Guide

AI Policy for CPA Firms: What It Should Cover

By Cole Kline, Founder, Edge Operations Managers

An AI policy for a CPA or accounting firm is a short written document that says which AI tools staff may use, what client information may and may not go into them, who reviews AI output, and how staff are trained. Many firms keep it to a page or two. It is an operations document first: it only works if it's built into daily workflows and SOPs.

Note: This page is not legal or tax advice. Have your attorney review your policy and any client consent language.

Why firms are writing AI policies now

Staff are already using AI tools, often on personal accounts. Meanwhile the rules that apply to client data haven't gone away. A written policy gives everyone one answer to "can I use this tool for this task?"

The rules to know, in plain terms

Rules that apply to AI use in CPA firms
Source	What it says, in plain terms
IRS Office of Professional Responsibility, Issue 2026-19 (responsible AI guidelines for federal tax practice)	Tax practitioners should use only secure, enterprise-approved AI for client data, never upload sensitive data to public or unsecured tools, vet AI vendors, document how AI is used, and review AI output.
IRC Section 7216	Tax preparers may not disclose or use a client's tax return information without the client's consent, unless an exception applies. Sending return data to an outside service can count as a disclosure.
FTC Safeguards Rule	Tax and accounting firms count as "financial institutions" and must keep a written information security plan (WISP), including oversight of service providers. IRS Publication 5708 has a template.
AICPA Code of Professional Conduct	CPAs may not disclose confidential client information without specific client consent.

State rules may also apply. Ask your attorney which rules cover your firm.

What an AI policy for an accounting firm usually covers

Approved tools: which tools and which plans staff may use, and who approves new ones
Client data rules: what may never go into an AI tool, and what may go only into approved tools
Client consent: when consent is needed and how it's recorded (language reviewed by your attorney)
Human review: every AI output is checked by a qualified person before it reaches a client
Records: which tools were used on which work
Training: how staff learn the policy, and who answers questions
Owner and review date: one named owner, reviewed at least yearly

Rolling out AI is an operations project

A policy on paper doesn't change how work gets done. Edge documents and systemizes your workflows so AI is used consistently. Your operations manager runs the SOPs, including how staff use the AI tools your firm has approved. We help draft internal AI usage guidelines and SOPs as operations documents your firm reviews and approves. The scorecard tracks adoption and the capacity it frees up.

How Edge runs it: EDGEos

EDGEos is the operating system an Edge operations manager installs and runs in your firm: a weekly scorecard, a weekly meeting rhythm, documented SOPs and an accountability chart that shows who owns what. It builds on practices many owners know from EOS-style systems. For an AI policy, that means the policy has an owner on the accountability chart, the steps live in SOPs, and adoption shows up on the scorecard.

(EOS® is a trademark of EOS Worldwide. Edge is not affiliated with EOS Worldwide. Compare approaches: EOS alternatives)

FAQ

Is an AI policy legally required?

No single federal rule says "write an AI policy." But the IRS expects tax practitioners to use only secure, enterprise-approved AI and to document how they use it, and tax and accounting firms already need a written information security plan. A written AI policy is the practical way to show how your firm handles both. Have your attorney confirm what applies to you.

Does Edge write our AI policy?

We help draft internal AI usage guidelines and SOPs as operations documents. Your firm reviews and approves them, and your attorney reviews anything legal, including client consent language.

Do we need client consent to use AI on tax work?

It depends on the tool and what data goes into it. Section 7216 limits how preparers disclose or use tax return information without client consent. Ask your attorney before client return data goes into any AI tool.

Want help putting your policy into practice?

If AI use in your firm depends on who's doing the work, talk to us. We'll look at where workflows run through you.

Book a call

Not ready to talk yet?

Start with a free resource:

EDGEos Playbook: see how documented SOPs and a weekly scorecard fit together.
CEO Dashboard: track your firm's weekly numbers in one sheet.

Or: Take the 2-minute readiness check · Score your owner bottleneck

Ready to hand off the operations?

Talk with us about placing a full-time Operations Manager who installs EdgeOS inside your existing tools.

Book a call