Client Data and AI: What Your Firm Owes, and What AI Vendors Actually Promise

As of 21 October 2026. Every rule and vendor term below was checked against its primary source on that date. Each citation gives the source's own date: when it was issued, took effect or was last updated. Guidance and vendor terms change, so treat anything here as current only as of the date shown, and check the source before you rely on it.

Most accountants I talk to are not against using AI. They are worried about one thing: what happens to a client's data once it goes in. Most of the answers they hear are half right.

This guide goes back to the primary texts: the statute, the regulations, the FTC rule, the IRS's own words, the AICPA Code, and each vendor's terms. It is for every kind of practice, not only tax: which rules apply depends on the work. The main text is short. Each section has a "Read more" with the exceptions and the exact wording. I am not a lawyer and this is not legal advice; where something is my reading rather than the text, I say so.

The short version

Put client data on a business plan, not a personal one. On personal plans, paid ones included (ChatGPT Plus or Pro, Claude Pro or Max, Google AI Pro or Ultra, Perplexity Pro or Max), conversations can be used for training unless the user turns that off. Turning it off helps, but it is one person's setting under consumer terms, not a promise to your firm. Personal plans are fine for work with no client or confidential firm information. If client data has already gone into one, turn training off and delete those chats; that stops future use, not training already done.
Business plans promise no training, in the contract. That settles training only, not how long data is kept, where it is processed, or §7216.
If you prepare income tax returns, §7216 is the hard question, and the IRS hasn't answered it. Inside the US, the main recipients who can get return information without the client's consent are your own staff, another preparer helping with the return, and contractors for the software you use to prepare returns. A general AI vendor fits none of these cleanly. There are workable answers: a valid, voluntary consent that names the AI vendor settles it for that client, and AI built into your tax software is the strongest no-consent case (see the paths below). Disclosure outside the US always needs consent, and someone abroad who can view the data counts. Bookkeeping, payroll and advisory work that isn't tied to a return is generally outside §7216. Many practitioners treat AI on a business plan like the email and cloud software they already use, which raises the same question (see "A practitioner's view").
US-only processing is a top-tier option, and it doesn't settle §7216 on its own. It keeps return information out of the outside-the-US rule; it doesn't make the vendor a permitted recipient. The plans most small firms buy (ChatGPT Business, Claude Team, Microsoft Copilot) can't keep processing in the US today.
AICPA members have a second rule, for every client. Before sharing client information with an AI vendor, the Code expects either the client's consent, or a confidentiality contract with the vendor plus reasonable assurance about its safeguards, and a notice to clients that you use outside providers. The Code doesn't bind non-members such as most enrolled agents and many bookkeepers. Circular 230 binds everyone who practises before the IRS.
The IRS's guidance on AI is short: use only "secure, enterprise-approved AI", vet third-party tools, and review all AI output before it goes to a client.
If you hold information about individual clients, the FTC Safeguards Rule probably applies, and your WISP is where it all lands. An AI vendor that receives that information is a service provider you must vet, bind by contract and oversee.

What applies to your work

The rules follow the work, not the job title. Many firms do several kinds of work; apply each rule to the data from the work it covers.

Tax return preparation. §7216 for anything furnished to prepare a federal income tax return, business or individual. The Safeguards Rule for information about individual clients. The AICPA Code and its tax standards if you're a member, NAEA's Code of Ethics if you belong to NAEA, and Circular 230 if you practise before the IRS.
Bookkeeping, payroll and advisory, with no return preparation. §7216 generally doesn't reach you. Its regulations say that someone who only furnishes information to a preparer at the client's request, or whose work "only incidentally relates to the preparation of tax returns", is not a preparer. That changes if you help prepare the return or receive return information. The Safeguards Rule protects information about consumers: individuals using a service for personal, family or household purposes. My reading is that work for businesses mostly falls outside it, but advisory work for individuals can bring you in, since the rule lists "financial and investment advisory services". The AICPA Code applies if you're a member.
Audit and attest. §7216 and the Safeguards Rule generally don't reach the audit data itself. The AICPA Code does, and so does your quality management system: record each AI tool's approval there.
Firms that do several. Return information keeps its §7216 status wherever it goes in the firm. If a client's books feed its return, treat what you use for the return as covered.

