How to set up a CPA firm to use AI: a working guide
A sequenced setup for accounting, advisory, and insurance firms: one workspace, a client data rule, your own files, and one workflow before busy season.
King & Company
In short
Start with four things in order: one firm workspace under a commercial agreement, a one-page rule for client information, the firm's own templates and prior work loaded where the AI can read them, and one workflow built against last season's files. Put the review at the point where a manager or partner already reviews, and keep every instruction and template in the firm's own workspace so the firm owns the result.
To set up a CPA firm to use AI, put four things in place in this order: one firm workspace under a commercial agreement, a one-page rule for client information, your own templates and prior-year work loaded where the AI can read them, and one workflow built against last season's actual files. A firm that runs on documents can start all four this month, and none of them requires a strategy document first.
The reason to be deliberate is that the use has already started. In a Thomson Reuters survey of 538 tax and audit firm professionals across 40 countries, conducted in March and April 2026, 81% said they regularly use AI in their day-to-day workflows and 35% said they use AI tools their firm has not authorized for work. The setup below gives that activity a proper home before the next busy season.
What "set up for AI" means for a firm that runs on documents
Most of the week at an accounting, advisory, or insurance firm is spent producing documents from other documents. An organizer comes from last year's return. A workpaper comes from a trial balance and a set of client statements. A proposal comes from the last three proposals for similar clients. Being set up for AI means the AI can read the source documents, knows how a senior person at your firm does the task, and hands its draft to the same reviewer who would have checked a staff member's draft.
Most of this work is unglamorous. It is file organization, written instructions, and a clear rule about client information.
Step one: one firm workspace instead of personal accounts
Move everyone onto a single business workspace that the firm administers, with a contract the firm signed. Personal accounts leave the firm with no contract, no administrator, and no way to see what went where.
The contract matters because data terms can differ between a vendor's consumer and business plans. Anthropic, for example, states that by default it will not use inputs or outputs from its commercial products, such as Claude for Work and the Anthropic API, to train its models, with an exception when a user reports feedback or otherwise chooses to allow it. Read the equivalent page for whichever vendor you choose, and read it for the plan you are buying.
Firms that prepare tax returns have a second reason. The FTC lists tax preparation firms among the financial institutions covered by the Safeguards Rule. The same guidance says a covered firm must select service providers with the skills and experience to maintain appropriate safeguards, with contracts that spell out security expectations and provide for monitoring and periodic reassessment. Ask your Qualified Individual and your counsel how an AI vendor fits into the firm's written program before client information goes into it.
Step two: a one-page rule for client information
Write one page that a new hire can follow on day one. It should name the approved tools, say which categories of client information may go into them, name who reviews output, and say how AI use is recorded in the file.
The profession's own guidance gives you the contents. A July 2026 Journal of Accountancy article by Nicole L. Graham of Aon suggests firms consider limiting use to authorized tools, designating an AI lead or committee, restricting entry of personal, confidential, or proprietary information where it is not de-identified and others outside the firm can access it, requiring human review under existing supervision policies, verifying AI-generated research against primary authoritative sources, and documenting the prompts, the verification, and the reviewer in the client file.
The insurer's guidance is stricter in one respect, and you should know that before you write your rule. CNA, in a 2023 article published by the AICPA Member Insurance Programs, tells firms to draft a firmwide policy, prohibit the sharing of confidential and proprietary client and firm information with generative AI tools, and consult counsel on terms of service and privacy policies. Where your firm lands between those two positions is a decision for the partners, counsel, and your carrier, and the one-page rule is where you write the decision down.
Step three: get your own templates, checklists, and prior work where the AI can read them
A general AI workspace produces generic work until it has your materials. Gather the documents that define your firm's standard and put them in a shared location inside the workspace:
- Engagement letter templates and the current fee schedule
- Tax organizers and document request lists by client type
- Review checklists and workpaper templates
- A small set of prior-year files that a partner considers well done
- Past proposals, sorted by service line
Then write down how a senior person at the firm does each task: what they open first, what they compare, what they always catch. Those written instructions are what make the output match your standard. When we build for a firm, we package those instructions as Claude skills that sit in the firm's workspace.
