In June 2026, the Office of Professional Responsibility issued OPR Alert Issue Number 2026-19, Introductory Guidelines for Responsible AI Use in Federal Tax Practice. This isn't guidance for the future; it's the regulatory framework for now.
Why does this matter? OPR Alert Issue Number 2026-19 makes clear that the IRS expects competence with AI technology and holds practitioners accountable for how it's used. More importantly, your clients trust you to get it right. The bulletin makes clear that getting it right now means demonstrating competence with AI.
OPR Alert Issue Number 2026-19 raises expectations. Now comes the practical question: how do you translate those regulatory expectations into a framework that works in day-to-day practice?
The good news is that the bulletin doesn't create entirely new obligations. Instead, it applies existing Circular 230 standards to modern AI technology. Understanding the framework and incorporating it into your workflows is straightforward when approached deliberately.
The answer isn't “use AI cautiously.” It's “use AI deliberately.” Cautious use suggests hesitation. Deliberate use means knowing exactly when, how, and with what oversight you deploy AI.
The regulatory expectations: What Circular 230 really requires
OPR Alert Issue Number 2026-19 is rooted in five core Circular 230 provisions; due diligence, fees, competence, procedures to ensure compliance, and written advice requirements, in addition to the long-standing disclosure prohibitions under IRC §§ 6713 and 7216(a) and Circular 230 § 10.51(a)(15). Each applies directly to AI use, and the bulletin explains what compliance looks like in practice.
Circular 230 § 10.22 (Due Diligence)
Circular 230 § 10.22 (Due Diligence); the provision OPR Alert Issue Number 2026-19 leads with, requires that practitioners exercise due diligence in preparing returns, advice, and other IRS submissions, and in determining the correctness of representations made to the Treasury and to clients. Applied to AI, this means reviewing what the technology produces before it reaches a client or the IRS — verifying facts, checking citations, and confirming calculations. Due diligence is a professional obligation that cannot be delegated to the tool that did the drafting.
Circular 230 § 10.27(a) (Fees)
Under Circular 230 § 10.27(a), a practitioner may not charge an unconscionable fee in connection with any matter before the IRS. OPR Alert Issue Number 2026-19 draws a direct line from this provision to AI. Billing clients for manual research or drafting time that AI performed, or double-billing for AI-assisted work, can violate § 10.27 — particularly where the pattern recurs across clients, or the billing differential is significant. The expectation is that firms pass efficiency gains on transparently. Disclose, in general or specific terms as appropriate, when AI performed the work, and credit cost reductions to the client's account rather than billing as if the work were done manually.
Circular 230 § 10.35 (Competence)
Under Circular 230 § 10.35 (Competence), referenced explicitly in OPR Alert Issue Number 2026-19, competence now includes understanding AI's limitations — hallucination risks, bias vulnerabilities, and when human verification is non-negotiable. The bulletin notes that “lack of technological competence could lead to improper advice or flawed filings.”
Circular 230 § 10.36 (Procedures to Ensure Compliance)
Under Circular 230 § 10.36 (Procedures to Ensure Compliance), cited prominently in OPR Alert Issue Number 2026-19, firms must take reasonable steps to ensure adequate procedures exist for all staff, associates, and employees. The bulletin specifically requires firms to establish protocols for secure data handling, AI accuracy monitoring, and documented verification. It mandates comprehensive staff training on AI risks and requirements. Firms must also vet third-party AI tools before purchasing. All of this must be documented to demonstrate adherence to § 10.36.
Circular 230 § 10.37 (Written Advice Requirements)
Under Circular 230 § 10.37 (Written Advice Requirements), OPR Alert Issue Number 2026-19 makes clear that written advice must be based on reasonable factual and legal assumptions. Practitioners cannot rely on AI projections or representations without verification. For legal documents, citations must be checked and cases read. Financial forecasts, inputs, and formulas need confirmation. If the system's logic is opaque, reliance may be unreasonable under § 10.37. Blind reliance on what AI yields, especially when underlying logic or sources are unclear, may constitute unreasonable reliance.
Here's where many practitioners stumble. AI cannot do these things independently. It can accelerate research, drafting, and analysis, but it cannot assume professional responsibility.
The framework is simple. AI supports productivity. You provide judgment, verification, and accountability.
Data security and confidentiality: Non-negotiable guardrails
OPR Alert Issue Number 2026-19 devotes significant attention to data security and confidentiality. The bulletin warns that AI platforms can present risks related to unauthorized disclosure of sensitive taxpayer information, particularly when information is uploaded to unsecured or public systems.
The guidance explicitly references IRC Sections 6713 and 7216, which impose civil and criminal penalties for unauthorized use or disclosure of tax return information, along with Circular 230 § 10.51(a)(15), which separately prohibits willful unauthorized disclosure or use of taxpayer information. Both remain fully applicable when AI tools are involved.
The compliance standard is straightforward:
- Never upload sensitive client information to unsecured platforms.
- Use enterprise-grade AI solutions with strong confidentiality protections.
- Confirm vendors provide audit trails and data isolation safeguards.
- Ensure client information is protected throughout the AI workflow.