Whatever the work, state privacy, breach-notice and accountancy-board rules may still apply, and so do your engagement letters and client contracts. State rules vary and aren't covered here.

Choose your path

There is more than one right way to use AI with client data. Pick the path that fits each kind of work; many firms will use more than one.

Two points firms often get wrong.
SOC 2 is not mandatory under the AICPA Code. The Code offers two routes: the client's consent, which needs no vendor assurance at all, or a confidentiality contract with "reasonable assurance", which "depends on the facts and circumstances". A SOC 2 report is one way to get that assurance; it isn't the only one.
A valid consent that names the AI vendor satisfies §7216. It must be voluntary (the client can say no) and signed before the data goes out. It does not replace the Safeguards Rule: you still vet the vendor, bind it by contract and list it in your WISP.

1. Build consent into your client documents. Add an AI consent to onboarding that names the AI vendor and what you'll use it for. For 1040 clients, that is a §7216 consent in the IRS's required format, as its own document, which you can attach to the engagement letter. For business returns and for non-tax work, it can be a clause in the engagement letter. It settles §7216 for that client, and for AICPA members it is also the Code's consent route and the client notice, so the Code needs no further vendor assurance. The client must be free to say no; for those who do, work without that tool.
2. Use AI built into your tax software. An AI feature inside the US software you use to prepare returns is the strongest case for not needing a §7216 consent, through the rule for software contractors. That rule fits your tax software vendor; it is less clear for the AI model provider the vendor uses behind the feature, so ask (question 5). Check that your vendor agreement covers the AI feature, and give the written §7216 notice (question 11).
3. Rely on the vendor contract, for work outside §7216. For bookkeeping, advisory and audit data that isn't used for a return, §7216 doesn't apply. AICPA members can use the Code's contract route: confidentiality terms plus reasonable assurance, which can come from the vendor's published security information. On a strict reading it doesn't cover return information: the exception that lets CPA firms use it for other services never allows disclosure outside the firm. Many practitioners treat AI like the email and cloud software they already use; see "A practitioner's view" below.
4. Keep client data out. Drafting, research, templates and training don't need client data at all. Removing names is not enough for return information, though: the regulations count even a statistical compilation that can't be tied to any client.

Whichever path you take: use a business plan with firm accounts, configure it before anyone uses it (MFA, training and feedback off), list it in your WISP as a service provider you've vetted, and have a person review AI output before it goes to a client.

Read more: what an AI consent needs to say

Name the vendor. A §7216 consent must "identify the specific recipient (or recipients)": the AI vendor by name, and the product if it helps. Business consents may instead name a "descriptive class", but only of firms the client itself engages for its returns or audited financial statements, not a vendor your firm chooses. Adding a new AI vendor means updating the consent.
Say what for: the purpose, and which information will be shared.
Get it first: signed and dated by the client before the data goes to the vendor. It lasts one year unless it says otherwise. Give the client a copy.
Keep it optional: it must be knowing and voluntary, so you can't make your services conditional on it. The one exception, a consent to share with another preparer who helps prepare the return, uses different mandatory wording and isn't the one for an AI vendor.
For 1040-series clients, use the IRS format. Revenue Procedure 2013-14 (effective 14 January 2013) sets it: a separate document, which "may be provided as an attachment to an engagement letter"; on paper, at least 12-point type; mandatory statements in a fixed order; opt-in only. Several disclosures can share one form, each selected separately, but "disclosure consents and use consents must be provided in separate documents."
If the vendor may process or view data abroad: the IRS's wording for disclosure to a preparer outside the US is "This consent to disclose may result in your tax return information being disclosed to a tax return preparer located outside the United States." My reading is that a consent naming an AI vendor that may do so should include it. For 1040-series returns, the Social Security number has to be masked unless both firms keep an adequate data-protection safeguard and the consent says so.
For business clients: any format, including the engagement letter, as long as it has the required content.
For non-tax work (AICPA members): the Code asks for the client's "specific consent", in no set format. An engagement-letter clause that names the tool and its purpose serves, and also gives the client notice that you use an outside provider.
Not the whole job: consent covers §7216 and the Code, but not the Safeguards Rule. You still pick a capable vendor, bind it by contract and list it in your WISP. Nothing in that rule requires a SOC 2 report.

