A senior associate has a question about a client's K-1 on a Tuesday in March. She types it into the firm's AI research tool along with the relevant figures. Nine seconds later she has an answer and three citations. No policy was broken. The tool is on the approved list. IT signed off on it last year.
The Shadow AI Story Is the Easy Half
It may still have been a disclosure.
The AI security conversation inside firms is almost entirely about staff pasting client data into a public chatbot. That risk is real and worth closing, and it is the easier half, because it is a behaviour problem with a behaviour fix: a written policy, a training session, a blocked domain, an approved alternative.
The harder half is not behaviour. It sits inside the tools the firm chose, paid for and approved, and it is not governed only by the FTC Safeguards Rule or IRS Publication 4557. It is governed by section 7216 of the tax code, which is a criminal provision.
What Section 7216 Actually Says
Congress enacted it in 1971. Any person engaged in preparing tax returns for compensation who knowingly or recklessly discloses information furnished for the preparation of a return, or uses that information for any purpose other than preparing the return, faces a fine of up to $1,000, up to a year in prison, and the costs of prosecution. A parallel civil penalty under section 6713 runs $250 for each disclosure or use, capped at $10,000 in a calendar year.
The regulations are deliberately broad about what counts. Treasury Regulation 301.7216-1(b)(5) defines disclosure as making tax return information known to another person in any manner whatever. A paste. An upload. An API call your practice management vendor makes on your behalf.
Firms know this rule. They have complied with it for decades, mostly without thinking about it, because the disclosures involved were obvious ones: an e-file provider, an outsourced processing partner, a bank sending a verification.
The Exception Everyone Assumes Covers Them
There is an exception, and it is the reason nobody sweats the e-file provider. Treasury Regulation 301.7216-2(d) permits a preparer to disclose return information to another preparer located in the United States for the purpose of preparing the return, or obtaining or providing auxiliary services, without the taxpayer's consent.
Then it draws the line. The exception holds only where those services do not involve substantive determinations or advice affecting the tax liability reported by taxpayers. And the regulation defines its terms: a substantive determination involves an analysis, interpretation, or application of the law.
Read that twice, because it is the whole article. The exception covers processing. It stops at analysis.
Which Is Exactly What the Tools Are For Now
Sixty percent of tax professionals use AI for tax research at least weekly, up from 33% a year earlier, according to the second annual Blue J and CPA.com outlook report published in June 2026, drawn from more than 1,000 US tax professionals. The same survey puts weekly use at 44% for advisory projects, 40% for tax planning and 39% for compliance research. Eighty-four percent cite time saved.
Every one of those categories is analysis, interpretation or application of the law. The uses growing fastest inside firms are precisely the ones the auxiliary services exception was not written to cover.
The geographic condition has moved too. Located in the United States used to be a question about where an outsourcing partner kept its office. It is now a question about where a model runs and where its logs sit, which a large number of firms cannot answer about their own approved stack.
None of this makes AI tax research illegal. Consent exists as a route: Treasury Regulation 301.7216-3 sets out the requirements and Revenue Procedure 2013-14 gives the required language and format for 1040 clients. Obtained in advance, in writing, it is a solved problem. The difficulty is that very few firms obtained it, because very few framed the software as a disclosure in the first place. In August 2026 CNBC ran the question as a consumer story, asking whether your tax preparer can use AI without telling you. Clients are going to start asking it in the same words.
Three Questions Per Tool
The practical version is not a ban and not a committee. For each tool the firm has approved, three questions. Does client return information leave the firm. If it does, where does it go and who can see it. And is the work that tool performs processing, or is it analysis.
MetaWurks answers the first two rather than the third. It ingests a client's returns, statements, invoices and correspondence and lets an accountant query them in plain English, with role based access controls and audit logs recording who opened which file and when. Documents ingested into the platform are not used to train models and are not exposed to other users, so the client's file does not leave the firm's control to be useful.
The audit log is the part that matters for this rule specifically. A section 7216 question is answered with a record of what went where, not with a partner's recollection of what the vendor said in a demo.
What no software will do is answer the third question. Nothing decides for you whether the work was a substantive determination. That judgment stays where it has been since 1971, with the preparer who signed the return.
Join the Conversation
For how many of your approved tools could you say today whether client return information leaves the building, and whether you have consent for it?