Secure AI for Accounting | How to Safeguard Your Clients' Data Within Claude, ChatGPT, and More

Perfect. Hello, hello, hello everybody and welcome to an episode here where we're going to be discussing secure AI for accounting with our guy Brad Messner. For those of you that don't know Brad Messner, he is an enrolled agent and national speaker who has been spending 30 years in the intersection of tax, technology, and security. He actually runs the 3rd generation of his family practice, which he's modernized with automation using a lot of tools that we love and use as well. Before that, he actually built and sold a 30-person technology company. He teaches cybersecurity and AI implementation at accounting conferences nationally, and he has been called as an expert on multiple accounting firms' data breaches. He also spoke recently before the United Nations boards on AI, which got him some, uh, interesting popularity, as we were discussing offline here. And when it comes to AI, at least there's no one else I know that's kind of a better person to ask questions, so that's why I decided to bring him in to talk about AI and security. So, Brad.

Excellent. Thank you so much for having me.

Yeah. All right, so perhaps let's start walking us through your experience in that United Nations speaking gig you got, and I'm sure you can kind of give us some light there and like what was discussed around AI, what are like the national leaders Worried about, or where do they see AI heading?

Yeah, no, I mean, and honestly, it was truly the wildest experience of my life. I mean, when you see it on TV and you see it in movies, and I think that was the craziest part, is these are the scenes and these are the environments you see in those movies, and they usually have some sort of negative impact. They're trying to blow it up or they're trying to do something horrible, but the environment is really, really Fast-moving, fast-paced. It's one thing after another. They do not waste any time. But this whole event last week was designed specifically around trying to solve or come up with an AI governance solution globally. What that means is, how do we as a society of people approach AI and how do we protect ourselves and protect the rest of essentially humanity. And they had commissioned an entire panel of experts, scientists, economists, academics, all of these experts to prepare a report on where things have been and where things are going. And that's where the panel started. And from day one, and this I think is the biggest message to take away from the event, From the very first introductory speech, it was the message of AI forward. We are here universally. There was not a single country that was stepping forward saying we do not want this. There was not a single country stepping forward saying this is not something we need to want or should move forward with. However, Every single time it was brought up, it was followed immediately by the points and questions of what is it going to do to the world?

Yeah.

And honestly, that's where, and this is, and I see a lot of fearmongering. I see a lot of comments online like, oh my gosh, AI is going to replace this industry and that industry. And I've taught a lot in computer science and they've taken some pretty big hits.

Yeah.

I teach a lot in accounting and we're not seeing any massive hits there. But the biggest message that they pushed out other than we're moving forward is there's extreme concern that this is going to have global economic impact.

Yeah.

So there's a lot of fear that as these systems are growing, that there's going to be a negative economic impact globally.

Yeah.

And I think what scares a lot of the rest of the world, and I'm saying this as a person who lives here in the United States, what is scaring a lot of the rest of the world is the extreme lack of access and inequality of access. So for example, at this very moment, the United States owns and controls 80— sorry, 75% of the global compute power. So 75% of all AI processing goes through the United States.

Yeah.

Next is China with 15%. And there are some, like, even continents. So the continent of Africa has less than 1% of global compute power. So the real question is, how much does this become a big tech versus countries versus people working together solution? And that's where a lot of people are worried or nervous is just how do we create some sort of equalized process moving forward? But it was a phenomenal event.

Yeah, but sounds like essentially they're fully embracing it, but The fear is still there, like what economic impact is going to happen. Yes.

And with that, then, of course, their whole focus is on creating these AI governance and policies and some sort of elevated privilege to access. So I think the funny thing that hits me, and I truly mean this is funny because it's the huge disparity between here, In the United States, like I'm seeing one person after another. They're using AI to to generate all these funny memes and pictures and and all of this just like entertainment. Meanwhile, there are countries in other regions who are hoping and begging for access to basic models to just run like food or agricultural simulations to try to improve their. their food output. So it is, it's a very different angle. And I will say, for one, it made me feel very, very privileged to be in the United States because it— we kind of take advantage of what we have.

Yeah. Trying to make this land for the audience a little bit, I think there's perhaps some analogies we can map between a country thinking about the government's between countries, but also now thinking about a firm, right? A firm owner that has perhaps a team and has to think about what impact will this have for the people I employ. Um, and I think the fear is the same, and firm owners should be starting to think about what governance rules would kind of govern behavior as it relates to AI in a company. And what's our decision?