A practitioner's view: is AI any different from Outlook?

Everything above is what the texts say. Firms also have to work with them day to day. On 21 October 2026, Jason Staats (@jasononfirms), who writes about and runs events for accounting firm owners, put the pragmatic case on X. A strict reading of §7216, he points out, requires consent for "any non tax-prep app that tax info touches": not only Claude, but Zoom, your practice management software, Microsoft 365, Google Sheets, even iMessage when a client texts you something. Firms don't collect consents for those. So he asks one question:

"is tax return info touching Claude any different from tax return info touching Microsoft Outlook?"

His answer is no, as long as your prompts aren't used for training, which means a business plan. He would probably not collect AI consents to be safe, either: each client has to be able to opt in or out of each app, which becomes "a real mess of who opted in to what", and you would still have to explain why AI is in and Outlook is out.

Read more: where the comparison holds, and where AI is different

It holds on §7216. The regulations have no exception for general cloud software, email included. If sending return information to an AI vendor needs consent, then, read strictly, so does sending it to your email or file host. No court and no IRS guidance has tested either.
It is a judgement about risk, not a safe harbour. It doesn't make the disclosure permitted. It says the risk is the one firms already accept with their email and cloud software. The IRS could still apply the regulation as written, and to both.
Disclosure abroad still needs consent. Who at the vendor can view your data, and where, differs by vendor and plan; check it (questions 3 and 4).
AICPA members owe a notice that email doesn't need. The Code exempts "administrative support services" such as "record storage" and "software application hosting" from the duty to tell clients. An AI tool that helps do the work is not that, so tell clients, for example with a general line in the engagement letter (1.150.040).
You review the output. Email doesn't draft advice; AI does. OPR's guidance says to review all AI output before it reaches a client or the IRS.
His full rule-by-rule tables are transcribed in the appendix at the end, with notes where his wording differs from the sources. None of those differences changes his argument.
If you take this route, it is the "Whichever path you take" basics applied to return information: business plan, training off, a vendor contract, the tool in your WISP, the client notice, and human review. Record the reasoning in your WISP, so it is a decision rather than an oversight.

The rules

Section 7216: who may see return information

If your firm prepares income tax returns, section 7216 of the Internal Revenue Code (last amended 1 July 2019) and its regulations (issued January 2008, last amended December 2012) govern what you may do with tax return information. It covers anything furnished to you to prepare a federal income tax return, for individual and business clients alike, and anything you derive from it. Only the uses and disclosures the regulations list are allowed without the client's consent. For everything else you need a signed, dated consent before you disclose. The IRS has not said whether sending return information to an AI tool is a disclosure that needs consent. If you only keep books, run payroll or advise, it generally doesn't reach you.

Read more: what §7216 covers, and what it doesn't

Which returns: federal income tax returns, "any return (or amended return) of income tax imposed by chapter 1", for individual and business clients. The consent rules add requirements for 1040-series filers, which include sole proprietors, but business returns are covered too.
What a disclosure is: "the act of making tax return information known to any person in any manner whatever". The definition doesn't distinguish an AI tool from email or file storage.
Which information: anything "furnished in any form or manner for, or in connection with, the preparation of" that return, by the client or a third party, plus anything you derive from it, including IRS acknowledgments.
The "but for" test: information counts if the client would not have given it to you but for the return engagement. My reading: books you keep under a separate bookkeeping engagement are generally not tax return information until you use them for the return; the tax workpapers are. If you do both for a client, treating the bookkeeping data as covered is the safe course.
Who isn't a preparer: someone who only "furnishes information to a tax return preparer at the taxpayer's request", or "performs some service that only incidentally relates to the preparation of tax returns".
State returns: using the information to prepare the client's state and local returns needs no consent. Disclosing it for them follows the same rules as for the federal return.
Outside it: information you hold only for other federal taxes (payroll, estate and gift) or only for non-tax work. That data is not unregulated: the Safeguards Rule, the AICPA Code, your state board and state privacy law may still apply.

