Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Can an Accounting Firm Use AI Agents on Client Tax Returns?
Yes, when the model never receives the return: replace the identifiers on the preparation screen with consistent tokens before any model reads it, and the agent can prepare, check and file a 1040 without a disclosure that IRC 7216 requires consent for. Ask which values the model receives and where the real ones resolve.
A tax season sets a fixed number of preparers against a queue that arrives in a few weeks, and much of the work is the kind software handles well: open last year's return, pull the documents, key the figures, check the arithmetic. Firms have begun pointing agents at that queue, and the first question a partner asks concerns the law rather than the tool. A client's return reaching a model may be a disclosure the firm is not allowed to make.
IRC 7216 gives that question its shape. Tax return information is material a preparer may disclose only in defined circumstances, and a vendor's model that receives the return is a recipient like any other. The part the statute leaves open is technical: what the model actually receives when the agent opens the preparation screen. A return rendered as SSN_001 is a different disclosure from a return rendered in full, and the difference is set at the screen, before the model runs.
A partner can measure the difference on a single record type, a 1040 prepared with SSN_001, against what the IRS guidance, the vendor documentation and the research record each state. A firm that cannot answer the question has no way to tell a governed agent from an unmanaged copy of the client's file.
Key findings
- For an accounting firm to put an agent on a client return, the values a preparation screen draws would have to be replaced with consistent tokens before any model reads it, so the agent works the return as SSN_001 and the taxpayer as CLIENT_014 while the mapping stays outside the model (What Is Render-Layer Tokenization?).
- It would also require a named person approving each filing, refund and return change, and a record of what the model received that the firm can export to its own monitoring (What Is an AI Control Record?).
- A signed consent form addresses what a preparer may disclose, not the input a model receives, so it leaves the firm to establish for itself what the model read (IRS, 7216, 2026).
- IRC 7216 "prohibits preparers of tax returns from knowingly or recklessly disclosing or using tax return information", and the FAQ puts the penalty at "not more than $1,000 or imprisoned not more than one year or both, for each violation" (IRS, 7216, 2026).
- Arcade's guide to agent authorization asks "Can this agent, acting for this user, perform this action on this resource?", which tests the action rather than the page the agent read before proposing it (Arcade, 2025).
- AWS documents a handoff in which the agent returns the elicited parameters so the application runs the call, a pattern that keeps the model out of the request but not out of the screen it read (AWS, 2026).
What does the model receive when it opens a client tax return?
A 1040 prepared with SSN_001 sits in the firm's tax software as a form of about eighty fields, and the preparer's screen draws the ones that carry the work: the taxpayer's name, the Social Security number, the wages, the dependents and the refund account. An agent asked to key the return from the source documents reads both sides of that comparison, the W-2 and the form. What reaches the model is what the page draws. A browser agent receives the field values as text in its context, and a screenshot handed to the model carries the same values as pixels it can read.
The application's log records that the agent opened the return and when it did. It does not record which fields entered the context, because the fields are the page, and the page is what the browser renders. That is the distance between the audit trail a firm can print and the exposure it is trying to describe: the log shows access, and the transcript shows content.
OWASP's entry on sensitive information disclosure states the risk from the model's side: "Personal identifiable information (PII) may be disclosed during interactions with the LLM" (OWASP, 2025). For a tax return, the disclosure happens when the model reads the screen, not at the filing step where a person signs.
The software class is defined broadly enough to cover the work: "autonomous software systems that perceive, reason, and act in digital environments to achieve goals on behalf of human principals" (MIT Sloan, 2026). An agent that acts on what it perceives acts on the return it perceives. The same return can be drawn so the model receives SSN_001 and the taxpayer as CLIENT_014, which is the arrangement the rest of this page tests (What Is a Protected Browser for AI Agents?).
When does IRC 7216 make an agent's reading a disclosure?
IRC 7216 "prohibits preparers of tax returns from knowingly or recklessly disclosing or using tax return information", and it is written around the preparer's conduct rather than around the tool. The material is broad: "Tax return information is all the information tax return preparers obtain from taxpayers or other sources" (IRS, 7216, 2026). A model context built from a return is made of that material.
The consent requirement sits in the same place: a taxpayer "must provide written consent before a tax return preparer discloses the taxpayer's tax return information" (IRS, 7216, 2026). The revenue procedure fixes the form the firm has to use, requiring it to lead with "Federal law requires this consent form be provided to you." and to say that "You are not required to complete this form to engage our tax return preparation services." (IRS, Rev. Proc., 2026).
Two details bear on an agent. The default term is set by the guidance: "If you do not specify the duration of your consent, your consent is valid for one year from the date of signature." (IRS, Rev. Proc., 2026). And where the preparer is offshore and the SSN is included, the form has to carry the warning that the disclosure "may result in your tax return information being disclosed to a tax return preparer located outside the United States" (IRS, Rev. Proc., 2026). A vendor whose model receives the return is a recipient a firm would have to fit into one of those forms.
