and retention terms, data locations and agent permissions. The proposed 2027 criteria add AI points of focus, but they are not final [5][6].

Does AIUC-1 replace SOC 2? No. The joint offering produces both a SOC 2 report and an AIUC-1 certification, and the full launch is expected in early 2027 [3][4].

Can we paste client data into a free consumer chatbot? Check the provider's terms first. OpenAI, for example, says data from versions of ChatGPT for individuals can be used for training, while its business plans are not trained on by default [8]. Your WISP and engagement letters should say which tools staff may use.

Related reading: Can AI Prepare a 1040?, AI coworkers for accounting firms, the Income Tax category and the Practice Management category.

Sources

  1. 16 CFR 314.4, FTC Safeguards Rule elements (eCFR, checked 2026-11-10): https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314/section-314.4
  2. IRS Publication 5708, Creating a Written Information Security Plan (Rev. 8-2024, checked 2026-11-10): https://www.irs.gov/pub/irs-pdf/p5708.pdf
  3. AICPA, Auditors Meet Urgent Demand for AI Assurance with New Offering from AICPA and AIUC (Oct 19, 2026): https://www.aicpa-cima.com/news/article/auditors-meet-urgent-demand-for-ai-assurance-with-new-offering-from-aicpa-and-aiuc
  4. Accounting Today, New AI assurance certification combines SOC 2, AIUC-1 (Oct 19, 2026): https://www.accountingtoday.com/news/new-ai-assurance-certification-combines-soc-2-aiuc-1
  5. AICPA, AICPA Proposes Update of SOC 2 Trust Services Criteria (Oct 28, 2026): https://www.aicpa-cima.com/news/article/aicpa-proposes-update-of-soc-2-r-trust-services-criteria-to-enhance-the-relevance-usability-and-value-of-cpas-reports
  6. Journal of Accountancy, The risks of quick-turn SOC engagements and what CPAs should know (Apr 30, 2026): https://www.journalofaccountancy.com/podcast/2026/apr/the-risks-of-quick%E2%80%91turn-soc-engagements-and-what-cpas-should-know/
  7. Journal of Accountancy, AICPA guides peer reviewers to address SOC 2 risks (May 2026): https://www.journalofaccountancy.com/issues/2026/may/aicpa-guides-peer-reviewers-to-address-soc-2-risks/
  8. OpenAI, Enterprise privacy at OpenAI (updated Jan 8, 2026, checked 2026-11-10): https://openai.com/enterprise-privacy/
  9. 26 CFR 301.7216-2, permissible disclosures without taxpayer consent (eCFR, checked 2026-11-10): https://www.ecfr.gov/current/title-26/chapter-I/subchapter-F/part-301/subpart-ECFR6d2a5d3bb5d8d1f/section-301.7216-2

Last checked: 2026-11-10

Tools in this article