A staff accountant pastes an IRS notice into ChatGPT and asks it to draft a response. The notice includes the client’s name, Social Security number, and tax year. She doesn’t think of it as sending return information to a third party, and nothing in her firm’s policy tells her otherwise.
Regulators now expect firms to have thought about that moment before it happens. In June 2026, the IRS Office of Professional Responsibility issued Alert 2026-19, which applies Circular 230 duties to generative AI and puts the burden on practitioners to decide whether their AI use triggers the §7216 disclosure rules. In May, the State Bar of California approved updated generative AI guidance for attorneys. Neither document lists approved tools. Both assume the firm has already made those decisions.
When small firms have an AI policy at all, it is usually one sentence: use approved tools and don’t share confidential information. That sentence couldn’t help the accountant, because her question was whether this specific data could go into this specific tool. The answer depends on both, so this guide is organized by data type.
Why “Use Approved Tools” Is Not a Policy
Tool-based AI policies work fine for a company that controls which tools employees use. Most small professional services firms do not. Staff have found ChatGPT on their own, Copilot showed up in their Microsoft 365 subscriptions, and someone on the team is probably using at least three AI tools that no one has reviewed. An AI policy that says “only use approved tools” without defining what approval means, who grants it, or what data is allowed in each tool creates the appearance of governance without any of the substance.
A data-first policy takes a different approach. Instead of starting with tools, it starts with what’s in your files. Once an employee knows that Social Security numbers cannot go into a personal or consumer AI tool under any circumstances, and that health information requires a specific signed agreement before it can go into any AI tool, they have an answer they can actually use. The breakdown below gives them that answer.
What Can Go Where
Find the type of data you’re working with, then check the verdict for the kind of AI tool you’re using. The bold verdict is the answer for employees. The detail under it is what the firm has to put in place before that answer becomes yes, which makes it a checklist for whoever owns IT or compliance. Treat this as a recommended policy, not a legal determination; your contracts, vendor terms, and regulatory obligations take precedence.
| Data your team handles | Personal and consumer AI (free or paid individual plans: ChatGPT Free, Plus, Pro; Claude.ai personal; Gemini personal) |
Business-tier AI (ChatGPT Business or Enterprise; other plans under a business contract with no training on your data) |
AI inside Microsoft 365 (Microsoft 365 Copilot, signed in with your work account) |
Rules behind it |
|---|---|---|---|---|
| Tax records, SSNs, financial account information |
NoNo business contract, no data protection terms, no client consent mechanism.
|
Conditions applyThe vendor must be named in your firm’s written information security plan, under a signed service agreement with data protection terms. Before using any AI tool with §7216-protected return information, evaluate whether that use constitutes a third-party disclosure requiring client consent under existing law. OPR Alert 2026-19 does not resolve that question but makes clear the obligation to assess it falls on the practitioner.
|
Conditions applyYour Microsoft 365 tenant must already appear in your written security plan. File-level permissions must be configured so only appropriate staff can access these files through Copilot. Review your engagement letters to determine whether AI use is addressed; if not, update them and evaluate your consent obligations under the existing §7216 framework before using Copilot with return data.
|
FTC Safeguards Rule (16 CFR Part 314); IRS Publication 4557; OPR Alert 2026-19 (June 2026); IRC §7216 and §6713 |
| Patient health information (PHI) |
NoNo business associate agreement is available for consumer AI plans. This applies regardless of what the patient record contains.
|
Conditions applyThe vendor must sign a business associate agreement that specifically covers the product you are using. For ChatGPT consumer and business subscriptions, no BAA is available. Enterprise and sales-managed Healthcare plans do offer a BAA, as does OpenAI’s API through a separate self-service BAA pathway for eligible API usage. These are distinct from the consumer and subscription products. Confirm BAA coverage for the specific product and configuration before any PHI enters the tool.
|
Conditions applyMicrosoft supports HIPAA compliance for properly configured enterprise Microsoft 365 Copilot services. Verify that your contractual coverage applies to the specific Copilot services you are using, noting that web-search queries fall outside BAA protections. Your IT configuration, not the agreement alone, determines compliance.