Read more: who can receive it without consent, and where AI fits

Inside the United States, the main recipients who don't need consent are:

your own staff;
another preparer in the US helping with the return, as long as it makes no "substantive determinations" (interpreting or applying the law for the return);
a contractor for the "programming, maintenance, repair, testing, or procurement of equipment or software" used to prepare returns, only "to the extent necessary", and only if everyone there who receives the information gets written notice of the rules and penalties. That contractor is itself treated as a tax return preparer.

Where an AI vendor fits is unsettled. An AI feature inside your US tax software is the strongest case for the contractor route. A general-purpose AI vendor is a weaker fit for all three. If it counts as "another preparer", asking it to apply the law to a client's facts looks like a substantive determination, which needs consent even inside the US. The regulations don't say.

Outside the United States, you need consent, even within your own firm. "The taxpayer's consent under § 301.7216-3 prior to any disclosure is required." The regulations' own example covers a contractor's employee abroad who can only view data held on a US server, with downloading and printing blocked: that is still "disclosing T's tax return information outside of the United States." So someone abroad who can view the data counts; ask who at the vendor (support, safety review, contractors) can see it, and where they are. Whether a vendor's automated processing abroad counts is unsettled; a consent covers it either way. The reverse case is exempt: if the client first gave the information to a preparer outside the US, that preparer needs no consent to use it.

Read more: other uses, and the exception for CPA and law firms

Consent needed: marketing products other than tax preparation, refund-related bank products and financial products. Using a client list to offer more tax preparation services does not need it.
The exception: a preparer "lawfully engaged in the practice of law or accountancy" may use the information within the firm "for the purpose of providing other legal or accounting services to the taxpayer", consistent with its legal and ethical duties. So a CPA firm that prepared a client's return can add a planning engagement without a consent.
It stops at the firm's door: "In no event, however, may the tax return information be disclosed to a person who is not an officer, employee or member of the law or accounting firm", unless another exception applies. So it doesn't cover sending the information to an AI vendor.
Not covered by it: related or affiliated firms, such as a sister wealth-management firm. The regulations don't say whether an enrolled agent's practice counts as "accountancy", and financial planning is a grey area. If either applies to you, get the consent.

Read more: penalties, and what "knowingly" means here

The crime: a disclosure or use made "knowingly or recklessly" is a misdemeanour, with up to a year in prison. The statute's fine is up to $1,000 ($100,000 in identity-theft cases), but the general federal fine statute lets a court impose up to $100,000 on an individual and $200,000 on an organisation for this class of offence.
The open question is not intent. Uploading is deliberate. The question is whether sending return information to the vendor is a disclosure that an exception covers. If none does, routinely uploading it is a knowing disclosure, whatever the plan's training setting. No court has applied this to AI.
An honest, non-reckless slip (the wrong file, the wrong recipient) is not that crime. It can still bring the civil penalty under section 6713, which states no mental state: $250 per disclosure or use, up to $10,000 a calendar year ($1,000 and $50,000 in identity-theft cases). It can also be a breach of your Code, your state board's rules, client contracts and state breach-notice laws.

The FTC Safeguards Rule and your WISP

Under the FTC's Safeguards Rule (16 CFR Part 314, last amended 13 November 2023; text current as of 19 October 2026), "an accountant or other tax preparation service that is in the business of completing income tax returns" is a financial institution, and so is a firm providing financial and investment advisory services. It must keep a written information security program, which the IRS calls a WISP and publishes a template for (Publication 5708, Rev. 8-2024). The rule protects information about consumers (individuals using your services for personal, family or household purposes), so individual tax clients are covered. If you hold that information, an AI vendor that receives or can access it is a service provider. For AI, the rule means MFA, access controls, logging, encryption, a retention and disposal schedule, vendor contracts and oversight, and notice to the FTC within 30 days of a breach affecting 500 or more consumers. A breach at the vendor counts as yours. Small firms are exempt from some paperwork, not from these.

