AI and the TPB Code: what tax practitioners must do

Not the best move. Many everyday tools now include AI features, often switched on by default in an update. You are responsible for tools that touch client data even if nobody chose to use AI.

Best answer. AI now arrives inside software you already use, such as meeting summaries or email drafting. The TPB's competency duty covers tools you may not realise you are using.

Not the best move. A feature can be free or bundled and still send client data somewhere. What matters is what it does with client information, not what it costs.

Best answer. The TPB Code bars sharing a client's information with a third party without permission. Recording what happened lets you assess the risk, work out what follow-up is needed and stop it happening again.

Not the best move. Free tools often keep what you enter and may use it to train their models. Sharing a client's records this way can be a disclosure to a third party without the client's permission.

Not the best move. Deleting the chat does not undo the data leaving the firm, and it leaves no record of what happened or which client was affected.

Best answer. These details answer the two questions the TPB cares about: whether client information stays private, and whether you understand the tool well enough to rely on its output.

Reasonable, but not the best. Knowing who uses a tool is useful, but it does not tell you what happens to the client data it touches.

Not the best move. Cost and renewal dates help with budgeting, but they say nothing about the client data the tool handles or where it goes.

Not the best move. A copy of the email proves you told clients, not that they agreed. Permission needs a clear yes you can point to.

Not the best move. Silence is not permission. The TPB Code bars disclosing a client's information to a third party without permission, and a non-reply does not show that the client agreed.

Best answer. You need to be able to show each client's agreement, for example through a signed engagement letter or consent form. Anyone who has not agreed is treated as not having given permission.

Not the best move. That is a sales message, and it may not hold. Clients need to understand what happens to their information before they can agree to it.

Best answer. This is what a client needs to make an informed choice about giving permission, and it is what the TPB recommends you tell them.

Reasonable, but not the best. Naming the vendor is fine, but on its own it does not tell clients what happens to their information. They need to know where it goes and where it is stored.

Best answer. Each of these leaves a record showing the client agreed, which is what you need if the client or the TPB ever asks.

Reasonable, but not the best. That would work, but it is more than you need. A clause in the engagement letter or a general authority can cover AI use without a form for every tool.

Not the best move. A website notice tells people how you work, but it does not show that a particular client agreed.

Best answer. The TPB expects a competent person to check AI output against source material using their own expertise. Without a recorded check, the firm cannot show reasonable care was taken.

Not the best move. A tool cannot vouch for its own output. The registered agent stays responsible, so a qualified person still has to check it.

Not the best move. A quick look is not a review. Reasonable care needs a competent person to check the work against the source documents and record that they did.

Not the best move. Timeliness matters for other reasons, but it does not show that anyone checked the content or what they found.

Reasonable, but not the best. Initials show who reviewed it, which is a start, but not what they checked or changed. Without that, the record cannot show the review was more than a glance.

Best answer. Kept in a file note or a sign-off on the job, a record with those three details shows a real review happened, and it can be found quickly if a client or the TPB asks.

Not the best move. Hiding AI use undermines the honesty clients expect and can damage trust if it comes out. A clear review record is the better answer.

Reasonable, but not the best. That avoids the question rather than answering it, and costs time. A watermark is not a problem when the work has been properly reviewed and recorded.

Best answer. Using AI is allowed. What matters is that a qualified person checked the work and you can show it, so there is no reason to hide that AI was involved.

Best answer. Writing the ban into a policy, and checking it is followed, turns it into a rule staff can follow and you can show the TPB.

Not the best move. AI features are built into many everyday tools, so a ban only means something if it is written down and checked. Otherwise you cannot show it is being followed.

Not the best move. By the time someone asks, it is too late to show the rule was in place. The policy belongs in your quality management system from the start.

Best answer. The TPB rules expect you to document how you manage the quality of your work. Filing the AI policy there makes it part of that system, not a stand-alone document.

Not the best move. Engagement letters carry the client-facing AI clause. The policy is an internal rulebook and belongs with your other quality procedures.

Reasonable, but not the best. Easy access matters, but the policy also needs to sit inside your quality management system, so it is reviewed and enforced like your other procedures.

Not the best move. A draft nobody has seen does not change how people work. The policy needs to reach the team now, with a review date set.

Best answer. Training makes sure people understand it, signatures show they have agreed to follow it, and a review date keeps it current as tools change.

Reasonable, but not the best. Sharing it is a start, but nobody has been trained on it or agreed to follow it. Training and signatures show the team knows the rules.

Best answer. Testing a real file against the clock, say within an hour, shows whether the records exist where they should. Anything you cannot find quickly is the gap to fix next.

Not the best move. By then it is too late to fix gaps, and records made after the fact carry little weight. Checking one file now shows what is missing while you can still fix it.

Not the best move. A policy shows what should happen, not what did. Only the records on real client files show the rules are being followed.

Not the best move. The reported changes include penalties for breaching the Code, so it is worth knowing where things stand now rather than after a problem.

Best answer. The TPB publishes updates on changes to its powers and when they start, so it is the reliable place to confirm what applies now.

Not the best move. Forum posts can be out of date or wrong. The status of new legislation should come from an official source.

Not the best move. AI tools change month to month, so a policy left for years soon stops describing what the firm actually does.

Reasonable, but not the best. New guidance is a good reason to review, but tools change faster than guidance does. A yearly review and a check whenever you add a tool catch the rest.

Best answer. AI tools and the rules around them change often. A set yearly date plus those two triggers keeps the policy matching how the firm really works.