|
HIPAA Privacy Rule (45 CFR Part 164); HIPAA Security Rule; HHS guidance on business associates |
| Privileged or confidential legal material |
NoIn a 2026 federal decision (S.D.N.Y., United States v. Heppner), a court rejected privilege claims over consumer AI exchanges under the specific facts of that case. More fundamentally, consumer AI plans typically lack meaningful confidentiality commitments covering your inputs, which weakens any argument that the content was shared in confidence. Review the terms of any specific product before concluding otherwise.
|
Conditions applyThe contract must include confidentiality terms and confirm the vendor will not train on your inputs. Client consent may be required depending on the retainer and outside counsel guidelines. California attorneys must apply State Bar 2026 Practical Guidance tests before using any AI tool with client matter data.
|
Conditions applySame confidentiality tests as business-tier AI, plus a review of any client retainers or outside counsel guidelines that restrict AI use. Confirm that Copilot’s data stays within your Microsoft 365 tenant and does not reach external services without your control.
|
ABA Formal Opinion 512 (July 2024); Cal. RPC 1.6; Bus. & Prof. Code §6068(e); State Bar of California Generative AI Practical Guidance (2026) |
| Government contract data (CUI) |
NoConsumer AI has no FedRAMP authorization. Sending CUI to a consumer tool is a reportable incident under most government contracts.
|
NoStandard business-tier AI, including most enterprise plans, does not meet FedRAMP Moderate authorization or DFARS 252.204-7012 requirements. There is no self-serve path to compliance here.
|
Verify before useCommercial Microsoft 365, including standard Copilot, does not meet CUI handling requirements. Whether GCC, GCC High, or another environment qualifies depends on your specific contract, the CUI category involved, and the applicable authorization baseline. Microsoft’s government cloud documentation distinguishes between these environments and their eligible use cases. Confirm the acceptable environment with your contracting officer before any CUI enters any cloud AI tool.
|
DFARS 252.204-7012; NIST SP 800-171; CMMC (if applicable); your specific contract terms |
| California consumer personal information |
NoNo CCPA service provider contract is available for consumer-tier AI tools. Using them with personal information creates a “sale” or “sharing” risk under CPRA.
|
Conditions applyYour contract must include service provider language that restricts the vendor from using the personal information for their own purposes. Disclose AI tool use in your privacy notice. If AI is used to make significant decisions affecting consumers, California’s automated decision-making rules may apply.
|
Generally OKMicrosoft’s standard commercial data processing terms generally qualify as a service provider arrangement under CCPA. Keep file permissions tight and document the basis for your assessment. Review Microsoft’s current terms if your privacy notice has not been updated recently.
|
CCPA/CPRA (Cal. Civ. Code §1798.100 et seq.); California Privacy Protection Agency regulations |
| Internal business information (no client data) |
Limited useDo not include anything confidential. Turn off the setting that allows the AI provider to use your conversations for model training, where that control exists. Check your plan’s current terms; default settings vary.
|
Generally OKBusiness-tier plans typically confirm they will not train on your inputs and include data protection terms. Use judgment on what counts as confidential.
|
Generally OKFor most internal workflows, Copilot processes data within your Microsoft 365 tenant. Web search, connected third-party apps, and certain Copilot features may route data through external services. Internal drafting, summarization, and analysis without client data is generally appropriate use.
|
Your own policy; applicable NDA and confidentiality obligations to clients, partners, or vendors |
These recommendations are a starting point, not a legal opinion. The rules behind each recommendation change when vendors update their terms, regulators issue new guidance, or your specific contracts create stricter obligations. Date-stamp any policy you build from this and review it every quarter. Industry-specific notes appear below.
What Actually Differs Between Tool Types
The recommendations above turn on four things that change depending on which kind of AI tool an employee is using. Understanding them helps when a vendor releases a new product or you need to evaluate a tool that doesn’t fit neatly into one of the three categories.
