The IRS Just Put Firm Owners on the Hook for AI

The new OPR guidelines on AI read like advice for preparers. The sharper message is for whoever runs the firm.

On June 24, 2026, the IRS Office of Professional Responsibility (OPR) released Alert 2026-19, "Introductory Guidelines for Responsible AI Use in Federal Tax Practice." Most of the early commentary has focused on the individual preparer: check the citations, verify the math, and keep client data out of public chatbots. That advice is correct, and none of it is new.

What deserves more attention from firm owners is where the guidelines place accountability. They do not create an AI rule. They take the Circular 230 duties that already govern CPAs, enrolled agents, and attorneys who practice before the IRS and apply them to AI. Two of those duties land on the firm rather than the preparer: the duty to maintain compliance procedures and the duty not to charge an unconscionable fee.

No new rule, same exposure

The word "introductory" matters. OPR is signaling that more guidance may follow, and the guidelines themselves are not a regulation. The Circular 230 sections they rely on, however, are enforceable today.

Due diligence (Section 10.22)

Practitioners are expected to review every AI-created document and verify its facts, citations, and calculations before it goes to a client or the IRS.

Competence (Section 10.35)

Competence now reaches the tools as well as the law. OPR expects practitioners to understand how an AI tool works, where it fails, and what risks it carries before using it on an IRS matter.

Written advice (Section 10.37)

AI output is a starting point. Facts and legal conclusions in written advice must be independently verified.

Confidentiality

Section 10.51(a)(15), along with Internal Revenue Code Sections 6713 and 7216, carries civil and criminal consequences for unauthorized use or disclosure of return information. This is where AI becomes a real legal risk rather than a quality issue. When a staff member pastes a client's W-2, a trial balance, or a draft return into a free consumer chatbot, that information leaves the firm and goes to the AI vendor, a third party, typically without the client's consent and often under terms that let the vendor keep or reuse it.

That can amount to exactly the kind of unauthorized disclosure these provisions penalize, and Section 7216 makes a knowing or reckless disclosure a crime. OPR's instruction is therefore plain: client data belongs only in "secure, enterprise-approved AI."

OPR summarized its position in a single line: "Technology serves as a powerful tool, not a substitute for professional judgment." If a staff accountant treats a chatbot answer as research, that sentence is the standard the work will be measured against.

Section 10.36 is the owner's problem

Section 10.36 requires the individuals with principal authority for overseeing a firm's tax practice to take reasonable steps to ensure the firm has adequate procedures for complying with Circular 230. The guidelines apply that duty directly to AI. Firms are expected to have policies covering staff training on AI risks, internal protocols for data handling and accuracy monitoring, and vetting of outside AI providers. Under the existing rule, the person with principal authority can be disciplined if, through willfulness, recklessness, or gross incompetence, the firm lacks adequate procedures or that person fails to act on a known pattern of noncompliance.

Read that from the owner's chair. If a preparer uploads a client's return to an unapproved tool, the preparer has a problem. If the firm has no list of approved tools, no training, and no one checking the work, the owner may have one as well. "I didn't know staff were using it" is a weak defense, because in most firms staff already are. The stronger defense is a written policy, evidence that people were trained on it, and a review step that would catch a fabricated citation before it leaves the building.

Section 10.27 and the pricing conversation

The billing guidance is the part most likely to change how firms operate. Section 10.27 prohibits unconscionable fees. The guidelines warn that billing for time not actually spent, or double billing for AI-assisted tasks, may violate the rule. They also expect cost savings from AI to be credited fairly to the client, with the AI work described in general or specific terms as needed.

For firms that still price by the hour, this is a direct problem. If a research memo that once took three hours now takes forty minutes, billing three hours invites exactly the question OPR is raising.

Two responses are defensible. One is to bill actual time and let efficiency show up as lower fees and more capacity. The other is to price the engagement in advance, fixed or value-based, so the client pays for the result, and to describe the firm's AI use in the engagement letter.

What is not defensible is quietly keeping the old hour count. Firms that moved to value pricing years ago will find this section easy. Firms that did not, now have a regulatory reason to start.

Five steps before next filing season

1. Name the approved tools.

Publish a short list of AI tools the firm has vetted and state plainly that client data goes nowhere else. For each vendor, ask where data is stored, whether it is used to train models, and who can access it.

2. Write a one-page policy.

Cover permitted uses, prohibited uses, required review, and whom to ask when unsure. One page that staff actually reads beats a manual that nobody opens.

3. Train, and keep the evidence.

A short session with a sign-in sheet or recorded attestations shows that procedures existed. Include a live demonstration of an AI tool inventing a citation; it makes the point faster than any memo.

4. Build review into the workflow.

Require that every AI-assisted memo, letter, or computation be reviewed by someone who checks the sources, not only the conclusion, and note AI use in the workpapers.

5. Update the engagement letter and the fee model.

Add a plain-language description of how the firm uses AI and protects client data, and make sure invoices reflect either time actually spent or a price agreed in advance.

The upside for firms that move first

None of this should discourage firms from using AI. The guidelines assume practitioners will use it and ask only that it be held to the same judgment applied to any other work product. A firm that builds its policy now can tell clients, truthfully, that their data stays in approved systems and that a professional reviews every deliverable. That is a selling point, and it is precisely what OPR is asking for.

The rules have not changed. The tools may be artificial, but the liability is entirely real. The IRS has made it clear: the technology can generate the work, but the person who runs the firm answers for it.