AICPA Ethics Framework for AI Use at CPA Firms

The AICPA has published on AI, and it has not published the thing people are usually looking for. Both halves matter.

What exists: the AICPA and CIMA publish a Small Firm Generative Artificial Intelligence Policy Template, written for firms setting rules around publicly available large language models. There is also guidance on responsible AI use in federal tax practice, and an AI resource center collecting the material as it lands.

What does not exist is an ethics interpretation specific to AI, comparable to ABA Formal Opinion 512 on the legal side. That absence is not a gap in coverage. The Code of Professional Conduct applies as written, and the framework is clear once traced through it.

The applicable AICPA standards

• Code of Professional Conduct — Foundation including independence, integrity, objectivity
• Confidential Client Information Rule (ET 1.700.001, formerly Rule 301) — Client information protection
• General Standards Rule (ET 1.300.001, formerly Rule 201) — Professional competence and adequate technical training
• Compliance With Standards Rule (ET 1.310.001, formerly Rule 202) — Auditing, review and other standards when applicable
• SSARS — Statements on Standards for Accounting and Review Services
• SQMS — Statements on Quality Management Standards

Plus Circular 230 (IRS practice) and state board rules.

How AICPA standards apply to AI

Confidential Client Information Rule:

• AI tools that retain or use client data for training violate confidentiality
• Free consumer AI tools (free ChatGPT, etc.) typically not compliant
• Enterprise-tier tools with proper data handling are acceptable
• Document handling for AI processing must protect privilege

General Standards Rule, professional competence:

• CPAs must understand AI tools sufficient to use them competently
• Verification of AI output is part of professional competence
• Training and ongoing education on AI tools

SSARS and Quality Management:

• AI use in attestation and review services must comply with applicable standards
• Quality management framework applies to AI-augmented work
• Documentation of AI-assisted procedures

Due Diligence under Circular 230:

• CPAs must exercise due diligence in tax practice
• AI accelerates work but doesn't reduce due diligence obligation
• Verification of AI output essential

Practical framework for CPA firms

Tool selection:

• Enterprise-tier tools only for client work
• SOC 2 Type II or equivalent
• Data not used for training
• Encryption at rest and in transit

Workflow design:

• AI-assisted work clearly designated
• CPA verification and supervision at every step
• Documentation of AI use

Training:

• Annual AI competence training
• Tool-specific training for staff
• Documentation of training

Audit and review:

• Quarterly review of AI-assisted work product
• Quality control sampling
• Annual policy refresh

Engagement letter language

Sample AI disclosure language:

"Our firm uses AI tools to assist with tax preparation, document analysis, advisory services, and related tasks. All AI-assisted work is reviewed and verified by our CPAs, and client confidentiality is maintained through tools that protect confidential information. Our billing reflects the value of our work, including time spent reviewing and verifying AI-assisted output."

State-specific considerations

State CPA boards vary in AI guidance:

• Some states have published initial AI guidance
• Most reference AICPA standards with state-specific notes
• State CPA board rules apply for licensed practice
• Maintain awareness of your state's specific guidance

What examiners and peer reviewers look for

Common questions:

• Do you have written AI policy?
• What AI tools are in use?
• How are CPAs and staff trained on AI?
• How is client confidentiality protected?
• How is AI use documented?
• Have you addressed AICPA standards in your AI policy?

Documentation supporting these answers protects the firm.

What can go wrong

Pattern 1: Free consumer AI for client tax data. A Confidential Client Information Rule problem.

Pattern 2: Inadequate verification. Errors in returns or advisory work.

Pattern 3: Documentation gaps. Peer review or examination finds issues.

Pattern 4: Inadequate staff training. General Standards Rule (competence) concerns.

Pattern 5: Aggressive billing. Honest billing applies to CPAs same as attorneys.

A typical engagement

For AI ethics infrastructure:

• AI policy aligned with AICPA standards
• Training curriculum (60-90 min annual)
• Workflow documentation
• Quality management updates
• Engagement letter language

Cost depends on how much of the policy and training the firm writes itself. Get a written scope and quote. Prometheus publishes a defined build from $5,000. Ongoing maintenance is light.

Bottom line

AICPA standards fully apply to AI-augmented CPA practice. The framework is clear: enterprise-tier tools, professional competence, supervisory oversight, due diligence, honest billing.

Firms with structured AI ethics infrastructure operate AI confidently. Firms without one should expect questions from peer reviewers, examiners and state boards.

The investment is modest. The protection is substantial. Build the framework before you need it.