AI is now a Code obligation for every tax practitioner

On 22 July 2026, the Tax Practitioners Board issued its final guidance on AI use in the provision of tax agent services. TPB(GS) 55/2026 confirms what practitioners with any real AI use in their firms have been quietly working around for the last twelve months. AI use is not exempt from the Code of Professional Conduct. Competency, confidentiality, reasonable care and record-keeping all apply.

The guidance was released as an exposure draft in March, ran a submission period through April, and is now final. It carries clear direction: existing Code obligations attach to AI use, and the practitioner remains accountable for anything the AI touches.

The TPB’s framing is that AI tools, used appropriately, deliver real productivity gains for practitioners, clients and the profession. That framing matters, because it removes the “we’re waiting to see what the regulator does” excuse a lot of firms have been sitting on. The regulator has moved.

What the guidance requires is that when AI is being used in a tax agent service, the practitioner is still responsible for the output. AI cannot be treated as a black box. Practitioners must understand what the tool does and where it fails. They must review its output. They must document how it is being used. And they must comply with existing confidentiality and privacy obligations in the process.

Nothing about this is novel. What is novel is the TPB writing it down.

The competency thread runs through Code items 7, 8, 9 and 10, and sections 30, 35 and 40 of the Determination. Practitioners must provide services competently, maintain relevant knowledge and skills, take reasonable care in ascertaining a client’s affairs, apply the tax law correctly, keep proper records, supervise anyone providing services on their behalf, and maintain a documented system of quality management.

Applied to AI, this cashes out as several practical requirements.

Practitioners must exercise their own professional judgement when advising clients. AI output cannot be used as a substitute for the practitioner’s own analysis. Large language models can hallucinate, produce biased output, and confidently state things that are wrong. The Code obligation to take reasonable care assumes a competent and reasonable person would verify AI output against source material and their own expertise, and would document that review.

Practitioners must also understand the limits of the tool they are using. Using an AI feature embedded in third-party software without understanding what it does, where its outputs come from, or what data it processes falls short of the competency standard. That understanding is not optional.

Code item 6 requires that a practitioner does not disclose information about a client’s affairs to a third party without the client’s permission, unless there is a legal duty to do so. The TPB’s guidance now clarifies that entering client information into an AI model can constitute disclosure to a third party, depending on how the tool is configured and used.

That is the sentence in the guidance most firms need to re-read.

If your team is pasting a client’s XPM data, a bank statement or a working paper into a generic AI chatbot without the client’s permission, that is a Code item 6 problem. It sits inside the same rules as outsourcing and offshoring, and it needs the same treatment: an informed client, a written record of permission, and clarity on where the data goes.

The guidance recommends practitioners inform the client about the proposed disclosure. Who it is being disclosed to. Where the data is being stored. Whether AI tools may be used. Client permission can be granted through a signed letter of engagement, signed consent, or a general authority consenting to third party disclosure. What matters is that the permission exists and is documented.

Three practical steps to work through now.

The first is an audit of the AI tools already in use across the practice. Every AI feature in your practice management software. Every generic tool a team member is using on the side. Every embedded assistant in your file storage. Map them, and understand what data they touch. The competency obligation applies to tools you do not know you are using as much as tools you have deliberately deployed.

The second is engagement letter and consent review. If your current engagement letters do not cover AI use and third party disclosure, they need updating before the next engagement cycle. This is the cheapest and clearest way to bring existing clients inside the confidentiality obligation as it now sits.

The third is a documented review process. Whatever AI is being used, there needs to be a step where a qualified human reviews the output, applies judgement, and signs off. That review needs to be recorded. Without that record, the practitioner has a supervision and quality management issue under section 35 and section 40 of the Determination, and no evidence that reasonable care was taken.

The TPB has now issued formal guidance on AI use, in line with the Australian Government’s National AI Plan and the OECD’s definition of AI systems. That places the profession alongside the broader regulatory trend toward making organisations responsible for AI harms and requiring documented governance. Chartered Accountants Australia and New Zealand, CPA Australia and IPA members are already covered by APES 110 revisions on technology use. The TPB guidance sits alongside that.

Practitioners who have been waiting for regulatory clarity before deploying AI now have it. Practitioners who have deployed AI without documented review, informed client consent and a clear understanding of the tools’ limits are now operating against a documented Code standard.

The regulator has made its position clear. The next move belongs to the profession.