Your professional liability renewal is coming. Somewhere between the revenue figures and the claims history may be a question you have not answered: does the firm have a written AI policy?
At a 5 to 50 person CPA firm, the answer is often “everyone uses something, and nobody wrote it down.”
The short answer
A written AI policy is a one-page document that names the AI tools your firm allows, the client data staff may put into them, and how a person checks the output. Three groups now expect a CPA firm to have one. CNA, the underwriter behind the AICPA's professional liability program, says clients will ask how you use AI. The IRS's June 2026 alert from its Office of Professional Responsibility tells firms to adopt AI procedures under Circular 230 and keep a record of them, covering staff training, secure handling of client data and the vetting of outside AI tools. Clients want to know where their data goes and who can see it. A single page, paired with a checklist for vetting AI vendors, answers all three. Write it before your renewal, and update it whenever your tools change.
CNA has been the exclusive accountants professional liability underwriter for the AICPA since 1993. Its risk control team includes CPAs with public accounting experience, and its consultants have written and spoken about AI for the Journal of Accountancy since 2025. In July 2026 the journal ran a Professional Liability Spotlight column titled Drafting an AI Policy That Actually Works. Its author, Nicole L. Graham, is a risk consultant at Aon, the managing general underwriter CNA works through on the program.
Underwriters tend to ask about what their risk team writes about. If the question comes at renewal, in a risk-control call, or in your broker’s checklist, you want an answer on one page rather than an improvised one.
In a July 2026 JofA podcast, Sarah Ference, a CPA and risk control director at CNA, discussed that column and why accounting firms need an AI policy. She said clients are likely to ask how you use AI in your practice, and that having an answer ready to share is good practice.
That puts the exposure on the client relationship. The column behind the episode explains why. Generative AI can be confidently wrong, and if unchecked output reaches a client, the client will come after the firm, not the tool. The signing CPA stays responsible for accuracy, and blaming the software is not an option.
The column also recommends a documentation habit worth copying. Record the prompts used, how the output was verified, and who reviewed it. As the column puts it, work that is not documented did not happen. Its closing sidebar notes that only 16% of firms in the 2025 PCPS MAP Survey described themselves as very confident in their ability to adapt to AI over the next three years. Most firms in your peer group are still working this out.
CNA’s J. Michael Reese listed the questions clients may ask in an April 2025 column. Put the same questions to every AI vendor before you buy, along with three contract points he recommends.
Ask before you buy
What clients ask you, and you ask every AI vendor
1 to 6 are the client questions; 7 to 9 are the contract points Reese recommends. Get the answers in writing.
Reese also notes that no federal law or professional standard applicable to CPAs currently requires you to disclose AI use. Some states, including California and Utah, have enacted laws requiring some level of disclosure. Separately, the FTC’s Safeguards Rule treats CPA firms as financial institutions that must protect client information, including what their service providers hold.
The liability angle is where firms get caught. Reese warns that overreliance on AI output, combined with silence about its use, can appear to a client as deception after a loss. A plaintiff can then argue the firm lacked competence or misrepresented its services. A firm that cannot say what tools touch client data has a liability problem.
Before anyone pastes in a return
Uploading client tax return information to an unsecured or public AI tool can bring civil and criminal penalties.
The IRS Office of Professional Responsibility says so in its June 2026 alert (OPR Alert 2026-19): IRC sections 6713 and 7216 apply, and so does Circular 230 discipline. It is the same data question your clients ask, asked by the regulator.
A short written AI policy, paired with a vendor-vetting checklist.
Start with the IRS, because it is the one demand that already carries the force of a rule. Circular 230 section 10.36 requires the people who run a firm’s tax practice to take reasonable steps to ensure the firm has adequate compliance procedures. The OPR alert states that firms must implement internal policies and procedures to comply with Circular 230 in the AI space. It names three coverage areas: staff training, internal protocols for secure data handling and accuracy monitoring, and vetting of outsourced or third-party AI tools. It adds that all steps should be documented to show adherence to section 10.36.
The vendor side has its own resource. CPA.com’s AI solution due diligence guide, launched at the Digital CPA conference in 2025, provides firms with a framework for evaluating AI providers. A Virginia Society of CPAs write-up of the guide stresses that diligence should scale with risk, not with firm size, so a tool that drafts internal memos needs far less scrutiny than one that ingests tax returns.
The one-page policy
Six lines a firm your size writes down
Plain sentences, one page. The IRS side of it is in our post on the OPR guidelines.
One caution on billing. The OPR alert says AI efficiencies should be passed on to clients, and the AICPA has asked the IRS for clarification, arguing the language ignores value pricing and the cost of implementing and governing AI. That dispute is unresolved, so have counsel review how your policy describes pricing.
Written once and kept current, the same page answers the underwriter’s risk question, satisfies the procedures duty, and gives you a ready reply when a client asks how you use AI. Put it in front of your broker before renewal rather than after.
Not under federal law or a professional standard for CPAs, according to CNA's Reese. California and Utah are among the states that have passed disclosure laws of their own. And silence carries its own risk: if AI-assisted work goes wrong, a client can read it as deception.
Does Circular 230 require a written AI policy?Section 10.36 makes the people who oversee a firm's tax practice responsible for its compliance procedures. The June 2026 OPR alert applies that duty to AI and asks firms to document each step. A short written policy is the plainest way to show you have done it.
Can staff put client tax data into a public AI tool?The OPR alert warns against it, citing penalties under sections 6713 and 7216 for client return information placed in an unsecured or public system. Your policy should name the approved tools and the data each one may receive.
For CPA firms
Write your AI policy with PK Tech
PK Tech has worked with CPA firms as a managed IT provider for nearly 17 years, and holds AICPA SOC 2 Type II attestation from an independent audit. We can list the AI tools your staff already use, vet the vendors with you, and have the page ready for your broker.
Schedule a call with Jordan →