The AI clause every Australian engagement letter needs

Most Australian firms do not yet have an AI clause in their engagement letters. The TPB has now made that a problem.

TPB(GS) 55/2026, issued 22 July 2026, is the TPB's final guidance on AI use in tax agent services. Two lines from it matter most. First: existing Code obligations apply to AI. Second: entering client data into an AI model can constitute a disclosure to a third party under Code item 6.

That second line changes what needs to be in your engagement letter. This article covers what Code item 6 requires, the clause to add, and the explainer to send existing clients before they hear about AI from someone else.

What Code item 6 actually requires

Code item 6 of the Tax Agent Services Act 2009 says a registered tax practitioner must not disclose information relating to a client's affairs to a third party without the client's permission, unless there is a legal duty to do so.

The TPB defines "third party" as any entity other than the client and the practitioner. When a team member pastes client information into a generic AI tool, that information is being made available to a third party: the tool's operator. TPB(GS) 55/2026 confirms this can constitute a disclosure, depending on how the tool is configured, where the data goes, and what the vendor's terms say.

The TPB does not require you to name every AI tool in your engagement letter. It requires client permission for the disclosure. That permission can come through a signed engagement letter, signed consent, or another form of communication. Whatever form it takes, it needs to be documented and reproducible if the TPB asks.

Disclosure and permission are not the same thing

Disclosure is telling your client you use AI. Permission is the client agreeing to it. Code item 6 requires both.

A privacy policy on the firm website that mentions AI is disclosure. It is not permission. The client has not signed anything, agreed to anything, or been asked. If the TPB asks you to produce the permission for a specific client's file, a website disclaimer is not the answer.

An engagement letter clause is the cleanest way to capture permission. It applies to the whole engagement and lives in the file where every other consent lives.

The clause to add to your engagement letter

This is a starting point, not legal drafting. Adapt it to your firm and get it reviewed before it goes out.

Use of technology and artificial intelligence. In delivering our services we may use software tools, including artificial intelligence tools, to assist with tasks such as document drafting, data analysis, transcription and research.

We conduct due diligence on the providers of these tools and only use tools whose terms provide appropriate confidentiality and data protection safeguards for your information.

All work produced with the assistance of these tools is reviewed by our professional staff, and responsibility for the services we provide remains with us at all times.

By signing this letter you consent to our use of such tools on your engagement, including processing of your information by their providers under the safeguards above. You may withdraw or limit your consent at any time by notifying us in writing, and we will discuss any effect on the services or fees.

Two sentences do the heaviest lifting. The due diligence line tells the client which tools they are consenting to. The withdrawal line makes the consent real rather than boilerplate.

The explainer to send existing clients

The engagement letter clause is the legal artefact. The client explainer is the plain-English version to send existing clients before their next engagement renewal.

We use carefully selected AI tools to help deliver your work faster and more accurately, for tasks like drafting documents, summarising records and preparing analysis.

Your information is only processed through tools we have vetted for security and confidentiality, under agreements that prevent your data training public AI models.

Every piece of work is reviewed by a qualified member of our team, and we remain fully responsible for everything we deliver.

If you would prefer we not use AI tools on your engagement, tell us and we will talk it through.

Send this now. Silence is not permission under Code item 6.

Meeting recordings need their own consent path

AI meeting assistants record and transcribe. That triggers a second consent question and, in some Australian states, surveillance and listening device laws that vary by jurisdiction.

Three things need to happen. The bot announces itself when it joins the call. The client is told at the top of the meeting. Recording is covered in the engagement letter clause. If one of the three is missing, the recording is on shaky ground.

Privacy Act 1988 obligations apply to the transcript once it exists. Where the transcript lives, who has access, and how long you keep it need firm answers before the tool is running at scale.

The problem the clause does not fix

A junior team member pastes a client email into a free chatbot on their phone at home. The firm's engagement letter clause does nothing to fix that. Client permission was for vetted firm tools, not personal accounts.

The clause needs a one-page AI policy sitting alongside it. The policy names the approved tools, the data those tools are cleared to touch, and the tools nobody should be using with client information. Without the policy, the clause is doing half the job.

What firms should do this week

Add the AI clause to the engagement letter template. Every new engagement letter that goes out from now on covers Code item 6 as it stands in 2026.

Send the client explainer to existing clients. Do not wait for renewal.

Write the one-page AI policy for your team. Name the approved tools. Name the disallowed ones. Circulate it.

The engagement letter clause protects the firm outward. The AI policy protects it inward. Both need to exist.