AI and the Tax Profession

I am reluctant to add to the volume of commentary out there about AI; however, the general level of misunderstanding that exists surrounding the proliferation of these tools means it is inevitable. I am not here to talk about the general security concerns, risks, and considerations that we need to be aware of, but rather the specific obligations we have as tax professionals.

The use of AI, and specifically Large Language Models (LLMs) in the accounting industry, is ubiquitous; however, the level of appropriate knowledge is still lagging behind. In two recent seminars I attended, there was an overwhelming belief that Microsoft Co-Pilot and desktop versions of Claude (Anthropic) and ChatGPT (OpenAI) were local models and therefore completely safe to use with sensitive information. To confirm, local in this instance means the entire model (often an open-weight variant) is installed on a device that you control, and none of the prompts or answers leave your device/network. Microsoft Co-Pilot, Claude, ChatGPT, and all frontier models process your prompts on their servers, which you do not control. There are options you can select (dependent on your model and subscription), such as to not have your data train the models; however, this is not the same as a local model and does not mean that you can use it with reckless abandon when dealing with sensitive or personal identifiable information.

A second element to consider is a study undertaken in February 2026 where it was tested just how well “anonymised” text protected someone’s identity. Given minimal text data, the agent autonomously searched, cross-referenced and attempted to re-identify the person behind the redacted text. It was successful in 9 out of 33 scientists that tested this. Simply removing personal identifiable information may not be sufficient to adequately protect client information moving forward. This may not technically be a notifiable data breach, under the terms at the moment, as it was not a breach in the sense as defined by the OAIC, which typically governs tax agents (as a result of The TFN Rule [2015] and its connection with the Taxation Administration Act [1953] and The Privacy Act [1988]). Strictly speaking:

A data breach happens when personal information is accessed or disclosed without authorisation or is lost. If the Privacy Act 1988 covers your organisation or agency, you must notify affected individuals and us when a data breach involving personal information is likely to result in serious harm.

Under the current provisions, the information has not been disclosed, but rather inferred, solved, or calculated, and therefore not a breach under the definition guidance of a notifiable data breach.

Further to this, we need to be aware of our obligation to advise clients of all AI/LLM tools that we will be using with or for their data. This can be done informally through mediums such as your website or newsletter, or more formally through your terms of engagement — it may be prudent to review your obligations under APES 305 (Terms of Engagement) to ensure you are complying with this at a wider level.

To help guide tax agents further, in addition to the recent webinar that was hosted by the Tax Practitioners Board (TPB), they also released guidance statement TPB(GS) 55/2026: The use of Artificial Intelligence and the Code of Professional Conduct. This guidance is a beneficial read to ensure compliance with the Tax Agent Services Act 2009 (TASA), but more importantly, it provides some useful assistance and considerations before and during the deployment of AI during your engagements and ensuring adherence to the core competencies, confidentiality, and independence as it relates to the act and tax agent services.

To help guide practitioners, there is a useful checklist that can be informally followed to help ensure overall compliance, and to ensure an appropriate level of professional scepticism exists when using AI:

• Is this tool appropriate for the task? Identify the tool, consider the risks, including potential data leak risks, and attempt to understand the tool with its data flow at a higher level. This responsibility cannot be abdicated, and whilst we do not need to have an in-depth understanding of the model(s) and cybersecurity, there is still a responsibility to obtain as much information as possible and ensure any decisions carry sufficient documentation and risk assessment.
• What information will be entered? Consider what information will be provided to the tool and operate with a least privilege mindset. By this, attempt to provide the tool with the minimum amount of information required, taking time to anonymise and remove all personal identifiable information. Whilst such a process can appear cumbersome or counterintuitive to the use of the tool, it is important to understand the overarching requirements the accounting profession is governed by and expected to adhere to (such as confidentiality).
• Has the client given the necessary permission? The desire and commonality of skipping this step cannot be overstated, but the risks are quantifiable. Without approval, you may be in contravention of accounting standards, TASA, and other professional body governance regulations. Additionally, without approval, it may qualify as a data breach, independent of the pace at which the AI / LLM landscape is evolving and the (potential) ability to re-identify subjects.
• Where will the information be stored and used? Review the tool’s security, privacy, and data-handling arrangements. Estimating or surmising will not be sufficient; you should demonstrate quantification of this data by clearly identifying the location of the servers, even if just confirming not in Australia, as such non-local data locations will impact the application of Australian Privacy Principles.
• How will the output be checked? Establish a review process that applies appropriate tax knowledge, client-specific analysis, and professional judgement. As is detailed in TPB(GS) 55/2026, “It is important for tax practitioners to understand the capabilities and limitations of AI tools, and ensure AI outputs are assessed and supplemented by professional judgement, before being relied on.” The need for professional judgement and verification is a key element of the profession, and this is one area such technological advancements cannot fully replace.
• What records need to be retained? Document the use of AI, the review undertaken, and relevant decisions as part of the practice’s record-keeping and quality management processes. Deleting the chat/prompt/data does not delete it from the servers, and whilst the user records may be removed, it will remain, and again could be a data leak risk to be considered.
• Is appropriate supervision in place? Ensure people and entities providing services on the practitioner’s behalf have the necessary knowledge and skills and are appropriately supervised. Supervision is a component of the TASA, and this extends to tools. “The AI said” is not an appropriate defence when the industry relies on integrity, trustworthiness, and professional skill and judgement.

I do not propose that as a collective we need to become luddites in the face of using this technology; however, it is an area that tax agents are clearly being monitored and guided on. Having an understanding of the technology at a fundamental level, and more importantly our obligations and requirements, can ensure that this technology can be deployed in a safe and professional manner that will add value to your services, maintain compliance, and minimise risks to all parties.

Reference: Lermen, S., Paleka, D., Swanson, J., Aerni, M., Carlini, N., & Tramér, F. (2026). Large-scale online deanonymization with LLMs. arXiv. https://arxiv.org/pdf/2602.16800