Training on your inputs. Personal and consumer AI plans typically reserve the right to use your conversations to improve the underlying model, and that default varies by plan and by the settings you configure. Business-tier contracts and Microsoft 365 Copilot contractually commit to not training on your organization’s data. That doesn’t mean your data disappears from their infrastructure, but it does affect how it can be used.
Data retention and who can see it. Consumer tools retain conversation history that may be accessed by vendor employees for safety and abuse review. Business contracts typically limit that access and define retention periods. For most Microsoft 365 Copilot workflows, data is processed within your tenant and subject to your existing data governance. Web-search queries routed through Copilot features operate under different data-handling terms and may involve external processing. The distinction matters most when client data or PHI could appear in prompts that trigger a web search.
Signed agreements. HIPAA requires a business associate agreement before a vendor can receive or process protected health information on your behalf. The FTC Safeguards Rule requires tax preparers to have service provider agreements with written security requirements for any outside party that handles customer financial data. Consumer AI tools will not sign these agreements. Business-tier tools may or may not, depending on the specific plan and vendor.
Accountability when something goes wrong. If client data enters a consumer AI tool and a breach occurs, you are unlikely to have meaningful contractual recourse, and the vendor’s obligations to you are typically limited to their standard terms of service. With a business contract, you have defined breach notification rights and liability terms. That distinction matters most when explaining an incident to a client, a regulator, or a malpractice carrier.
The Copilot Permissions Issue
Before turning on Microsoft 365 Copilot, clean up your file permissions. Copilot can surface any file a user already has access to. If your organization shares documents broadly inside Microsoft 365 and an employee’s permissions reach files they shouldn’t normally handle, Copilot will find those files and include them in responses. The tool does not create new access problems. It reveals the ones you already have.
A Copilot readiness review typically involves auditing who has access to what inside your Microsoft 365 environment, tightening overshared files and SharePoint sites, and confirming that sensitivity labels or access controls are in place for your most sensitive content. If that work has not been done, rolling out Copilot first creates more exposure, not less.
Industry Notes
The recommendations above apply across industries. The notes below call out the specific obligations most likely to affect firms in each sector.
OPR Alert 2026-19, issued June 24, 2026, applies Circular 230 duties to generative AI use and draws practitioners’ attention to the existing §7216 and §6713 disclosure framework. It does not create a new, standalone AI-consent requirement, but it does require that firms document AI tools in their written security procedures, supervise AI-generated work product before it reaches clients, and ensure AI-assisted billing accurately reflects the work performed. The underlying question of whether feeding return data into an AI tool constitutes a §7216 disclosure to a third party remains formally unsettled, but the alert makes clear practitioners must evaluate it before proceeding.
The immediate action is to update your engagement letters and written information security plan. Most engagement letters predate AI tools entirely. Review whether your existing terms address AI use or whether clients should be notified. If you determine that your use of AI with return data triggers existing consent obligations under §7216, build that into the engagement workflow, not as an afterthought. Consult qualified tax counsel on how these requirements apply to your specific practice and tools.
California attorneys have two layers of current guidance: ABA Formal Opinion 512 (July 2024), which confirms that Model Rule 1.6 confidentiality duties apply to AI use, and the State Bar of California’s updated Generative AI Practical Guidance (2026), which was revised at the California Supreme Court’s request and addresses agentic AI tools that can act with minimal human direction. The guidance is not binding but represents the bar’s current position on competence and confidentiality obligations.
Before using any AI tool with client matter data, check the client’s retainer and any outside counsel guidelines. Institutional clients increasingly include AI restrictions in their engagement terms. A tool that meets all other tests may still be prohibited by the specific relationship. A 2026 federal decision from the Southern District of New York (United States v. Heppner) rejected privilege claims over consumer AI exchanges under the facts of that case. Privilege analysis in this area is still developing. The more fundamental issue is that consumer AI plans typically lack meaningful confidentiality commitments covering your inputs, which creates a disclosure problem independent of privilege doctrine. Review the specific product’s terms before concluding otherwise.