Read more: the requirements in detail

Access control: "authenticate and permit access only to authorized users".
Multi-factor authentication "for any individual accessing any information system", unless your Qualified Individual (the person you designate to oversee your security program) approves an equivalent control in writing.
Logging: "monitor and log the activity of authorized users". IRS Publication 4557 (Rev. 6-2024) recommends audit trails that record all activity. On many AI plans, audit logs are a top-tier feature, so check yours.
Encryption of customer information in transit and at rest.
Disposal: no later than two years after the information was last used, unless it is needed for business purposes or must be kept by law (audit documentation and state-board retention rules, for example). A vendor that keeps your prompts and files is holding it for you, so its retention belongs in your schedule.
Service providers: choose ones capable of protecting the data, and reassess them periodically, based on the risk. The rule lists "Requiring your service providers by contract to implement and maintain such safeguards", so a vendor's published policy alone isn't enough.
FTC notice: "as soon as possible, and no later than 30 days after discovery" when unencrypted information about 500 or more consumers was acquired without authorisation. Unauthorised access counts as acquisition unless you have reliable evidence otherwise. You are treated as knowing once any employee, officer "or other agent" knows; whether a vendor counts as your agent is unsettled, so put a short notice deadline in the contract. State breach laws, which often require telling clients, are separate.
Small firms: a firm that keeps information on fewer than 5,000 consumers is exempt from the written risk assessment (you still assess risk), continuous monitoring or annual penetration testing and six-monthly vulnerability scans, the written incident response plan, and the annual report to the board. It is not exempt from MFA, logging, encryption or vendor oversight.
If you e-file individual returns: Publication 1345 (Rev. 12-2025) requires Authorized IRS e-file Providers to "report security incidents to the IRS as soon as possible but not later than the next business day after confirmation of the incident". A breach at your AI vendor can start that clock, so the vendor's notice deadline (question 10) matters here too.
Theft: if client data is stolen or lost, the IRS asks you to report it immediately to your local IRS Stakeholder Liaison.

If you're an AICPA member: the Code

The Code of Professional Conduct (updated through September 2026) covers every client, including audit, bookkeeping and advisory clients that §7216 and the Safeguards Rule don't reach:

"A member in public practice shall not disclose any confidential client information without the specific consent of the client."

Before giving client information to a third-party service provider, which in my reading includes an AI vendor, the Code expects a confidentiality contract with "reasonable assurance" about the provider's procedures, or the client's specific consent. It also expects you to tell clients, preferably in writing, that you use outside providers. The two routes are alternatives: with the client's consent, you don't need the contract route. On the contract route, a no-training clause isn't enough on its own, so look for confidentiality terms. How much assurance you need "depends on the facts and circumstances, including the extent of publicly available information on the third-party service provider's controls", so the vendor's published security documentation can count. If you're not a member, the Code doesn't bind you, though your state board may have similar rules.

Read more: the interpretations, and who they reach

Contract or consent (1.700.040). The member should either "enter into a contractual agreement with the third-party service provider to maintain the confidentiality of the information and provide reasonable assurance that the third-party service provider has appropriate procedures in place to prevent the unauthorized release of confidential information to others," or "obtain specific consent from the client before disclosing confidential client information to the third-party service provider." How much assurance you need "depends on the facts and circumstances".

Tell the client (1.150.040). Before disclosing, "inform the client, preferably in writing, that the member may use a third-party service provider." If the client objects, either don't use the provider for that work or decline the engagement. There is no need to tell clients about providers that only give "administrative support services", such as "record storage, software application hosting, or authorized e-file tax transmittal services". That carve-out removes only the duty to tell the client. The contract-or-consent duty above has no such exception. My reading is that an AI tool that reads, analyses or drafts from client data is helping deliver the service, so both apply.

Vet and supervise (1.300.040). A member using a third-party service provider "must adequately plan and supervise the third-party service provider's professional services". My reading is that, for AI, this means checking the tool is fit for the task and reviewing its output.

The tax standards (Statements on Standards for Tax Services, effective 1 January 2024). They "apply to all members providing tax services". SSTS 1.3: "A member should make reasonable efforts to safeguard taxpayer data, including data transmitted or stored electronically", and to confirm that information properly shared with others is protected. SSTS 1.4 lists the tools a member may rely on, including "artificial intelligence", and says the member's responsibility for the work "cannot be transferred entirely to reliance on a tool."