Solutions designed specifically for tax and accounting professionals often incorporate these protections from the outset. Platforms such as Thomson Reuters CoCounsel Tax have invested in security controls, confidentiality protections, and audit capabilities designed to support regulated professionals.
Beyond written procedures, OPR Alert Issue Number 2026-19 emphasizes the importance of ongoing training and organizational culture. Practitioners at every level should understand how AI systems work, where they are prone to error, what verification is required, and how taxpayer information must be protected. Equally important, firms should encourage professional skepticism. Team members should feel comfortable questioning AI-generated outputs, escalating concerns, and challenging conclusions that appear unsupported. A culture that prioritizes accountability and independent judgment is one of the most effective safeguards against AI-related errors.
Building your AI verification protocol
The most common AI failures in tax and accounting firms can be traced to a single issue — insufficient verification. Verification does not mean redoing the work yourself. It means applying a structured, risk-based review process.
Your verification protocol should distinguish between higher-risk, medium-risk, and lower-risk activities.
Higher-risk work
Examples include:
- Written tax advice
- Regulatory analysis
- Tax calculations
- Client-facing memoranda
- Legal and regulatory citations
- Audit positions and supporting conclusions
For these tasks:
- Read and verify every cited authority
- Confirm case holdings and interpretations
- Validate statutory and regulatory references
- Independently confirm calculations
- Document your review process
A simple checklist might include:
- Verified all citations against source documents
- Confirmed case holdings
- Reviewed statute and regulation updates
- Validated calculations
- Approved final conclusions
This documentation demonstrates compliance and professional oversight.
Medium-risk work
Examples include:
- Internal research summaries
- Draft workpapers
- Preliminary memoranda
- Research on familiar subjects
- Draft client communications
For these tasks, targeted verification is generally appropriate. Focus on key assumptions, legal reasoning, and material facts.
Lower-risk work
Examples include:
- Organizing documents
- Categorizing information
- Administrative communications
- Formatting data
- Summarizing information already familiar to the practitioner
Spot-checking for accuracy and consistency is often sufficient for these items.
The practical reality is that AI can significantly reduce drafting and organizational time, but professional review remains essential. The true benefit isn't simply speed. It's the ability to start with a stronger first draft and spend more time applying expertise where it matters most.
Which tasks are appropriate for AI: Practical guidance for tax professionals
OPR Alert Issue Number 2026-19 does not prohibit using AI for specific tasks; instead, it places responsibility on practitioners to ensure that AI-assisted work is subject to appropriate oversight, verification, and professional judgment. As a rule, AI is most effective for supporting research, organization, drafting, and analysis. The key consideration is not whether AI is used, rather whether the level of human review is proportionate to the risks involved. Regardless of the task, the practitioner remains responsible for the accuracy, completeness, and defensibility of the final work product.
Generally appropriate uses of AI include:
- Organizing and summarizing tax research
- Drafting first versions of memoranda or client communications
- Identifying potentially relevant authorities and regulations
- Comparing large volumes of documents or data
- Categorizing information and supporting administrative tasks
- Generating outlines, checklists, and workpaper templates
Uses that require substantial professional review include:
- Written tax advice
- Tax-return calculations
- Legal and regulatory analysis
- Audit positions and supporting conclusions
- Client-facing recommendations
- Interpretation of statutes, regulations, and case law
Activities that should not be delegated to AI
AI can be a powerful tool, but some responsibilities require human expertise. Professional judgment, accountability, and subject matter expertise cannot be outsourced to technology.
Activities that cannot be outsourced to AI:
- Taking tax positions without human analysis
- Relying on citations without verification
- Issuing complex tax advice without review
- Addressing novel or aggressive tax positions without professional evaluation
AI may assist with gathering information or organizing analysis, but the final assessment and decision-making responsibility always remains with the practitioner.
Choosing the right tools
Not all AI solutions are created equal. Your choice of vendors and platforms directly affects your ability to practice responsibly. Before committing to any AI tool, ask the following questions:
Security
- Is your clients’ data used to train the model?
- Does the vendor provide data isolation from other firms’ data?
- Has the vendor completed SOC 2 or comparable security audits?
- This isn't optional — it's a § 10.36 requirement
Auditability
- Can data usage activity be tracked?
- What data was uploaded, when, and by whom?
- Are prompts and outputs logged?
- Can records be exported for regulatory review?
Transparency
- Does the vendor acknowledge limitations such as hallucinations?
- Does the platform provide guidance on appropriate use cases?
- Are known risks and accuracy limitations disclosed?
- Vendors hiding these things are signaling they haven't built compliance into their product.
Compliance alignment
- Was the tool designed for regulated professionals or retrofitted from a general-purpose system?
- Does it support governance and oversight requirements?
AI tools are not all built for the same purpose. General-purpose AI applications may be useful for broad tasks, but tax professionals should consider whether a solution is designed to support the security, transparency, and oversight requirements of tax practice. For example, solutions like CoCounsel Tax are designed around professional tax workflows and trusted content sources, helping firms incorporate AI into existing processes while maintaining appropriate review and control.
