Build a reconstructable AI review trail for Circular 230 diligence

The June 2026 IRS Office of Professional Responsibility bulletin, Introductory Guidelines for Responsible AI Use in Federal Tax Practice, clarifies that existing Circular 230 duties apply to AI use in federal tax practice. The guidance does not create new regulations but explains how duties regarding diligence, competence, confidentiality, and supervision apply to AI-assisted workflows. The professional remains responsible for all results and must be able to demonstrate the verification performed on AI-generated output.

For a CPA firm, the operational question is concrete: if a partner, reviewer, or regulator asked what happened on an engagement, could the firm reconstruct the AI-assisted steps without searching someone’s chat history?

Circular 230 duties for AI-assisted practice

The Office of Professional Responsibility (OPR) identifies several sections of Circular 230 that govern the use of AI tools.

Section 10.22 requires diligence as to accuracy. Practitioners must verify AI-generated facts, citations, and calculations before they are included in a return or provided as advice. Section 10.27 addresses fees. Billing for manual time that was not spent, or double billing for AI-assisted tasks, may violate the fee rules depending on the facts. If AI efficiency changes the economics of an engagement, firms should address those savings openly.

Section 10.35 requires competence, meaning the practitioner must understand the capabilities and limitations of the AI tool. Under Section 10.36, firm leadership must establish procedures to supervise AI use, train staff, and vet providers. Section 10.37 states that written advice must be based on authenticated facts and reasonable assumptions rather than unverified AI output. Finally, IRC 6713 and 7216, along with Section 10.51(a)(15), address unauthorized use or disclosure of taxpayer information. OPR warns that public or unsecured AI systems can create that risk.

Engagement records for AI use

A firm should maintain a record that allows a reviewer to reconstruct the steps taken by an AI during an engagement. The depth of this record should correspond to the risk level of the engagement.

Field	What to capture
Firm user	Who initiated the request
Client and engagement	Which taxpayer or company and which service
AI system	Product, provider, and material configuration
Connection	How the system reached client data
Instruction	The request or procedure given to the AI
Data scope	Reports, records, documents, or tax information accessed
Output	Material conclusion, draft, exception list, or proposed action
Verification	Sources checked, calculations recomputed, and records reviewed
Reviewer	Qualified person who evaluated the output
Approval	Who approved advice, filing content, or accounting changes
Result	What was delivered, changed, posted, or rejected
Time	Relevant request, review, approval, and completion timestamps

Match record depth to risk. Drafting an internal agenda does not need the same file as preparing adjustments that feed a business return.

Firm policies and activity documentation

A firm policy defines which tools staff may use, what client data each tool may receive, which tasks require professional review, and how the firm handles errors or disclosure incidents. The engagement record answers a different question: what happened for this client and this procedure. It should show which tool was used, what data it accessed, what it proposed, what the reviewer verified, and how the professional disposed of those proposals.

AI use in pre-tax accounting workflows

AI often assists with bookkeeping tasks that occur before tax preparation. This includes transaction classification, year-end account balance reviews, and the preparation of adjusting journal entries. Because these steps feed into tax software and influence the final return, they are subject to Circular 230 diligence requirements. Documentation of AI involvement should begin at the accounting level rather than only within the tax application.

In QuickBooks Online Accountant, Prep for taxes can expose annual balance-sheet and P&L totals, transaction detail, adjusting journal entries, and tax-line mappings. AI-assisted cleanup can affect that chain before anyone opens the tax software. Examples include clearing Uncategorized Income, reviewing unusual balances, preparing accrual entries, reclassifying transactions, and reviewing 1099 vendors.

Limitations of the QuickBooks Online audit log

The QuickBooks Online audit log records transaction edits, sign-ins, and settings changes. When a connected third-party application modifies a record, the event often appears under System Administration. This log identifies that a change occurred, but it may not identify:

• The staff member who asked the assistant to prepare the change.
• The instruction given to the assistant.
• The reports or transactions reviewed first.
• The professional who approved the proposal.
• Related actions across other companies.
• Proposals that were rejected and never posted.

Firms need a separate workflow record for the professional decisions that the QuickBooks audit log was not designed to capture.

Documentation for year-end cleanup

Suppose the firm asks an AI assistant to review the year-end trial balance and general ledger, identify unusual balances, prepare likely reclassifications, and list items that require client support. The instruction also says not to post changes.

A reconstructable record would include:

1. The client company, fiscal year, accounts reviewed, and authorized data sources.
2. The exact instruction and the no-posting boundary.
3. The unusual balances and transactions supporting each finding.
4. Proposed reclassifications, kept separate from confirmed facts.
5. Questions that require client documents or professional judgment.
6. The accounts, calculations, and source records used for verification.
7. The reviewer and their disposition of each proposal.
8. The entries posted after approval, rejected proposals, and unresolved items.

This record supports quality review and staff handoffs even if no regulator requests it.

Data controls and vendor vetting

OPR advises practitioners to use secure, enterprise-approved AI and not upload sensitive data to unsecured sites. Before approving a provider, a firm should document:

• The client data the service receives.
• Whether client data is used for model training.
• Retention and deletion terms.
• Relevant subprocessors and data locations.
• Authentication, access controls, and encryption.
• Incident-response commitments.
• How access is revoked when an employee leaves.
• Whether the firm can export its activity records.

Firm policy should prohibit consumer or personal AI accounts for client work. Practitioners should consult counsel regarding consent and disclosure obligations for taxpayer information.

Verification of professional review

Saying that a human is in the loop is not enough. Evidence of oversight must be specific to the engagement. The record should show exactly what the reviewer evaluated, any changes they made to the AI output, and the timing of their approval. Review should occur before advice is issued, before entries are posted to the ledger, and before tax-line mappings are finalized.

AI efficiency and fee disclosures

Section 10.27 prohibits unconscionable fees. Charging for manual labor that was not performed or double-billing for AI-assisted tasks may violate the rule depending on the facts. Partners and billing managers should review time entries and fixed-fee economics to ensure that AI-driven efficiencies are handled transparently in proposals and engagement letters.

Compliance steps for accounting firms

• Inventory all AI systems that receive client or taxpayer information.
• Approve specific providers and account types before staff use them.
• Define prohibited data and prohibited procedures in writing.
• Map company and client access to engagement assignments.
• Require verification levels based on the risk of the accounting or tax task.
• Separate AI findings from proposed professional conclusions in workpapers.
• Require named approval before finalizing accounting changes or tax advice.
• Record instructions and approvals outside of the AI chat interface.
• Train staff on firm AI procedures and spot-check for compliance.
• Align billing policies and incident response plans with AI usage.

Connect and QuickBooks Online

Connect provides AI assistants with access to QuickBooks Online data through a managed interface. The firm controls which companies the assistant can access and can require professional approval before any changes are posted to the ledger. Connect maintains a record of connection activity and tool use. This record provides metadata about the interaction but does not store prompts, report contents, tool arguments, or transaction payloads.

The gateway record is not a complete engagement workpaper and does not make a firm Circular 230 compliant. Firms must combine it with their own policies, staff training, provider review, engagement documentation, and professional verification.

For implementation context:

• Review security and review controls for AI accounting.
• See Connect controls for accounting firms.
• Read the QuickBooks AI agent evaluation criteria for CPA firms.

This article provides general information, not tax, legal, or Circular 230 advice. Consult your own advisors about Circular 230, IRC 6713 and 7216, state law, professional standards, and your firm’s specific use of AI.