Who it reaches. A member "may be held responsible for the acts of all persons associated with the member in public practice whom the member has the authority or capacity to control", so it reaches your non-CPA staff. State boards have their own confidentiality rules for all licensees. For audit and attest clients, record the AI approval in your quality management system.

The AICPA publishes sample client disclosure language (dated 13 May 2013), and the Code links to a nonauthoritative staff article, "Ethics Staff Insights: AI through an ethics lens". For an individual tax client, all three regimes apply at once: §7216, the Code and the Safeguards Rule. One vendor agreement can serve the Code and the Safeguards Rule, but it does not replace a §7216 consent where one is needed.

What the IRS has said about AI

The IRS's security publications don't mention AI. But on 24 June 2026 the IRS Office of Professional Responsibility published Issue Number 2026-19, "Introductory Guidelines for Responsible AI Use in Federal Tax Practice." It is OPR's guidance on how Circular 230 applies to those who practise before the IRS, not a new rule:

"Practitioners must strictly handle all client data using only secure, enterprise-approved AI."

My reading is that "enterprise-approved" most likely means approved by your firm, not a vendor's Enterprise plan. The guidance also says practitioners "must thoroughly review all AI-created documents" before delivery, and that "Willful mishandling of taxpayer information through AI may lead to disciplinary actions under Circular 230." It does not answer the consent question.

Read more: the rest of the guidance

On data: "GAI platforms may present risks regarding the unauthorized disclosure of sensitive taxpayer information, especially when data is uploaded to unsecured or public systems."
Vetting: "Outsourced or third-party AI tools should be vetted", with the firm's steps documented.
Fees: billing "for manual labor or time that was not actually spent or double billing for AI-assisted tasks may violate § 10.27", depending on the facts. Practitioners should "disclose, in general or specific terms as needed, the AI activities performed" and pass on cost savings, which makes it an engagement-letter item.
Enrolled agents: the guidance points to Circular 230 §10.51(a)(15), which bars willful unauthorised disclosure or use of tax return information. That binds EAs whether or not the AICPA Code does. EAs who belong to NAEA also follow its Code of Ethics (updated 20 January 2025): "Members and Associates will maintain the confidentiality of professional relationships."
The duties underneath: OPR applies existing Circular 230 rules, among them due diligence in preparing returns and other documents (§10.22), competence (§10.35) and firm procedures (§10.36).
Other documents: IRM 10.24.1, revised 10 August 2026, covers the IRS's own use of AI, not yours. Publications 4557 (Rev. 6-2024) and 5708 (Rev. 8-2024) don't mention AI.

What AI vendors actually promise

Training

On personal plans, conversations can be used for training unless each user turns it off. ChatGPT, Gemini and Perplexity default to on, and Claude asks each user. On business plans, OpenAI, Anthropic, Google and Perplexity promise no training in their binding terms. OpenAI's and Google's terms allow training if the customer agrees, so check whether your administrator has. Microsoft states the same for Copilot in its documentation; ask where it is in your contract.

Read more: each vendor's wording and date

Personal plans

ChatGPT: OpenAI's help page (updated 20 October 2026) says that for "Free, Plus, Pro", "we may use your content to train our models." It can be turned off in Data controls. Even then, a thumbs-up or thumbs-down can send that conversation for training. Temporary Chats are not used for training "while they remain temporary".
Claude: Anthropic will "train new models using data from Free, Pro, and Max accounts when this setting is on" (announcement, 28 August 2025). With it on, data is kept for five years instead of 30 days. New users choose at sign-up; neither that announcement nor Anthropic's privacy center (updated 16 March 2026) says which way the choice is preset. Feedback and chats flagged for safety review can be used either way. Incognito chats are not used for training.
Gemini: on personal accounts, "If you're 18 or over, Keep Activity is on by default" (the help page shows no date), and Google uses that activity to improve its services, "including training generative AI models" (Gemini Apps Privacy Hub, updated 19 October 2026). Even with it off, chats are held for 72 hours, and chats picked for human review are kept for up to three years.
Perplexity: for Free, Pro and Max users, "AI Data Retention is enabled by default" (help page, last modified 31 August 2026); turning it off opts out of training.
Opting out, on any of them, stops future use. It does not undo training already done.

