Client consent for AI: what to tell clients, when to ask, and the letter to send

Somewhere in your firm right now, someone is pasting client information into an AI tool. The question is whether your clients know, whether they have agreed, and whether the law where you practise requires more than a privacy policy nobody reads.

The answer splits by jurisdiction, so this article covers the US, Australia, the UK and Canada, then gives you wording to adapt today. One caveat: this is general information, not legal advice, so check with your professional body or a lawyer before relying on it.

The short version: required vs good practice

• Consent is legally required when a statute says so, most clearly for US tax return preparers under IRC section 7216, a criminal provision.
• Consent is effectively required when your professional code prohibits disclosing client information to third parties without permission. Australia's TPB Code item 6 works this way, as do ICAEW and provincial CPA confidentiality rules.
• Disclosure is good practice everywhere else. Telling clients costs a paragraph; not telling them costs the relationship.

The distinction most firms miss: disclosure is telling clients you use AI, consent is them agreeing to it. Some regimes need both, in a specific form.

United States: section 7216 is the one that can actually hurt you

If your firm prepares US tax returns, read this twice. IRC section 7216 makes it a criminal offence for a tax return preparer to knowingly or recklessly disclose or use tax return information, punishable by a fine of up to $1,000 and up to a year in prison per violation, with a parallel civil penalty under section 6713.

The regulations define disclosure broadly: Treasury Regulation 301.7216-1(b)(5) captures making tax return information known to another person in any manner whatever, so a prompt paste, upload or API call looks like a disclosure to the tool's operator. Whether an exception under 301.7216-2 covers your tool depends on the contract and where the data goes; plenty of practitioners argue consumer chatbots are unlikely to qualify, so treat any vendor who says otherwise as a salesperson, not counsel.

Where consent is needed, section 301.7216-3 sets a high bar: knowing, voluntary, written consent before the disclosure, following the format and mandatory language of Revenue Procedure 2013-14 for individual returns, and identifying who receives the information. "AI tools we may use from time to time" does not meet that standard, and neither does a general engagement letter clause. You likely need a separate consent document; the AICPA publishes sample consent forms, and the IRS runs a section 7216 information center. The wider US rulebook, including the IRS's June 2026 Circular 230 alert on AI, is mapped in AI and the IRS rules.

Australia: Code item 6 plus a fresh TPB draft

Australian tax and BAS agents work under the Code of Professional Conduct in the Tax Agent Services Act 2009. Code item 6 says you must not disclose information relating to a client's affairs to a third party without the client's permission, and TPB guidance notes that permission can come via a signed engagement letter, signed consent or other communication.

The TPB addressed AI directly in March 2026 with an exposure draft information sheet, TPB(I) D62/2026. The draft is clear: AI does not reduce or transfer your professional responsibility for the work, and you should vet commercial AI tools so client information stays secure and Privacy Act 1988 requirements are met. As at July 2026 it is still a draft, but the direction is unmistakable.

United Kingdom: no AI statute, but ICAEW has done the drafting for you

UK firms have no single AI consent law, just the familiar pairing of professional confidentiality obligations and UK GDPR. Confidentiality means client information does not go to third parties without the client being told; UK GDPR adds lawful basis, transparency about processors and care with international transfers. GDPR consent is only one lawful basis among several, and often not the best one: many firms frame routine AI-assisted processing as legitimate interests plus clear disclosure.

The useful development: ICAEW has updated its engagement letter guidance to address AI directly, covering whether AI tools will be used in delivering the service, their limitations, and responsibilities for data protection, confidentiality and due diligence on providers. Start from their sample wordings.

Canada: PIPEDA's "new use" problem

Canadian CPAs answer to their provincial CPA code of conduct on confidentiality and to PIPEDA (or a provincial equivalent) on personal information. PIPEDA creates the specific trap: organisations must limit personal information to the purpose identified at collection and obtain consent before any new use. Client data collected to prepare financial statements was not collected to be processed by a third-party AI vendor, so running it through one is arguably a new use needing fresh, meaningful consent. Profession-wide AI rules are still thin in Canada as at July 2026, so the safe reading is: name AI in your engagement letter, vet where the data goes, and get explicit agreement before client-identifiable information touches a third-party tool.