No patient information goes into any AI tool without a signed business associate agreement covering that specific product. For ChatGPT, consumer and standard business subscriptions do not include a BAA. Enterprise and sales-managed Healthcare plans do, and OpenAI’s API has a separate BAA pathway with self-service eligibility for qualifying API usage. These are distinct from ChatGPT subscription products. For Microsoft 365 Copilot, verify that your contractual coverage with Microsoft applies to the specific Copilot services and configurations you plan to use. Microsoft’s HIPAA documentation identifies specific service exclusions, including certain web-search queries processed through Copilot features. Review your current agreement against Microsoft’s published HIPAA guidance before allowing PHI into Copilot-connected workflows.
The BAA is the prerequisite, not the finish line. HIPAA also requires administrative and technical safeguards: access controls, audit logging, minimum necessary use standards, and breach notification procedures. Configure your tools accordingly, and document that configuration.
Controlled Unclassified Information is subject to DFARS 252.204-7012 and, depending on your contract level, CMMC requirements. The safest policy is to prohibit CUI in any AI tool your firm has not specifically approved for it, and to approve a tool only after verifying it against your contract, the CUI category involved, and the required security controls and authorizations. Consumer plans and standard business-tier plans will rarely pass that check. Commercial Microsoft 365, including standard Copilot, is generally not the right environment for CUI; whether GCC, GCC High, or another environment fits depends on your contract terms. Confirm the requirement with your contracting officer, not with a product vendor.
The definition of CUI is broader than most contractors realize. It covers export-controlled technical data, certain financial information about federal programs, law enforcement sensitive information, and other categories defined in the CUI registry. When in doubt, treat it as CUI until you confirm otherwise.
How to Roll Out a Policy That Employees Actually Follow
A policy your team doesn’t know about produces the same outcome as no policy. These five steps take a firm from no AI governance to a working framework in a few weeks, without requiring a large IT project.
Ask staff directly. You will find more tools than you expect. The list should include browser extensions, apps downloaded onto personal phones or tablets that employees use for work tasks, and AI features embedded in software they already use (many productivity tools have added AI capabilities without announcing them). You cannot govern what you haven’t counted.
Sort what your firm handles into the data types above. Most professional services firms handle a mix: client contact information, financial records, health information (in some practices), legal documents, and internal business data. The classification work takes an hour and makes the policy immediately usable. If your firm never touches a data type, leave it out of your policy.
Document the tools your firm has decided to permit, the data categories those tools can receive, and the conditions attached to each. Include a process for requesting access to new tools, because staff will keep finding new AI products whether or not you have a formal evaluation path for them.
For any tool your firm decides to permit for client data, confirm that training on your inputs is disabled, that the vendor has signed the required agreements (BAA, service provider terms, data processing addendum), and that the tool appears in your written security plan. For Microsoft 365 Copilot, audit file permissions before turning it on. For AI tools that allow it, disable the setting that saves your conversation history.
Walk staff through the data types and verdicts at your next team meeting. The goal is a clear answer to the question they will actually face: “Can I put this in here?” Document the training date. Set a calendar reminder to review the policy in 90 days, because vendor terms and regulatory guidance both change faster than most policies are updated.
Not sure what data your team is putting into AI right now?
Vision Quest Cyber’s AI governance services include an AI data exposure review that identifies what tools employees are using, assesses what data categories are reaching them, and tells you where your firm’s exposure is before you need to explain it to a client or a regulator.
Schedule a 15-Minute CallSources: IRS OPR Alert 2026-19 (June 24, 2026): irs.gov • IRS Publication 4557: irs.gov • ABA Formal Opinion 512 (July 2024): americanbar.org • State Bar of California Generative AI Practical Guidance (2026): calbar.ca.gov • HHS Business Associate Guidance: hhs.gov • FTC Safeguards Rule (16 CFR Part 314): ftc.gov • DFARS 252.204-7012: acq.osd.mil