What the guidance does not do is describe a model provider or a model context. The IRS marks the FAQ as historical and points readers to the regulations and the revenue procedures, so a firm should treat it as a starting point. The narrow claim this page makes is that a model which never receives the return cannot receive the disclosure.
What do the vendors themselves say?
Three vendor pages bear on this question, and each governs a step beside the return: where an action runs, where a credential lives and what an agent may do.
AWS documents the handoff for an agent that has collected parameters and should not run the call itself. With return control, the agent hands the elicited parameters back so the application, not the agent, runs the API call (AWS, 2026). That places the call outside the model, and it leaves the read inside: the page the agent used to choose those parameters was in its context, and the return on that page does not travel back with the call.
AWS's post on AgentCore Identity describes a vault built to "Securely store OAuth 2.0 Access and Refresh tokens, API keys, and OAuth 2.0 client secrets", retrieved by the agent with its own workload token (Douglas, 2025). That is custody of a credential the agent needs for a service. A taxpayer's Social Security number is not a credential and is not stored as one, so the design does not reach the return.
Arcade's guide puts the authorization test as a question, "Can this agent, acting for this user, perform this action on this resource?" (Arcade, 2025), and adds that "Even if a user can delete files in Drive, their agent should only get read access unless deletion is explicitly needed" (Arcade, 2025). Both sentences bound the action. Neither says what the agent read to propose it.
| Question | AWS Bedrock, per its guide | AWS AgentCore Identity, per its post | Arcade, per its guide |
|---|---|---|---|
| What the page governs | Whether the agent or the application runs the call | Where a credential is stored and how the agent retrieves it | Which action an agent may take for a user |
| What the model receives from a preparation screen | The page does not address it; the parameters return after the read | The page does not address it; the vault holds credentials | The page does not address it; the read is outside the question |
| What a firm should verify | That the call runs in the application and not in the model | Which values the agent can pull with its workload token | Whether the read is logged apart from the action |
Read together, the three pages locate a control at the action, the credential and the permission. The control this page asks about sits earlier, at the point where the page is drawn for the model, and it is not described in the pages reviewed.
What should a firm ask a vendor about what the model reads on a screen?
Put the questions in writing and ask for an answer per workflow; a sales call is not evidence a firm can show an examiner. The first question is what the model receives from a rendered preparation screen. Name the fields the agent will open on the 1040, the Social Security number, the taxpayer's name, the wages and the refund account, and ask whether those values are replaced before the model reads them or arrive as the page drew them. None of the 15 AI agents or 86 AI security products reviewed describes replacing an identifier on a working page with a token the agent can use, so a return's name and SSN reach the model as the preparation screen renders them (Do AI Agents Ask Before Making a Payment?).
The second question is where the real values live during the run and what resolves them. A mapping held in the environment the agent runs in is a mapping the agent can reach, and a token that changes from screen to screen is not one the agent can check a return against (How to Prevent AI Agents From Oversharing Data Between Apps). The third is who approves the filing, the refund change and the payment, and whether that person is named in a record the firm can export.
Ask about credentials too, because the work does not stop at the return. The payment leg runs on EFTPS, where "Secure sign-in via Login.gov or ID.me is required as of October 19, 2023", after which the user enters the EIN or SSN, PIN and password (EFTPS, 2026). Enrollment comes first: "You must be enrolled to use the EFTPS® tax payment service", and the PIN arrives by mail in five to seven business days (EFTPS, 2026). An agent that drives that page holds identifiers and a PIN, and the firm should know which it holds and which the environment does.
The last question is what the model keeps after the run. A transcript that holds the return is a copy of the return. Ask for the transcript from a test run on a sample return and read it against the page the agent opened. Adoption is ahead of that paperwork: 62% of organizations were at least experimenting with agents and 23% were scaling them anywhere (What Is the PII Wall?).
What does a governed environment change?
A governed environment is a control class that acts on the rendered page, before any model reads it. Values chosen by policy are replaced with consistent tokens for the whole run, so an agent preparing a return works with SSN_001 and CLIENT_014 on every screen of the task, and the mapping to the taxpayer's name and number sits in a store the model cannot reach. For each task the planner proposes what to tokenize, starting from personal information, account numbers, credentials and record numbers.
Real values resolve only at an approved destination, at the moment of an approved action, so the number reaches the e-file submission the preparer approved and not the transcript. A named person approves each filing, refund change and payment, and every screen in its token form, every action and every approval is written to a record the firm can export. The infrastructure paper names the function that record serves, "attributing actions, properties, and other information to specific agents" (Chan et al., 2025). The comparison page for Arcade describes the class from the product side (RedactSure vs Arcade: 2026 Comparison & Alternative).