The comparison, side by side

Jurisdiction	Main rules	Consent legally required?	Engagement letter enough?
US	IRC s7216 and s6713, Treasury Regs 301.7216	Yes, for tax return information, unless an exception applies	No. Needs its own written consent with mandatory Rev. Proc. 2013-14 language, before disclosure
Australia	TPB Code item 6, draft TPB(I) D62/2026, Privacy Act 1988	Yes, before disclosing client affairs to third parties	Largely yes. TPB accepts a signed engagement letter, but be specific
UK	Professional codes (ICAEW and others), UK GDPR	Not always. GDPR consent is one lawful basis among several	Mostly yes. ICAEW's updated wordings cover AI use directly
Canada	Provincial CPA codes, PIPEDA and provincial privacy laws	Effectively yes for personal information put to a new use	Mostly yes, if the clause makes consent meaningful

The pattern: Australia, the UK and Canada let a well-drafted engagement letter do most of the work. The US does not, for tax return information. Build your process around the strictest regime you touch.

What to actually tell clients

Clients want to know three things: what you use AI for, whether their data is safe, and whether a human is still responsible. This client-facing explainer is a starting point, not legal drafting: tailor it to your tools and have it reviewed.

We use carefully selected AI tools to help deliver your work faster and more accurately, for tasks like drafting documents, summarising records and preparing analysis. Your information is only processed through tools we have vetted for security and confidentiality, under agreements that prevent your data training public AI models. Every piece of work is reviewed by a qualified member of our team, and we remain fully responsible for everything we deliver. If you would prefer we not use AI tools on your engagement, tell us and we will talk it through.

The engagement letter clause

An adaptable clause for the engagement letter or terms of business, again a starting point: adapt it to your jurisdiction and professional body's model wording, and get it reviewed before it goes out.

Use of technology and artificial intelligence. In delivering our services we may use software tools, including artificial intelligence tools, to assist with tasks such as document drafting, data analysis, transcription and research. We conduct due diligence on the providers of these tools and only use tools whose terms provide appropriate confidentiality and data protection safeguards for your information. All work produced with the assistance of these tools is reviewed by our professional staff, and responsibility for the services we provide remains with us at all times. By signing this letter you consent to our use of such tools on your engagement, including processing of your information by their providers under the safeguards above. Where specific legislation requires separate consent for particular disclosures, we will ask for that consent separately. You may withdraw or limit your consent at any time by notifying us in writing, and we will discuss any effect on the services or fees.

The last two sentences matter most: the separate-consent line keeps a US firm honest about section 7216, and the withdrawal line makes the consent real rather than boilerplate.

Two edge cases worth handling now

Meeting recordings. AI meeting assistants record and transcribe, which triggers its own consent question, and in some places recording laws. Make the bot announce itself, tell clients at the top of the call, and cover recording in the engagement letter. We compared options in our guide to the best AI meeting assistants for accounting firms; tools like Vinyl, built for accountants, are designed around exactly this disclosure problem (Vinyl is a commercial partner of The Firm).

Staff freelancing. A perfect engagement letter does nothing if a junior pastes a client email thread into a free chatbot on their phone. The clause belongs alongside a one-page AI policy naming the approved tools; our breakdown of whether AI is safe for client data covers vetting them, and the wider picture lives in our AI for accounting firms pillar.

The verdict: get the clause into your next engagement letter cycle, send the explainer before someone asks, and if you prepare US returns, build the section 7216 consent into onboarding this quarter.

Frequently asked questions

Do I need to redo consent every time I add a new AI tool?

Not if your clause consents to a category of vetted tools rather than naming products. But a tool that materially changes what happens to client data is a new conversation, and US section 7216 consents must identify the recipient, so a new recipient means a new consent.

What about clients who signed engagement letters before we started using AI?

Send the explainer now and add the clause at the next renewal. For anything consent-critical in the meantime, like US tax return information, get a standalone consent or keep that client's data out of third-party tools. Silence is not consent anywhere.

Does using AI inside Microsoft 365 or my practice management system count as disclosure?

It is different from a consumer chatbot: the data typically stays within an environment your firm already contracts for. Whether it counts as disclosure for a rule like section 7216 depends on the data flows, so check the vendor's terms, including whether a no-training commitment is in writing.

Can a client refuse AI use entirely, and do I have to accept that?

They can refuse, and you then choose: serve them without AI, adjust the fee for the extra manual work, or decline the engagement. What you cannot do is agree to a no-AI condition and quietly use the tools anyway.

Who enforces this, and what actually happens to firms that get it wrong?

In the US, section 7216 is criminal, with the civil section 6713 penalty the more likely first stop. In Australia the TPB can sanction up to termination of registration; in the UK and Canada, expect professional body discipline plus privacy regulator action. Everywhere, the reputational damage from undisclosed AI use arrives faster than the regulator.