AI vendor due diligence for CPA firms

Every firm evaluating AI software runs into the same problem: the questions that matter are not the ones on a standard vendor questionnaire, and the answers that come back are fluent enough to sound like compliance whether or not they are. What follows is twelve questions written to be sent as they are, each with the answer that should satisfy you next to the answer that should not.

The ordering is deliberate. The first four decide whether you need paperwork at all. The middle four decide whether the output is reviewable. The last four decide whether anyone is accountable when it goes wrong.

Whether you need paperwork

1. Where is our data processed, physically?

Good: A named country, and named subprocessors, in writing.

Not good: “The cloud”, “enterprise-grade providers”, or an answer about where the company is incorporated.

This single fact decides whether you need an IRC section 7216 consent at all. United States processing for non-substantive work needs none. Offshore needs a prescribed document with prescribed language. A vendor who cannot answer precisely has told you they have not read the statute.

2. Do you train models on our clients' data?

Good: No, stated in the contract rather than on the marketing site, and covering the underlying model provider as well as the vendor.

Not good: “We use it to improve the service”, or an opt-out you have to go and find.

Training is a use under section 7216 for a purpose other than preparing that return, so it needs consent obtained beforehand. A default-on setting mentioned in clause fourteen has obtained nothing, and the preparer is the one the statute binds, not the vendor.

3. Who are your subprocessors, and will you tell us when that list changes?

Good: A published list and contractual notice before it changes.

Not good: A refusal on confidentiality grounds, or a list that exists but is not committed to.

Your section 7216 position depends on where data goes, and it can be changed by a vendor's procurement decision you never hear about. Notice is what converts a point-in-time answer into an ongoing one.

4. Is any of this work a substantive determination affecting tax liability?

Good: No, and a clear description of the boundary the software will not cross.

Not good: Enthusiasm about how much of the return it can do.

The no-consent-required exception is limited to non-substantive assistance. It is also the line between software that prepares work and software that is quietly practising.

Whether the output is reviewable

5. Show me where this number came from.

Good: A click that lands on the page and the box the figure was read out of, demonstrated live on a real document.

Not good: A confidence score, a list of documents consulted, or an explanation of the model.

Ask them to demonstrate rather than describe. A score is the software grading its own work, and Circular 230 section 10.35 asks for competence in the matter, which you cannot have over output you cannot check.

6. What happens when it is not sure?

Good: It stops and asks, and the stopping is visible in the record afterwards.

Not good: It picks the most likely answer and flags it for review later.

Ask specifically what happens when a new document contradicts something already on file. That is the case where confidence is irrelevant, and a system that resolves it silently will do so on exactly the facts you most needed to see.

7. Can we see who accepted each figure, and when?

Good: A per-fact record naming a person and a timestamp, queryable after the fact.

Not good: An audit log of logins and exports.

Circular 230 section 10.36 puts an obligation on whoever has principal authority to ensure adequate procedures exist across the firm. You cannot demonstrate a procedure was followed without a record of who did what.

8. What does it do when a document is unreadable?

Good: It says so and asks, and the item stays open.

Not good: It returns a best guess with no distinction from a clean read.

Scanned, photographed and faxed documents are most of the season. How a tool behaves on bad inputs tells you more than a demo on a clean PDF.

Whether anyone is accountable

9. Who inside our firm can see which clients?

Good: The boundary is enforced in the database, and the same boundary applies to the automated work.

Not good: Permissions are checked in the application layer.

This is not pedantry. An application-layer check is one bug away from being bypassed, and it does not constrain an agent whose instructions can be influenced by the contents of a document it reads.

10. What is in the contract about confidentiality?

Good: A data processing agreement with confidentiality obligations and a commitment about the provider's own procedures.

Not good: A privacy policy, offered as though it were a contract.

AICPA ET 1.700.040 gives you two routes when using a third-party service provider: the client's specific consent, or a contractual agreement giving reasonable assurance the provider prevents unauthorized release. Reasonable assurance means you looked.

11. What certifications do you hold, and which do you not?

Good: A straight answer including the gaps, and a report you can actually read under NDA.

Not good: A SOC 2 badge on the marketing site with no report available, or a Type I described as though it were a Type II.

We fail this one: Docenta holds no SOC 2 Type II report and is not audited yet. A firm that decides that disqualifies us for now is applying the checklist correctly, which is the point of publishing it.

12. What happens to our data if we leave?

Good: Export in a usable format, and deletion on a stated timetable, both in the contract.

Not good: “Contact support”, or an export that returns PDFs of screens.

The work product is the firm's. An arrangement you cannot leave without losing the record is a commercial problem that turns into a professional one the moment a client asks for their file.

How to read the answers

Three patterns are worth more attention than any individual reply.

Precision about location. Vendors who have thought about section 7216 answer question one in a sentence with a country in it. Vendors who have not answer it with an adjective.

Willingness to show rather than describe. Question five is the fastest signal in the list. A vendor who can click from a figure to its source on a document you supply has built the thing they are describing. One who redirects to a slide has not.

Named gaps. A vendor who volunteers what they do not have is easier to verify on everything else. A vendor with no gaps has either an unusual product or an unreliable answer, and it is rarely the first.

The underlying obligations are covered in more depth in the piece on whether AI is safe for client tax data, and the consent mechanics in the section 7216 explainer.

This is not legal advice, and it is not a substitute for your firm’s own vendor risk process. It is the set of questions we think separate a real answer from a confident one, published in full including the question we come off worst on.