IRS AI Guidance for Tax Professionals: What OPR Issue 2026-19 Asks of Your Firm

On June 24, 2026, the IRS office that disciplines tax professionals published its first guidance on using AI in tax work. It adds no new rules. It takes the rules CPAs, enrolled agents and tax attorneys already follow and says plainly what they mean once AI is in the office: a person checks everything AI produces, you understand the tools you use, client data stays in secure, approved tools, and the firm has procedures for all of it, documented. Below is what it says, in plain English, and six questions to see where your firm stands today.

See a sample security plan with an AI section → · Read the IRS document (PDF) →

What the IRS published

The IRS Office of Professional Responsibility (OPR) is the office that enforces the rules for people who represent taxpayers before the IRS. On June 24, 2026 it released Issue Number 2026-19, "Introductory Guidelines for Responsible AI Use in Federal Tax Practice."

Three things are worth knowing before the details:

Who it applies to

The guidance is built on Circular 230, the IRS's code of conduct for anyone who practices before it. That covers CPAs, enrolled agents and attorneys, along with a few smaller credentialed groups. Most unlicensed preparers are outside it after a 2014 federal appeals court decision (Loving v. IRS). The exception is preparers in the IRS's voluntary Annual Filing Season Program, who agree to follow parts of it.

If OPR finds a violation, it can publicly censure a practitioner, suspend or disbar them from practice before the IRS, or fine them. It can fine the firm too. (Circular 230 §10.50)

What it asks, rule by rule

Each point below is an existing Circular 230 duty. The plain version comes first, and the section number follows in brackets for when someone asks "where does it say that?"

A person checks everything AI produces

AI can get facts wrong, and it can invent citations to cases and rulings that do not exist. The guidance says practitioners "cannot rely solely on AI; human scrutiny and editing are essential." Facts, citations and calculations all get checked by a person before they go anywhere. It points to lawyers who have already been sanctioned by courts for filing citations that AI made up. (Circular 230 §10.22, due diligence)

Know the tools you use

You do not need to know how an AI tool is built. You do need to understand what it is good at, where it goes wrong, and what happens to the information you put into it. (§10.35, competence)

Don't lean on answers you can't explain

Written tax advice has to rest on reasonable assumptions and on facts and law you have actually checked. The guidance puts it directly: "Blind reliance on what AI yields, especially when the underlying logic or sources are unclear, may constitute unreasonable reliance." (§10.37, written advice)

Bill for the work actually done

If AI turns a three-hour task into twenty minutes, billing for time nobody spent can break the fee rule. The guidance says cost savings "should be passed on openly, with billing practices that reflect the efficiencies gained" from AI. (§10.27, fees)

Keep client data in secure, approved tools

This is the line most firms will feel first. The guidance says practitioners "must strictly handle all client data using only secure, enterprise-approved AI." In practice that points away from free and personal accounts, which run on consumer terms nobody at the firm reviewed, and toward a business account the firm chose, read the terms of, and controls. Using or disclosing a client's return information in a way the law does not allow is misconduct under Circular 230, and pasting it into an unsecured tool is the kind of handling that rule reaches. (§10.51(a)(15); the guidance also cites IRC §§6713 and 7216)

The firm has procedures, and they are documented

This one lands on the owner's desk. Whoever runs a firm's tax practice must make sure the firm has adequate procedures for everyone who works there. The guidance says "Firms must deploy internal policies and procedures for compliance with Circular 230 in the AI space," covering staff training, data security, checking AI's accuracy and vetting outside AI vendors, with documentation that shows they are followed. (§10.36, procedures)

Notice what it does not say: the words "written AI policy" never appear. But a procedure that lives only in conversation is very hard to show anyone, and the guidance asks for the steps to be documented.

The best practices it lists

The guidance closes with a list of best practices. Six of them, in its own words:

It also recommends staying current on federal and state rules, since several states have passed AI laws of their own, and being open with clients about how AI is used. Its conclusion sums up the whole document: the technology "serves as a powerful tool, not a substitute for professional judgment."

Six questions to check your firm

Answer each one Yes, No or Not sure. Count "Not sure" as a No.

  1. Business accounts only. Is every AI tool anyone at the firm uses on a business account the firm controls, and not a personal or free one?
  2. The rules, in writing. If a new hire asked "What am I allowed to put into AI?", is there a page you could hand them?
  3. Everyone shown the rules. Can you name who has been walked through those rules, and when?
  4. A person checks every draft. Does a named person review anything AI drafts, and look up every citation, before it reaches a client or the IRS?
  5. The AI company checked first. Did anyone read the AI provider's business terms before signing up, and is that provider listed with your other vendors in your security plan?
  6. A plan for when it's wrong. If AI put a wrong number in a client letter and it went out, do you know who catches it, who fixes it, and who tells the client?

Every No is a procedure that lives in someone's head and nowhere else. That is the gap the guidance is pointing at.

Where the AI procedures belong

Issue 2026-19 does not say where a firm should keep its AI procedures. A month later, OPR's Issue Number 2026-22 (July 22, 2026) reminded practitioners that federal law already requires tax preparers to keep a Written Information Security Plan, or WISP, under the FTC Safeguards Rule. It tied that plan to the same two Circular 230 duties as the AI guidance: competence and firm procedures.

So most firms already have, or are supposed to have, one document where their security procedures live. The AI procedures fit there naturally. The AI provider goes on the vendor list, AI training goes in the training record, and the AI rules sit beside the firm's other policies. One caution: label that part as Circular 230. The FTC Safeguards Rule says nothing about AI, so an AI section should not be presented as an FTC requirement.

See what it looks like. Our sample WISP for a made-up six-person tax firm has a Responsible AI Use section on pages 11 and 12, written to Issue 2026-19 and labeled as Circular 230, separate from the FTC sections. Download it, read it, and borrow the AI policy wording if it helps.

Frequently asked questions

Does the IRS require tax firms to have an AI policy?

Not in those words. OPR Issue 2026-19 says firms "must deploy internal policies and procedures for compliance with Circular 230 in the AI space," under the existing duty in Circular 230 §10.36, and it asks for those steps to be documented. A written AI policy is the most direct way to show the procedures exist.

Is OPR Issue 2026-19 a new rule?

No. It explains how existing Circular 230 duties apply when AI is used: due diligence, competence, written advice, fees, firm procedures and the confidentiality of client return information. It says those obligations "remain unchanged," and it describes itself as introductory.

Does the IRS AI guidance apply to unlicensed tax preparers?

Mostly not directly. Circular 230 covers CPAs, enrolled agents, attorneys and a few other credentialed groups. Unlicensed preparers who join the IRS Annual Filing Season Program agree to follow parts of it. Separately, the FTC Safeguards Rule requires paid tax preparers to keep a written security plan whatever their credential.

Can I use ChatGPT or other AI tools with client data?

The guidance does not name products. It says client data should be handled "using only secure, enterprise-approved AI," and that sensitive data should never be uploaded to unsecured sites. Whatever tool you use, the questions are whether it is a business account your firm approved and controls, and whether someone has read its terms on what happens to the data.

Does a WISP need an AI section?

The FTC Safeguards Rule does not mention AI, so the FTC does not require one. But Circular 230 requires firm procedures, Issue 2026-19 says those procedures now include AI, and the WISP is where most firms already keep their security procedures. An AI section there, labeled as Circular 230, puts it in the document you would hand over if anyone asked.

Sources

Quotes are taken from the IRS documents as published on October 26, 2026. This page is general information, not legal advice.