Step four: build one real workflow against last season's files
Pick one task that recurs, has a clear source document, and already has a reviewer. Build it against last season's closed files, because you already know the right answer for those and can compare the AI's draft with what the firm delivered. Correct the instructions until a reviewer would accept the draft as a starting point, then use it on live work. Our guide to where AI fits in tax, audit, and client advisory work goes through the candidates by service line.
Where does the reviewer sit?
The reviewer sits where they sit today. The AICPA's tax standards define tools to include artificial intelligence and state that use of a tool does not absolve the member of professional obligations. CNA's guidance says to supervise and review AI output just as you would the work of any other engagement team member. We read both as pointing to the same design: the AI takes the preparer's seat for the first draft, and the existing review points stay as they are.
The table below is an illustrative example of that design for three common workflows.
| Workflow | What the AI drafts | Who reviews, and against what |
|---|---|---|
| Tax organizer | A client-specific organizer and document request list built from the prior-year return and workpapers | The preparer checks each item against the prior-year return before it goes to the client |
| Workpaper tie-out | A comparison of workpaper totals to the trial balance, with each difference listed and referenced to its source | The senior clears each difference, and the manager and partner review at their usual points |
| Proposal | A first draft from the precedent library, the engagement letter template, and the fee schedule | The partner reviews scope, fees, and terms before anything leaves the firm |
What should we tell clients and put in the engagement letter?
The Journal of Accountancy article suggests firms consider adding disclosure language to all engagement letters to tell clients that AI tools may be used in providing services. Tax practices should also have counsel look at the Treasury regulations under Section 7216, which set consent requirements for the disclosure or use of tax return information by preparers. The wording is a job for your counsel and your carrier. Once it is settled, the letter itself is a good candidate for the precedent library described in our article on proposal and contract drafting from a precedent library.
What should the firm own when the setup is done?
The firm should hold everything in its own workspace: the written instructions, the skills, the templates, the precedent library, and a short document for each workflow that says what it does and who reviews it. If those live in the firm's account, the setup keeps working when a vendor relationship ends or the people who built it move on. This is how we hand over our own work, with no platform fee and nothing the firm has to rent back.
What to skip in the first ninety days
Skip a firm-wide tool evaluation, a multi-phase roadmap, and anything described as an agent that sends or files on its own. One workspace, one rule, and one working workflow will teach the partners more about what to buy next than a comparison spreadsheet will.
Where to go next
Once the first workflow is in daily use, the next question is how to bring the rest of the firm along without colliding with deadlines, which we cover in a firm-wide rollout plan that fits around busy season. Insurance agencies follow the same sequence with different documents, and our guide for independent insurance agencies covers policy checking, submissions, and renewals. If you would like a senior person to build the first workflow alongside your team, you can get in touch.
Common questions
Can a CPA firm put client tax information into an AI tool?
It depends on the tool's contract terms, the firm's written security program, and the consent rules that apply to tax return information. CNA's 2023 guidance for the AICPA Member Insurance Programs tells firms to prohibit sharing confidential client information with generative AI tools and to review terms of service with counsel, so settle this with your counsel and your carrier before staff do it, and write the answer into a one-page rule.
Do we need to tell clients we use AI?
A July 2026 Journal of Accountancy article by an Aon risk consultant suggests firms consider adding disclosure language to all engagement letters saying AI tools may be used in providing services. Treasury regulations under Section 7216 also set consent requirements for disclosing or using tax return information, so have counsel review the wording.
Do we need a written AI policy before staff start using it?
In a 2026 Thomson Reuters survey, 35% of tax and audit firm professionals said they use AI tools their firm has not authorized, so the practical answer is to write a short rule now and improve it. One page covering approved tools, what client information may go where, who reviews output, and how use is documented in the file is enough to start.
Who in the firm should own the AI setup?
Name one partner or senior manager as the lead, and pair that person with whoever runs the firm's information security program. The lead approves tools, keeps the rule current, and decides which workflow gets built next.
Does using AI change who is responsible for the work product?
No. The AICPA tax standards say use of a tool does not absolve the member of professional obligations, and CNA's guidance for the AICPA Member Insurance Programs tells firms to supervise AI output as they would the work of any engagement team member.