Can accountants use ChatGPT with client data? Five rules

Five rules for a finance team

1. Company accounts only. ChatGPT Business and Claude Team don't train on your data by default. Personal ChatGPT plans do unless each person turns it off.
2. Check the engagement letter. If it limits who may see client data, an AI provider counts. Add a clause, or keep the data out.
3. US tax return information: section 7216 covers preparers who knowingly or recklessly disclose or use it beyond preparing the return; the penalty is a fine of up to $1,000 in most cases, up to a year in prison, or both. The IRS Office of Professional Responsibility's June 2026 AI guidelines (Alert 2026-19) say client data belongs only in secure, enterprise-approved AI, but don't settle when section 7216 consent is needed. The cautious course: written consent first, or no return information in AI at all.
4. Anonymize by default. Client name, tax ID, bank details and addresses become [Client], [ID], [Account] before anything is pasted.
5. A person checks every number. AI explains and drafts; the ledger and the workpapers are the source.

A summary, not legal or professional advice; sources and dates below. In Japan, the Personal Information Protection Commission has asked companies to check that personal data entered into AI isn't used beyond producing the answer.

A worked example

Illustration: a made-up business. A 9-person bookkeeping and tax firm finds three habits in one week: a bookkeeper pasting a client's bank export into a personal ChatGPT account to categorize transactions; a senior using Claude to draft engagement letters; and nobody sure whether tax returns had ever gone into an AI tool.

• The bank export: moved to the firm's Claude Team account, with the client name, account numbers and payee names replaced by labels first. Categories come back the same.
• Engagement letters: fine as they are; they contain no client data until the senior fills it in.
• Tax returns: the partners decide that return information stays out of AI tools until they've taken advice on section 7216 and updated their consent forms.

They write the five rules on one page, with the partner who answers questions named at the bottom.

Put it in place this week

1. Ask who uses which AI and on which account.
2. Move work to a business plan and close personal-account use for client work.
3. Read your engagement letters for data-sharing limits.
4. Decide on tax return information with your adviser.
5. Write the five rules on one page and name who answers questions.

Next step

Once the rules are set, put them into the AI itself: shared skills for the month-end checklist and variance note can carry "replace client names with labels" so nobody has to remember. Claude skills for finance covers which to build; the AI usage policy template covers the rest of the company.

Questions

Can accountants use ChatGPT with client data?

Only on a business plan that doesn't train on your data by default, such as ChatGPT Business or Claude Team, within what your engagement letters and professional rules allow, and never in a personal account. US tax preparers also need to consider IRC 7216, which restricts disclosing return information without consent.

Does IRC 7216 apply to using AI on tax returns?

Section 7216 makes it a misdemeanor for a preparer to knowingly or recklessly disclose or use return information beyond preparing the return. The IRS Office of Professional Responsibility's AI guidelines (Alert 2026-19, June 2026) cite section 7216 and require secure, enterprise-approved AI for client data, but don't say when consent is needed. The cautious course is written client consent first, or keeping return information out of AI tools. Ask your adviser.

How can finance use AI without client data?

Use it for the method and the writing: checklists, variance notes from figures you've anonymized, letter templates, explanations of standards. Replace client names and identifiers with labels and put them back yourself.