Business plans

OpenAI's Services Agreement (effective 1 January 2026) covers ChatGPT Business and Enterprise: "OpenAI will not use Customer Content to develop or improve the Services, unless Customer explicitly agrees to such use."
Anthropic's Commercial Terms (effective 17 June 2025): "Anthropic may not train models on Customer Content from Services."
Google Workspace: "Workspace does not use customer data for training models without customer's prior permission or instruction" (Workspace Privacy Hub, updated 6 October 2026). The promise is in the Training Restriction section, §12.11, of its Service Specific Terms (last modified 12 October 2026).
Perplexity's Enterprise Terms (last updated 3 August 2026) say it will not use customer content "to train, retrain, fine-tune or otherwise improve any generative artificial intelligence models."
Microsoft says Copilot's prompts, responses and "data accessed through Microsoft Graph aren't used to train foundation LLMs", with no opt-in described (Copilot privacy page, last updated 18 August 2026). It says this in documentation; ask where it appears in your Product Terms or data protection addendum. Feedback is separate: "Customers can manage feedback through admin controls."

Retention

Not training on your data doesn't mean deleting it. Providers keep business requests for a period, typically up to 30 days, for abuse monitoring, and longer if something is flagged. Zero data retention is mostly an API arrangement; Anthropic says its Team and Enterprise apps aren't eligible. Ask how long prompts, files and outputs are kept, who can see them, and whether that's set by your plan.

Read more: OpenAI and Anthropic specifics

OpenAI "may securely retain API inputs and outputs for up to 30 days to provide the services and to identify abuse" (Enterprise privacy page, updated 8 January 2026). On ChatGPT Enterprise, your admins set retention, and deleted conversations are removed within 30 days. Zero data retention is offered "for eligible endpoints if you have a qualifying use-case".
Anthropic deletes API data within 30 days by default. If a chat or session is flagged by its safety systems, it "may retain inputs and outputs for up to 2 years", even under a zero-retention agreement. It says "Claude Teams and Claude Enterprise product interfaces" are not eligible for zero retention (API and data retention docs; no date shown, checked 21 October 2026).

Where your data is processed

Storing data in a region and processing it there are separate promises, and the second is rarer. As of 21 October 2026:

ChatGPT: US processing on Enterprise and Edu only. Business can choose where data is stored, not where it is processed.
Claude: US-only processing on the API and usage-based Enterprise plans, at 1.1× the price. Not on Team.
Gemini (Google Workspace): in-region processing on Enterprise Plus-level editions; Business Standard and Plus get storage only, unless you buy an add-on.
Microsoft Copilot: US storage yes, US-only processing not yet (expected by the end of 2026). Anthropic models inside Copilot are on by default for US tenants and are outside that commitment.
Perplexity: no published option to choose a processing region found.

For return information, US processing keeps you clear of the outside-the-US rule, but you still need consent or the software route.

Read more: each vendor's terms, with dates

Product	Can you keep processing in the US?
ChatGPT	Enterprise and Edu only, for new workspaces. Storage can be pinned to 10 regions; GPU inference to the US, Europe or the UAE. "Non-GPU processing may still occur globally." ChatGPT Business can choose a storage region (still rolling out), but that "does not include inference residency". (OpenAI help pages, updated October and August 2026.)
Claude	Yes, on the API and usage-based Enterprise plans, for Claude 4.6 and later models: US-only inference is "priced at 1.1x the standard rate." On the API the default is "global", meaning any region. Not on Team or seat-based Enterprise plans. Anthropic itself offers only US or global; other regions come through cloud partners' regional endpoints. (Claude docs, no date shown; Enterprise help article, 15 June 2026.)
Gemini (Google Workspace)	Data regions cover Gemini prompts and responses in Workspace (not Gemini Notebook), once an admin sets the policy. In-region processing as well as storage needs an edition with Enterprise Data Regions (Enterprise Plus, Enterprise Essentials Plus, Frontline Plus); Business Standard and Plus get storage only unless you buy the Enterprise Data Regions add-on, and Business Starter gets none. (Data Regions page, updated 20 October 2026; Gemini app announcement, 29 June 2026.)
Microsoft Copilot (work; formerly Microsoft 365 Copilot)	US storage yes, US-only processing not yet. Stored Copilot interactions are kept in your tenant's country under Microsoft's Product Terms. But requests "can call into other regions where capacity is available during high utilization periods," and customers outside the EU "may have their queries processed in the US, EU, or other regions." Microsoft "enables Anthropic models on by default for most customers in commercial cloud (excluding EU/EFTA and UK)", and those models are "excluded from the EU Data Boundary, and when applicable, in-country processing commitments"; an admin can turn them off. EU tenants can keep processing inside the EU Data Boundary by turning flex routing off. In-country processing for the US is expected by the end of 2026. (Copilot privacy page, 18 August 2026; Anthropic models page, 18 September 2026; flex routing page, 29 September 2026; Microsoft 365 blog, 4 November 2025, updated 3 April 2026.)
Perplexity	No published option to choose a processing region found. (Help page, 31 August 2026; Enterprise Terms, 3 August 2026.)

