Compliance Considerations: IRS, SOX, and AI Usage

Compliance Considerations: IRS, SOX, and AI Usage

Using AI in accounting introduces compliance considerations that every accountant must understand. The regulatory landscape is evolving, but several principles are already clear. Under IRS rules, the tax preparer remains responsible for the accuracy of the return regardless of whether AI was used in preparation. Under SOX, management certifications of financial statements are not absolved by AI use — if AI helped prepare the statements, management is still accountable for their accuracy.

The AICPA has issued guidance on AI use in professional services, emphasizing that AI does not change the fundamental standards of due care, competence, and confidentiality. The accountant using AI must still exercise professional judgment, verify AI output, and maintain independence where required. AI is a tool, not a substitute for professional responsibility.

For firms subject to SOC 2 or SOC 3 reporting, AI tool usage may need to be documented in the system description. If AI tools process client data, this should be disclosed to clients and reflected in the firm's controls. For international clients, GDPR considerations apply if AI tools process data of EU residents — ensure your AI tools have adequate data processing agreements.

Compliance Checklist for AI Use in Accounting

• IRS Circular 230 compliance: AI-assisted tax positions must still meet the "reasonable basis" standard. Verify all AI-suggested tax treatments.
• Due diligence: AI does not reduce your due diligence obligations. Verify all AI-generated figures and citations.
• Confidentiality (AICPA Code): Ensure AI tools do not compromise client confidentiality. Use enterprise tier with no-training guarantees.
• Independence: AI tools do not create independence issues per se, but be cautious about AI tools that provide advisory services to your audit clients.
• Documentation: Document AI use in workpapers where material. Note which sections were AI-assisted and how they were verified.
• SOX compliance: Management still certifies financial statements. AI-assisted preparation does not change certification obligations.
• GDPR considerations: If processing EU client data, ensure AI tools have adequate safeguards and data processing agreements.
• Client disclosure: Consider disclosing AI use in engagement letters, especially if client data is processed by third-party AI tools.

Prompt Template: Compliance-Aware AI Usage Check

I am a [CPA/tax preparer/auditor] at a [FIRM TYPE] firm.
I want to use AI for: [DESCRIBE INTENDED USE CASE]
My client is: [INDIVIDUAL / BUSINESS / PUBLIC COMPANY]
Regulatory framework: [IRS / SOX / SOC / GDPR / COMBINATION]

Analyze:
1. Is this AI use case permitted under current regulations?
2. What professional standards apply (AICPA Code, Circular 230, etc.)?
3. What documentation do I need to maintain?
4. What client disclosures are required or recommended?
5. What verification steps must I perform on AI output?
6. What are the risks of this use case, and how should I mitigate them?

Provide specific regulatory references where applicable.
Note: This is general guidance, not legal advice. Consult your compliance team for specific situations.

Key Takeaways

• AI does not reduce professional responsibility — the accountant remains accountable
• IRS Circular 230: AI-assisted tax positions must still meet "reasonable basis" standard
• SOX: Management certification obligations are unchanged by AI use
• Document AI use in workpapers where material; disclose to clients where appropriate
• This is general guidance — always consult your firm's compliance team for specific situations

Try It Now

Review your firm's last engagement letter template. Does it mention AI tool usage? Consider adding a disclosure clause. Then use the compliance check prompt template to evaluate one of your current AI use cases against the applicable regulatory framework.