Exactly. And we see a lot of the big firms and we see the public firms talking about investing not even millions, like even some getting into billions of dollars in designing these systems and models. It kind of makes a firm like ours, who we only have 3 employees, feel like, well, what can I even do or offer? And that's where I think AI— and this was the ending message from last week— was Unilaterally, people believe AI can be the great equalizer. And I think that is such a powerful message for a lot of firms who are trying to find their uniqueness, who are trying to find how they can compete with other firms who maybe have massive manpower or large-scale technology. AI can serve to put you in that same bucket, to allow you to compete and offer differently. So it really does. So it's such a huge opportunity for any firm, no matter what their size or adoption style.

Yeah. Let me ask you a question. I'm going off script here, but when you say that great equalizer, I think about both the good and the bad of it, right? The good is like, I can compete with the big guys, but I also think it becomes difficult to differentiate yourself in the market. And now customers and clients like see you as perhaps an alternative. I can just do my taxes or do my books with AI. What's your take on how firms should be thinking about differentiating themselves?

No, and it's awesome because I attended a conference last month and that was a big part of the message. And it wasn't necessarily the theme of the conference, but as I sat in more and more sessions, that was really what a lot of the underlying message was. Is as we're all getting access to technology, what separates us from someone else is if I have the same CRM tool, if I have the same software, what is my difference compared to the firm 2 states over offering the exact same setup? And then to throw in, like you said, well, someone is sitting there saying, well, I can just drop my tax documents into Claude and it will pull everything and With at the moment 97-ish percent accuracy prepare a return. I think what we're going to see is the actual value of the human coming forward is what can we find that separates us? What makes Brad's system more uniquely Brad that someone wants to work with him versus someone down the street? And I think the way we use technology, just not the fact that we are using it, is going to become more important. So it's going to be more about the strategic use, not just the access to it. Right on.

Well, I do want to get a little bit more tactical and to answer some of the questions we kind of discussed earlier, and I'm sure many of the people in the audience will have. For the audience, if you have any questions as we go, feel free to drop them in. I see Don here that said that he lost The stream, but he refreshed the page and that got fixed. If any of you are having issues, feel free to comment in case we can get those issues fixed. But here's the first question, trying to get a little bit more tactical. As we think about the current big players, OpenAI, Anthropic, perhaps Perplexity and Gemini, the thing that keeps coming up in conversations with accounting firms is which one is more secure? I don't know if that's an easy thing to answer, but how should we be thinking about what actually makes one AI tool more secure than another as it relates to being able to put client data or just using it on a daily basis?

No, and yes, that is absolutely probably one of the biggest rabbit hole questions that's out there because we can keep going deeper and deeper. But if we really do look at the— if we really just look at the generalist platforms out there, there's a couple key things that we need to look at. Obviously, the first one, and this has been thankfully a very unified message across our industry, I feel like, is the access and usage of the free or personal versions is a no-go. So just hopping into any of the platforms on a free level is a no-go because They're very honest that they're using that platform, that process to train their systems, and that is something we cannot have. But when we move into more of the team or enterprise-level solutions, this is really where digging into the settings of the actual environment matter. But again, even each environment is not the same. So for example, Again, we'll talk details and just because we talk one or not doesn't mean it's different. It's just where we go with this. For example, Google, Perplexity, and OpenAI, they're all very solidly bringing forward options that allow you to limit where and how your data is processed. For example, when I go into ChatGPT, I can designate and assign that I want my data only stored in this location or region, and I only want my data processed in these geographic regions. And that is very important because a lot of industries, especially financial services, require disclosure if it leaves certain geographic regions. Where it gets a little bit more complicated is systems like Anthropic. That's Claude. Claude, if you want to limit to only the US geographic, they charge an upcharge because the compute power and capability is slightly more expensive in the United States. So if you're in a non-US area, Anthropic at the moment is not charging an upcharge. So if you're someone who's over in the EU, Anthropic, you can limit down to your region and you're set to go. If you're in the US with Anthropic and you need to limit to only US processing, then you're going to be paying— it's a 1.1 multiplier the last I checked. Not significant, but you need to make sure you handle that. The ugly one, and I can't believe I'm saying this in 2026, the ugly one out of the whole platform is actually Microsoft. So Microsoft is really good with storage, with M365, with all of those of allowing geo-region locking, meaning I can say what region I want my data kept and managed. The ugly piece of Microsoft, and this to me makes it a complete no-go, if you are using Microsoft Copilot, Microsoft Copilot currently does not have an option to limit only to your specific region. They have an internal routing algorithm that says, hey, if it's the middle of the night in Asia and the systems are processing at a much lower rate, but the US has a very large processing load, They will offload to the GPUs and processors over in Asia to move the processing forward. And that is not something at the moment that you can limit or contractually restrict in Copilot. So to me, and again, that just to me, that makes any use of Copilot specifically a no-go for a US provider.