Regardless of vendor, firms should evaluate every solution against their compliance, governance, and practice requirements
What happens if something goes wrong: Real consequences for CPAs
Many practitioners understand the opportunity AI presents. Fewer understand the consequences of using it irresponsibly.
Imagine a mid-size firm relies on a general-purpose AI tool to draft a memo on a novel tax position. The AI cites what sounds like authoritative case law but didn't actually verify it. The client relies on that memo and takes the position. Two years later, the IRS audits and the case the AI cited doesn't exist. The position collapses. Now the firm faces not just a malpractice claim, but also regulatory discipline for inadequate oversight under § 10.36. Plus, your Errors and Omissions (E&O) carrier may deny coverage if you didn't disclose AI use to them.
Regulatory discipline
The IRS may impose discipline under Circular 230, ranging from censure to suspension or disbarment from practice before the IRS.
Failures involving inadequate oversight, training, or procedures may result in scrutiny under §10.36. This isn't a single mistake; it's a systemic failure to have responsible AI practices.
Malpractice exposure
If inaccurate AI-supported work causes client harm, traditional malpractice standards still apply. Errors involving research, calculations, or advice remain the practitioner's responsibility.
Firms should review their E&O coverage and determine whether their policy addresses AI-related activities and risks. Many carriers are adding AI exclusions or requiring disclosure of AI use in your practice.
State board discipline
State boards of accountancy increasingly expect technological competence. States including California, Colorado, Illinois, and Utah have already enacted AI governance legislation addressing transparency and bias, and ethics and professional responsibility frameworks are beginning to follow suit; violations can result in discipline up to license suspension.
The common thread across regulatory, legal, and reputational risks is accountability. Regardless of whether AI is involved, practitioners remain responsible for the quality, accuracy, and defensibility of their work. The most effective way to reduce risk is to combine AI-enabled productivity with consistent review, oversight, and documentation.
Fortunately, most of these risks can be mitigated through thoughtful governance, staff training, verification procedures, and clear documentation. Responsible AI use is not about eliminating risk entirely, but about demonstrating that appropriate safeguards and professional judgment were applied throughout the process.
If you're audited by the IRS or questioned by a regulator, your best defense is documentation showing that reasonable procedures were in place and consistently followed.
The path forward
OPR Alert Issue Number 2026-19 makes one thing clear. The IRS expects competence, not caution or avoidance. The bulletin does not prohibit AI but establishes expectations for using it responsibly. Courts have sanctioned professionals who failed to meet similar standards, and tax practitioners should expect similar scrutiny.
A knowledgeable tax professional who uses AI deliberately, verifies outputs, understands limitations, and maintains appropriate oversight will be more productive and often more effective than one who ignores these tools entirely.
The good news is that responsible AI use does not require a complicated compliance program. The principles outlined in the bulletin can be translated into a practical framework that balances innovation, efficiency, and professional responsibility.
A practical framework for responsible AI use
- Build AI competence. Understand what AI can and cannot reliably do, train staff appropriately, and ensure human judgment remains central to client work.
- Apply risk-based oversight. Match tasks to the appropriate tools, verify high-risk outputs, and establish safeguards for sensitive or client-facing work.
- Implement governance and accountability. Create documented procedures for AI use, verification, approval, and data handling.
- Choose tools that support compliance. Work with vendors that prioritize security, confidentiality, auditability, and professional-grade workflows.
- Document decisions and verification. Maintain records demonstrating how AI-generated outputs were reviewed, validated, and approved.
Compliance is not achieved through good intentions. It requires documented processes, clear accountability, and proactive oversight. Understanding the principles is only the first step, and firms should also take practical measures that demonstrate those principles are being applied consistently, documented appropriately, and embedded into everyday practice.
Practical steps to take now
- Review your professional liability (E&O) coverage and notify your carrier about AI use.
- Confirm whether your policy includes AI-related exclusions, limitations, or procedural requirements.
- Monitor guidance from state boards and regulators, as expectations continue to evolve.
- Formalize internal AI governance policies and verification procedures.
- Maintain documentation demonstrating compliance, oversight, and quality control.
If you're ever audited by the IRS, asked to respond to a state board inquiry, or questioned by a professional liability carrier, your documentation may be your strongest evidence that reasonable procedures were in place and followed.
This is work. But it's work that generates competitive advantage. Firms that establish clear governance can move faster, scale expertise more effectively, and adopt new technologies with confidence. Those that avoid AI entirely risk falling behind; those that use it recklessly risk creating compliance and reputational problems.
The firms that will thrive are those that treat AI not as a shortcut, but as a professional tool that operates within a framework of competence, oversight, and accountability.
AI is a powerful tool. Professional responsibility remains a human obligation. The question for your firm isn't whether to use AI. It's how to use it in a way that makes you and your clients more successful, while keeping you compliant with the standards the IRS has now clearly articulated.
Firms shouldn't have to choose between innovation and compliance. Solutions like CoCounsel Tax are designed to help tax professionals adopt AI within a framework of security, oversight, and professional responsibility, enabling firms to work more efficiently while maintaining confidence in the quality of their work.
See how CoCounsel Tax can help your firm use AI responsibly, confidently, and efficiently.
.png){kind=logo}