Three notes on Microsoft:

US storage is included. A US tenant's SharePoint, OneDrive, Exchange, Teams and stored Copilot data stays in the US under the Product Terms, "at no additional cost" (data residency page, updated 8 October 2026). Paid add-ons (Multi-Geo, Advanced Data Residency) are only for choosing a different or extra location, and Multi-Geo isn't available on Business plans.
Copilot sees what each user can see. Copilot "only surfaces organizational data to which individual users have at least view permissions", so your SharePoint and OneDrive permissions, and sensitivity labels, are its per-client boundary. Review them before rollout.
Copilot Chat is on unless you block it. It comes with Microsoft 365 even without a Copilot licence. Firms that want Microsoft for storage and something else for AI should both withhold Copilot licences and block Copilot Chat in the Microsoft 365 admin center; unpinning it doesn't remove access (Copilot management page, updated 12 October 2026).

Breaches and bugs

Enterprise AI tools have had real data-leak flaws. A contract promises what the vendor will do, not that nothing will break, and if something does, it gives you a claim, not your data back. That is why the Safeguards Rule asks you to reassess providers on an ongoing basis.

Read more: the 2025 Copilot advisories

Between June and October 2025, Microsoft published six security advisories (CVEs) for Microsoft 365 Copilot, now called Microsoft Copilot. Five were information-disclosure flaws and one was rated spoofing. Two were credited to outside researchers, including "EchoLeak" (CVE-2025-32711), a prompt-injection flaw that "allows an unauthorized attacker to disclose information over a network" (released 11 June 2025). Microsoft fixed all six on its side and marked none as exploited.

Three things you may have heard

"Any slip with client data is a crime." The crime requires "knowingly or recklessly"; an honest slip can bring the civil penalty instead. Routinely uploading return information to a tool that no exception covers is not a slip.

"The IRS has declared that practice management counts as tax preparation, so AI in your practice software is fine." I found no IRS text that says this. The regulations permit narrower things: use within a US firm, help from another US preparer, contractors for software used to prepare returns, and record-keeping. An AI feature inside your US tax software is the strongest case for not needing consent. A separate AI vendor analysing the data, or anything disclosed abroad, is not. The IRS hasn't ruled either way.

"Our enterprise plan keeps everything in the US." Check the setting, the plan tier and the product. On most vendors processing can happen anywhere unless you change a setting or buy a higher tier, and some products have no US-only option yet. Even US-only processing doesn't settle §7216 by itself.

Read more: two more, on consent forms and tax planning

"Every disclosure needs its own consent form." Several disclosures can go on one form. For 1040-series clients, uses and disclosures go on separate forms, so at most two, not one per item. For business clients, one signed and dated engagement letter can cover both.

"Tax planning for an existing tax client always needs a consent." Not for a firm lawfully practising law or accountancy that prepared the return, which may use the information for "other legal or accounting services" within the firm. An affiliated firm still needs consent. For an enrolled agent, and for financial planning, the regulations don't say; get the consent.

The questions to ask any AI vendor

Put these in writing and keep the answers in your WISP file, with the date. Few answers are a simple pass or fail: under each question, "Read more" says what different answers mean and what to do next.

1. Training. Is any of our content (prompts, files, outputs, feedback ratings, flagged chats) used to train or improve a model, and where does the contract say so?