Interesting. It's so funny because the things that I think I've heard in this space is that Copilot's safer because it's Microsoft.

Well, and I think a lot of people think because, and I'll be honest, I mean, I'm a Microsoft firm. I have a lot of, I hate to say faith because that's kind of what it turns into, but I have a lot of, I guess, trust in the system and identity management that Microsoft has put in place. The problem is the Copilot team is a very different vibe and entity in Microsoft, and they're struggling so hard to find their place. And this is just one of those things where the Copilot grouping is separate from Microsoft. So Microsoft, I'm still very on board with. I think their solutions are very secure. But when we move into Copilot, the GPU offload, I think, is the scariest part. Because again, if I'm touching tax return data, specifically in regard to IRS in the US requirements, that to me rules Copilot as a no. But if I'm, again, if I'm in another region and maybe I'm allowed to put data in another region, then Copilot would be just in the same bucket as everyone else. It does depend on regionality a lot.

Let me summarize that. It sounds like one of the things that matter for an AI company to be more secure, it's the ability to choose where and how your data is processed. And sounds like both OpenAI and Anthropic allow you to do that, but Copilot doesn't.

Correct.

Beyond where the data is stored and how it's processed, is there anything else that we should be looking into to assess how secure a particular AI tool is?

I think some of the bigger items are, again, make sure that you're on an enterprise-level solution. Make sure you're on one of the solutions where they're guaranteeing contractually to not train and not use your data. But I think the other thing we— and we're going to talk about this in a moment with some disclosure stuff, but I think the other piece we really have to watch for is just because there's a contractual requirement, doesn't mean things don't break. I'll pick on Copilot for an option for a moment. Copilot last year had at least 6 different data breaches. Google with Gemini a couple of months ago had an internal— what we're labeling an internal firewall breach. They were not breached. There was no real data that was externally exposed or attacked, But what happened was the walls between users were taken down. What that allowed me as Brad to do was if I knew how and knew the proper ways to prompt, I could actually start accessing some of your content, Isaac, from within my Gemini environment.

Interesting.

Now again, there's a contract around that, but We've yet to really see anyone pursue legal action over a couple-hour internal firewall being down. So there's just a lot of unknowns still floating out there. But that's, I think, the big thing is even though we're still using these enterprise solutions, the tech— the technical oopsie still happens.

Yeah. Essentially, a contract is not a guarantee that The contract that they'll be able to do.

Correct. It essentially means that you have the right to seek damages if that contract is breached.

Yeah.

And then the tough thing is you have to be able to prove it. And that is still the scary thing, even from my perspective, with most of these AI systems, is it moves into what we call the black box. And once things are processing inside of these environments, we don't know what's happening. We don't have audit trails, we don't have access logs. So I could be sitting there accessing or seeing some of your content and no one would ever know. We're just being promised and guaranteed through these contracts that that's not happening.

Yeah. Okay. I mean, that's a good segue for my next question, which is around like If I am a firm owner and I'm evaluating, you know, rolling AI for my entire team, which many firms, something that's top of mind for them, is there anything I can do from a due diligence standpoint to at least be more comfortable rolling it out?

I think the big thing is being very cautious with the, what I'll call the emerging frontier offerings. Like the brand new. And these are the ones that I get a little scared on every time I hop on social media because someone will be there and they'll be like, this came out 6 minutes ago and I've already run 500 models through this. And that's scary a little bit because when these are emerging, we truly don't know. And I think that the ideal review of that is look back in June of this year when we saw Mythos and Fable released and then pulled back. Is as these models are being explored, having that internal team with these companies is very different than having millions of users out in the wild. So I think a lot of it is being very, very cautious in using or playing with the emerging models. But when it comes to saying like, we want to start leveraging these tools in-house, the big thing, and I know this is the part none of us love doing, is really taking the time, selecting the tool, and then going through the proper configuration and setup. A lot of times we get so excited because we just wanna hop in and start doing, 'cause I want this and I want that and I really wanna see how it handles this. But then we miss the steps such as, again, requiring multifactor authentication, requiring that we've ensured that we've enacted all the steps to Limit the geolocation. So to me, the big thing is really we need to invest the time as soon as we hit that purchase button before it goes to anything else to make sure the setup gets correct. And that is that shiny squirrel syndrome. We all wanna move on to the funny, the fun and exciting stuff. No one wants to sit there fiddling in configuration of a, of a system after they've just spent some money on it. So I think that's the biggest due diligence is making sure that you've properly configured it because that's really where a lot of the breakage is going to happen.