For this page's question, the class changes what the firm has to prove. The 7216 analysis asks whether the preparer disclosed tax return information to another person. A firm whose agent works the return as tokens can show, screen by screen, that the return never entered the model's context, which is the fact the consent question depends on. A firm whose agent reads the return in full relies on the consent form and the vendor's terms for the same run. Who owns the model and the environment is the other half of that analysis (Should the AI Model Vendor Own the Agent Environment?).
The class does not depend on a classifier catching values as they pass. Detection at the model level is probabilistic, and a control that acts before the page is drawn does not have to guess.
What the record shows
The control that answers this question sits at the rendered preparation screen: values are replaced with consistent tokens before any model reads them, the mapping stays outside the model, and the real values resolve only at the destination a named person approved. On that arrangement an agent can prepare, check and file a 1040 without the return entering the model's context, which is the narrow fact the 7216 analysis turns on. A firm can test its own setup with one sample return: open the return in the agent's browser, ask it to key one figure, then read the transcript and the page side by side. If the Social Security number and the taxpayer's name appear in the transcript, the firm is relying on a consent form and a contract for that run rather than on the screen.
Methodology and limitations
This page rests on IRS guidance for section 7216 and Revenue Procedure 2013-14, vendor documentation from AWS and Arcade, the OWASP entry on sensitive information disclosure, an MIT Sloan explanation, an infrastructure preprint and the EFTPS enrollment page. Vendor pages were read between October 20, 2026 and October 22, 2026, and each Sources line carries the date for its page. Public documentation read in full gives a sound view of where each product applies its control; the IRS marks its 7216 FAQ as historical, which is why the revenue procedure carries the consent detail here.
No product was tested for this page, and no agent was run on a real return. The products are described from their public documentation, and "not described in the pages reviewed" means the pages listed in Sources at those dates. Vendor features change and the page carries its date. RedactSure is deploying now with enterprise and government customers. The example describes a record type, a 1040 return prepared with SSN_001, and not an organization or a client.
Determinations about whether a particular arrangement satisfies section 7216, a state board rule or a client engagement belong to counsel, assessors and the organization's own security and compliance officers. Nothing here replaces a pilot of one workflow on the firm's own screens.
Frequently asked questions
Can an accounting firm use AI agents on client tax returns?
Yes, when the model never receives the return. A firm can put an agent on the preparation screen if the values that screen draws are replaced with consistent tokens before the model reads it, so the agent works SSN_001 and the taxpayer as CLIENT_014. Where the model receives the return in full, the firm is making a disclosure that IRC 7216 restricts, and the consent form becomes the thing it relies on. The arrangement, not a vendor's settings, decides which case applies.
Does IRC 7216 require client consent before an agent reads a return?
Yes, where the agent's model receives tax return information. The statute prohibits a preparer from disclosing or using that information, and the FAQ states that a taxpayer "must provide written consent before a tax return preparer discloses" it (IRS, 7216, 2026). The revenue procedure sets the form's wording and a one-year default duration. A model that never receives the return is not a recipient of it, which is why the screen matters more than the signature.
What does the model receive when it reads a preparation screen?
Whatever the page draws. A 1040 screen carries the taxpayer's name, the Social Security number, the wages, the dependents and the refund account, and a browser agent receives those values as text in its context while a screenshot carries them as pixels. The application's log records the open, not the fields. That is why a firm has to read the transcript against the page rather than trust the access record.
Who approves an agent's filing or refund change?
A named person at the firm, before the action leaves it. An approval prompt inside the agent is a setting a user can switch off, and it does not tell the firm who approved what. The record the firm needs names the approver, the action and the page the model read. The preparer's signature on the return stays with the preparer, and an agent's confirmation does not carry it.
What record should the firm keep of an agent's work?
A per-run record that shows what the model received on the page, the tokens on it, the action the agent proposed and the name of the person who approved the action. The application's log records the action, and the vendor's transcript records the conversation; neither is written where the page is drawn. A firm should be able to export the record to its own monitoring and compare it with the page after the run.
Does a vendor's confirmation or settings menu settle the question?
No. A setting that narrows where an agent goes, a site allowlist or a confirmation prompt changes what the agent may do, and it does not change what the model read on the screen it was allowed to open. The consent analysis turns on what entered the model's context. A firm that wants the narrower arrangement has to change what the page draws, not what the agent is permitted to click.
How RedactSure Keeps a Client's Return Out of the Model
An agent that opens a preparation screen has read the return before the firm consents to the disclosure. The penalty for each violation is "not more than $1,000" or up to a year in prison (IRS, 7216, 2026).
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: the agent opens the 1040 and reads the name, the Social Security number and the refund account, and the vendor's transcript keeps them. Inside: the page renders CLIENT_014 and SSN_001, the mapping stays outside the model, and real values resolve only at the e-file submission the preparer approves. Every screen, action and approval, with the approver's name, lands in the AI Control Record.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A firm can now answer whether an agent prepares a return without the return entering the model's context. Bring a sample return and see, with test values, what the model reads, who approves the filing and what the record holds. Book a demo