AICPA Ethics Framework for AI Use at CPA Firms
How AICPA standards apply to AI use at CPA firms. Confidentiality, professional competence, due diligence, and operator guidance.
The applicable AICPA standards
- Code of Professional Conduct — Foundation including independence, integrity, objectivity
- Rule 301 (Confidentiality) — Client information protection
- Rule 201 (Professional Competence) — Adequate technical training
- Rule 202 (Auditing Standards) — When applicable
- SSARS — Statements on Standards for Accounting and Review Services
- SQMS — Statements on Quality Management Standards
How AICPA standards apply to AI
Rule 301 Confidentiality:
- AI tools that retain or use client data for training violate confidentiality
- Free consumer AI tools (free ChatGPT, etc.) typically not compliant
- Enterprise-tier tools with proper data handling are acceptable
- Document handling for AI processing must protect privilege
- CPAs must understand AI tools sufficient to use them competently
- Verification of AI output is part of professional competence
- Training and ongoing education on AI tools
- AI use in attestation and review services must comply with applicable standards
- Quality management framework applies to AI-augmented work
- Documentation of AI-assisted procedures
- CPAs must exercise due diligence in tax practice
- AI accelerates work but doesn't reduce due diligence obligation
- Verification of AI output essential
Practical framework for CPA firms
Tool selection:
- Enterprise-tier tools only for client work
- SOC 2 Type II or equivalent
- Data not used for training
- Encryption at rest and in transit
- AI-assisted work clearly designated
- CPA verification and supervision at every step
- Documentation of AI use
- Annual AI competence training
- Tool-specific training for staff
- Documentation of training
- Quarterly review of AI-assisted work product
- Quality control sampling
- Annual policy refresh
Engagement letter language
Many CPA firms include AI disclosure:
"Our firm uses AI tools to assist with tax preparation, document analysis, advisory services, and related tasks. All AI-assisted work is reviewed and verified by our CPAs, and client confidentiality is maintained through tools that protect privileged information. Our billing reflects the value of our work, including time spent reviewing and verifying AI-assisted output."
State-specific considerations
State CPA boards vary in AI guidance:
- Some states have published initial AI guidance
- Most reference AICPA standards with state-specific notes
- State CPA board rules apply for licensed practice
- Maintain awareness of your state's specific guidance
What examiners and peer reviewers look for
Common questions:
- Do you have written AI policy?
- What AI tools are in use?
- How are CPAs and staff trained on AI?
- How is client confidentiality protected?
- How is AI use documented?
- Have you addressed AICPA standards in your AI policy?
What can go wrong
Pattern 1: Free consumer AI for client tax data. Rule 301 violation.
Pattern 2: Inadequate verification. Errors in returns or advisory work.
Pattern 3: Documentation gaps. Peer review or examination finds issues.
Pattern 4: Inadequate staff training. Rule 201 (competence) concerns.
Pattern 5: Aggressive billing. Honest billing applies to CPAs same as attorneys.
What we deploy
For CPA firms working with us on AI ethics infrastructure:
- AI policy aligned with AICPA standards
- Training curriculum (60-90 min annual)
- Workflow documentation
- Quality management updates
- Engagement letter language
Bottom line
AICPA standards fully apply to AI-augmented CPA practice. The framework is clear: enterprise-tier tools, professional competence, supervisory oversight, due diligence, honest billing.
Firms with structured AI ethics infrastructure operate AI confidently. Firms without face growing peer review, examination, and state board pressure.
The investment is modest. The protection is substantial. Build the framework before you need it.
Frequently asked questions
Does AICPA have a Formal Opinion on AI like the ABA?
Not yet a specific 'Formal Opinion on AI,' but existing AICPA Code of Professional Conduct (Rules 301, 201, others) and supplemental guidance apply fully to AI-augmented practice. The framework is clear through existing standards.
Can I use free ChatGPT for client tax data?
No — free consumer AI tools typically retain data or use it for training, which violates AICPA Rule 301 (Confidentiality). Use enterprise-tier tools with proper data handling for client work.
What does professional competence mean for AI use?
AICPA Rule 201 requires CPAs to have adequate training in services performed. Applied to AI: CPAs must understand tools sufficient to use them competently, verify output, and supervise junior staff using AI.
Do peer reviewers look at AI use?
Increasingly yes. Common questions: What AI tools? How trained? How supervised? How documented? Maintain documentation supporting your firm's AI use to answer peer review questions cleanly.
Does AICPA AI guidance vary by state?
State CPA boards may have specific guidance. Most reference AICPA standards with state-specific notes. Maintain awareness of your state's specific guidance in addition to AICPA standards.
Related guides
Need help implementing this?
//prometheus does onsite AI consulting and implementation in Milwaukee. We set it up, train your team, and make sure it works.
let's talk