So proper settings and just some cautious— some caution with like the newest and latest.

Correct.

Perfect. Mary actually asked a question that I think is relevant for what we're talking right now. Where did you specify the region if you're allowed to do so? I'm assuming that's going to vary by Correct.

Each tool is gonna be a little bit different. So it's gonna be a matter of whichever tool you select. And here's the other unfortunate piece based upon which, which option of the tool. So if you select the Teams versus the Enterprise versus the Professional, each one of those is gonna have a different set of options as well. So it, it really is gonna be a matter of digging into the settings and configuration. And if you can't find it, I am sure if you reach out to myself or Isaac, we will, we will, we will guide you in the, in the right direction to find it.

Yeah, perfect. All right, let's talk about tax compliance and the IRS 7216. This is something that's started like to come up so much. I know this is relevant in particular for US firms, but this is something that keeps coming up again and again for Tax firms in particular. What is the IRS 7216 and why is it— has it started coming up so much?

Okay, so 7216 has been around for decades, so this is not something new. And honestly, the conversation around AI is not a new conversation with 7216. We've dealt with it with cloud environments, we've dealt with it with all of these software products that have come out over time. So this isn't a new, like, oh my gosh, this appeared out of nowhere. It's the conversation keeps repeating itself. So 7216 is a section of code that was designed years ago to protect the purposeful or even accidental disclosure of tax return information. So think about it this way. Years ago when people started getting access to computers and now, oh my gosh, we have data. People's minds started going wild and they were like, oh, I could start marketing. I could start doing something with this data to expand my business, to grow my business. And people just started without consent marketing to people and using their tax return data for essentially nefarious or profitable reasons that weren't really the original intent of why someone shared that data. So 7216 was created. It is a very, very formal process. So it's not just something where you get them to sign off on this little— it is an actual specifically formatted document that does have to be signed for every individual process, product, and so forth. So this is where it gets really picky because I can't just have one 7216 that covers everything. If I have 4 disclosure issues, I may need 4 separate 7216s. And where this gets ugly is it is actually a criminal statute. So if I purposefully or accidentally unknowingly violate this, there are both fines and risk of actual imprisonment for this violation. And of course, we all know as soon as we hear those terms, that's where a lot of the fearmongering and worry starts popping up. And where we've seen this grow a lot over the last couple of months has been around the usage of AI. What is considered disclosure? What is not a disclosure? And of course, we have people on both sides of the aisle. We have people saying, well, this is a dated process. We don't need to worry about this. We're not really in that same spirit of concern anymore. And to me, that's a very dangerous move because even if we're not in that same spirit, it's still a regulation we have to follow. But then we have people on the other side who are going to a very large extreme saying every single time we touch data, we need a disclosure every single time we do something. And the honest truth lies in the middle. So the reality is that 7216 is about the tax return information that we have and what our permitted use and disclosure or sharing of it requires.

Yeah. So ultimately it sounds like it's just a consensual use of information. Correct.

I'm sorry.

Go ahead.

No, I was going to say, think about the next time you go to a doctor office. You have to sign all of these HIPAA disclosures. You have to decide who's allowed to call and access your data, who they're allowed to share your data with. That is the exact same idea as a 7216. So this is not a thing that's only for us. The idea of these disclosures is a widespread option across many industries. And I think the HIPAA one is the one that we're all very used to because you have to show up 10 minutes before your appointment just to sign all the paperwork.

Yeah. Now perhaps a more directed question. I'm sorry about putting you on the spot, but people sometimes ask, okay, I'm going to start using AI and I'm going to put tax return information in. Do I need to update or get client, like, direct consent as a result of that rule? What's your stance on that?

