IRS section 7216 consent, for firms using AI

The question a firm usually arrives with is “do we need a 7216 consent to use this software?” For most tools the answer is no, and the reason is worth understanding rather than taking on trust, because the same reasoning tells you exactly which tools do need one.

Start with the exception, not the rule

Treasury regulation section 301.7216-2 lists the disclosures a preparer may make without any consent at all. Subsection (d) is the one that covers software vendors and outsourced help: a preparer may disclose return information to another preparer located in the United States for services that do not involve substantive determinations affecting tax liability.

Both halves are load-bearing. United States processing, non-substantive assistance, no consent required. Change either one and you are in consent territory.

So when do you actually need one

Three situations, in rough order of how often they come up.

• The processing happens outside the United States. Offshore preparation, offshore review, an offshore subprocessor sitting behind a domestic-sounding vendor. Consent required, and see the section on social security numbers below, because that case has its own rules on top.
• The vendor uses the data for anything other than preparing that return. Training models is the obvious modern one. So is benchmarking, analytics sold onward, or marketing. Any of those is a use under section 7216 and consent has to come first.
• The work involves substantive determinations. Not transcription, not assembly, not tie-out. Deciding a position.

What makes a consent valid

Section 301.7216-3 sets the substance. A consent must be obtained before the disclosure or use, must be knowing and voluntary, and must identify the preparer, the taxpayer, the intended purpose, the specific recipient, and the information being disclosed. It needs the taxpayer’s signature and the date.

Two rules inside that catch firms out. Conditioning your services on the client signing makes the consent involuntary and therefore invalid, with a narrow exception for disclosure to other preparers assisting with the return. And if a client refuses, you may not come back and ask again for a substantially similar purpose.

Unless the document says otherwise, a consent expires one year from the date the taxpayer signed it. Which means a consent obtained for the 2025 season is not doing anything for you in the 2027 one.

The formatting rules that void a consent

For the 1040 series, Rev. Proc. 2013-14 adds requirements about the physical form of the document, and they are specific enough that a consent buried in an engagement letter usually fails them.

• On paper: one or more sheets of 8½ by 11 inch or larger paper.
• In at least 12-point type, and no more than 12 characters per inch.
• All of the text on each sheet must pertain solely to the disclosure or use that consent authorizes. This is the one firms trip over. A consent paragraph inside a general engagement letter does not satisfy it, because the rest of the sheet is about something else.
• Electronically: on its own screen or screens, with text at least the same size as the normal body text of the surrounding software, and sufficient contrast between text and background.

The language the IRS requires you to include

Two mandatory statements, quoted here as published so you can lift them. This is not the whole consent, which still needs the elements above; it is the wording that has to appear inside it.

Every consent, on or after 14 January 2013

If you believe your tax return information has been disclosed or used improperly in a manner unauthorized by law or without your permission, you may contact the Treasury Inspector General for Tax Administration (TIGTA) by telephone at 1-800-366-4484, or by email at complaints@tigta.treas.gov.

Disclosure to a preparer outside the United States, including an SSN

This is the one most firms have never read, and it is the one that matters most if any part of your workflow leaves the country. First, the underlying rule: if return information going to a preparer outside the United States includes the social security number, and the number is not fully masked or redacted, the disclosure is only permitted where both preparers maintain an adequate data protection safeguard. If the SSN is fully masked, a shorter form of consent applies instead.

Where the SSN does go, the consent must contain this, verbatim:

This consent to disclose may result in your tax return information being disclosed to a tax return preparer located outside the United States, including your personally identifiable information such as your Social Security Number (“SSN”). Both the tax return preparer in the United States that will disclose your SSN and the tax return preparer located outside the United States that will receive your SSN maintain an adequate data protection safeguard (as required by the regulations under 26 U.S.C. section 7216) to protect privacy and prevent unauthorized access of tax return information. If you consent to the disclosure of your tax return information, federal agencies may not be able to enforce United States laws that protect the privacy of your tax return information against a tax return preparer located outside of the United States to whom the information is disclosed.

Read the second sentence again. Signing that form asserts that both preparers maintain an adequate data protection safeguard. If you do not know where your vendor processes data, you are not in a position to make that assertion, and the assertion is yours rather than theirs. That is the practical reason the location question is the first one to ask any vendor.

What this means for choosing software

The consent regime is not a hurdle to clear so much as a fork to notice. A vendor that processes in the United States, does non-substantive work, and does not train on your data puts you on the side of the fork with no paperwork at all. A vendor that does any of the other three puts you on the side with a prescribed document, a prescribed typeface and a prescribed sentence about federal agencies being unable to help your client.

Neither side is disqualifying. Plenty of firms run offshore workflows properly with valid consents on file. But the difference in operational burden is real, it lands on you rather than on the vendor, and it is knowable in one question before you sign anything.

For what it is worth on our side: Docenta processes in the United States, does not train on client data, and does not decide positions, which is the combination that lands in section 301.7216-2(d). The vendor due diligence checklist has the questions that establish this for anyone, us included, and the wider piece on AI and client tax data covers Circular 230 and the AICPA rule alongside this one.

This is not legal advice. It is a reading of published authority, linked and quoted so you can check it, and the guidance changes. The mandatory statements above are reproduced from Rev. Proc. 2013-14 as published; confirm against the current version before putting them in front of a client, and have your own counsel or your professional liability carrier clear a specific arrangement.