The AI section of your security plan

# AI addendum to the Written Information Security Plan of [Firm name]

Dated [date]. Approved by [Qualified Individual], Qualified Individual.

_A draft for your counsel or Qualified Individual to review; not legal advice. Whether it meets a rule that applies to you is for you and them to decide._

## 1. Scope

This addendum covers the AI tools that [Firm name]'s staff and contractors use on customer information: client files, returns, and anything said about a client. It adds to the firm's Written Information Security Plan (IRS Publication 5708) and changes nothing else in it. Customer information here includes tax return information, which the regulation defines this widely:

> "The term tax return information means any information, including, but not limited to, a taxpayer's name, address, or identifying number, which is furnished in any form or manner for, or in connection with, the preparation of a tax return of the taxpayer." (26 CFR 301.7216-1(b)(3)(i), as quoted in OPR Alert 2026-19)

## 2. AI tools allowed on customer information, and on which plans

[List the AI tools and plans the firm allows. None was named, so none is allowed on customer information.]

Any AI tool or plan not listed here is not allowed on customer information. Personal accounts are not allowed on client work. Before a tool is added, the Qualified Individual records its vendor's terms on training and retention, the plan, and where its log is kept (section 6).

> "Implementing and periodically reviewing access controls, including technical and, as appropriate, physical controls" (16 CFR 314.4(c)(1))

> "Practitioners must strictly handle all client data using only secure, enterprise-approved AI." (IRS OPR Alert 2026-19, on IRC sections 6713 and 7216(a))

## 3. Logging the activity of authorized users

> "Implement policies, procedures, and controls designed to monitor and log the activity of authorized users and detect unauthorized access or use of, or tampering with, customer information" (16 CFR 314.4(c)(8))

The firm keeps one AI activity log for every tool in section 2: who used which tool, when, for which kind of action (a prompt, a tool call, a file opened, an approval given or refused), and on which client folder or file when the tool's export records it. It is built on the firm's own computer from each vendor's export and hash-chained, so a line removed or changed afterwards shows. It holds no prompt or reply text: a copy of what was said about a client would be one more copy of tax return information to protect and to dispose of.

> "Develop, implement, and maintain procedures for the secure disposal of customer information in any format no later than two years after the last date the information is used" (16 CFR 314.4(c)(6))

> "Event Logging will remain enabled on all systems containing PII. Review of event logs by the DSC or IT partner will be scheduled at random intervals not to exceed 90 days." (IRS Publication 5708 (Rev. 8-2024), sample WISP, page 10)

## 4. Review

[Reviewer] reviews the AI activity log at least every 90 days, and after any security event. Each review checks that the log's hash chain is unbroken, that every tool in section 2 appears in it, that no tool outside section 2 does, and that each person's activity fits their role. Each review is recorded here:

| Review date | Period covered | Reviewer | Chain verified | Findings and actions |
| --- | --- | --- | --- | --- |
| | | | | |
| | | | | |

## 5. Verifying AI output

> "Document AI usage and verification processes." (IRS OPR Alert 2026-19, Best Practices for Responsible AI Use)

Whoever uses an AI tool on a client matter checks its output before it is used or sent: facts, figures, calculations and every citation against its source. They record in the client file the date, the tool, what it was used for and who checked it. AI output is a draft until then.

| Date | Client file | Tool | Used for | Checked by | Notes |
| --- | --- | --- | --- | --- | --- |
| | | | | | |

## 6. Confidentiality and the AI vendors

> "Taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue" (16 CFR 314.4(f)(1))

For each tool in section 2 the Qualified Individual keeps: the vendor's terms on whether customer data trains its models and how long it is retained, the plan the firm is on, who in the firm administers it, and where its log is. Client data goes only into the tools and plans listed in section 2.

## 7. Incidents

If customer information reaches an AI tool or account that section 2 does not allow, or an AI tool's account is used by someone who should not have access, it is handled under the firm's incident procedure.

> "Notify the Federal Trade Commission about notification events in accordance with paragraphs (j)(1) and (2) of this section." (16 CFR 314.4(j))

A notification event involving the information of at least 500 consumers is reported to the FTC as soon as possible and no later than 30 days after discovery.

## 8. Approval

> "And all steps and processes documented to show adherence to section 10.36." (IRS OPR Alert 2026-19, on § 10.36)

Approved by [Qualified Individual], Qualified Individual. Signature: ____________ Date: ____________

## Where each rule is answered

| Rule | What it asks | Section |
| --- | --- | --- |
| 16 CFR 314.4(c)(8) | Monitor and log what authorized users do | 3, 4 |
| 16 CFR 314.4(c)(1) | Access controls | 2 |
| 16 CFR 314.4(c)(6) | Dispose of customer information within two years of its last use | 3 |
| 16 CFR 314.4(f)(1) | Oversee service providers, the AI vendors among them | 2, 6 |
| 16 CFR 314.4(j) | Tell the FTC about a breach of 500 or more consumers' information within 30 days | 7 |
| IRS OPR Alert 2026-19, Best Practices for Responsible AI Use | Document AI use and how its output is verified | 5 |
| IRS OPR Alert 2026-19, on IRC sections 6713 and 7216(a) | Client data only in secure, enterprise-approved AI | 2, 6 |
| IRS OPR Alert 2026-19, on § 10.36 | Firm procedures for AI, written down (Circular 230 §10.36) | 4, 5, 8 |
| IRS Publication 5708 (Rev. 8-2024), sample WISP, page 10 | Event logging on, and reviewed at least every 90 days (the IRS sample plan) | 3, 4 |
| 26 CFR 301.7216-1(b)(3)(i), as quoted in OPR Alert 2026-19 | What counts as tax return information | 3, 6 |

## Sources

- 16 CFR 314.4, Elements of an information security program (Cornell LII): https://www.law.cornell.edu/cfr/text/16/314.4 (read 9 October 2026)
- 26 CFR 301.7216-1, Disclosure or use of tax return information (Cornell LII): https://www.law.cornell.edu/cfr/text/26/301.7216-1 (read 9 October 2026)
- IRS Office of Professional Responsibility, OPR Alert 2026-19: Introductory Guidelines for Responsible AI Use in Federal Tax Practice (24 June 2026): https://content.govdelivery.com/accounts/USIRS/bulletins/41d6e70 (read 9 October 2026)
- IRS Publication 5708 (Rev. 8-2024), Creating a Written Information Security Plan for your Tax & Accounting Practice: https://www.irs.gov/pub/irs-pdf/p5708.pdf (read 9 October 2026)