So, and this is where the details of 7216 come into play. And when we're talking 7216, I really wanna be super clear. Consent to disclose is different than our requirement to protect and secure data. So that's a whole separate requirement as far as protecting the data. This is just truly about where are we allowed to use the data. And what it comes down to is there are location requirements. Then there are usage requirements. For example, if our data is leaving here connected to the IRS, if our data is leaving the United States, we're going to need consent. If we have an offshore team that we work with, we're going to need consent. Again, I mentioned Copilot. If I'm using Copilot and there's that risk that my my data may move into their model in Singapore. I'm going to need consent. We have the location. If it is in the United States, so let's say that I'm going to work with John and John is located in North Carolina. If it is connected for the right reason and purpose, he's in the United States, I do not need consent. to share your tax data with John for tax return preparation. So the first piece is, where's the data going? The next piece is, what is the use of the data? If it is connected to tax return preparation, then we are good. We do not need consent. If I'm throwing the data into Drake, we're good. If I'm using a web-based platform, like Intuit has several web-based platforms, we're good. I'm using it to prepare a tax return.

Yeah.

Where I'm not good is if I am uploading it to, again, do marketing, or I'm uploading it for— where it gets a little risky, and this is where we really do have to be careful. I own a tax preparation business. I decide next year I'm going to start offering financial services. I want to start offering financial planning. That is no longer tax return preparation.

Mm-hmm.

So I would need, as silly as this sounds, I would need a 7216 consent to use a client's tax information by myself in my firm to use it for financial planning.

Got it.

So it's all about connected. And this is where, again, and I really do, I know this sounds like a pawn-off move, but if you're mixing a lot of pieces, it may be worth hiring a lawyer for an hour or 2 to talk through the exacts because it's already been declared by the IRS that practice management falls under tax return preparation. So if I'm using— let's just say I'm using an online— again, I'll just throw— let's say I'm using TaxDome and they decide that TaxDome is going to start using AI to prioritize the order in which I need to do returns. So it's going to sit there and be like, oh, look, here are some entities that they're going to get prioritized over some other Because that is a practice management system linked to tax preparation, I do not need consent for that.

Nice.

However, if I'm using tools or systems for something else, then I do need, which is why a lot of these bank products. So if I, if I'm gonna try and do advanced payments and things, we need a 7216 for that because that is related to payment services Not tax preparation.

Got it. Okay, so it looks like as the use case, it's tax prep, and the location of data is the US. There's not really an additional consent that we need at the moment.

And where you really need to be careful is in the, the middle blind areas or the gray areas. So for example, tax planning. I spent 8 hours yesterday speaking on tax planning at a conference. It's such a hot topic right now. And the reality is when we're tax planning, it's more about the timing of things. So for example, let's say that Kristen hires me to just do some tax planning for her. There is not going to be any preparation. It is truly just she knows I'm excellent at R&D credit. So she wants me to do some planning around this. When I receive her data, that is not tax return information at that point because I have not been engaged as a tax preparer. So as wild as it sounds, I do not need any disclosure from Kristen for that data. I can do whatever, again, within the security reins. I can, I can do what I want to with that. But if they are a tax preparation client, and now I'm adding on tax planning. So let's say they've been doing tax planning. I mean, we've been doing tax prep for 4 years. All of a sudden now they're at the point, I think we're ready to retire. Can I, can I engage you for a tax planning engagement? In order to help me ease into retirement. That would require a 7216 because it is no longer— because I'm using tax return information as with me as that tax preparer. And now I'm using it for a non-tax preparation setup. So it really does. It's very, very, very specific about those details. And I have no problem if anyone ever reaches out talking through exact scenarios or specifics. But if you play a lot in that area, then I think that's an area that you may want to just get any clarification from a lawyer if that's going to come up.

Yeah, perfect. Awesome. Thanks for clarifying that. Christine says here, that's a great distinction for tax versus tax planning. Um, I'm sure it is. Now, and I asked We were talking the, the last week about a new article that came up.

Mm-hmm.

The IRS.

Yes.

Is that related to 7216? Has that— did that change your perspective of the IRS position on AI? And if so, how?

So yes, so, and, and I want to clarify because there's actually been 2 documents and I think we're all ignoring the first document. The first document actually came out all the way back in February. And this one I think is super interesting because it is actually the IRS's policy on how the IRS uses AI. And I think that's a really interesting read if anyone is really wanting to see that. But yeah, so back in June we had issue 2016-19 come out. And there's a lot of details in there. A lot of people are focusing— there was specific wording about hourly billing and what we're allowed to bill hourly for when we use an AI. And a lot of people are focusing on that, and I don't want to downplay that. But if we move down a little bit further, they do talk about data risk and disclosure. And this, I think, actually highlights more than anyone has been discussing, because I've always said from, from years ago when I got heavily into this, I don't feel like this is really in the IRS's wheelhouse. I mean, yes, they need to remind and ensure that we stay protected, but if we look at the bigger picture, If we look at, there are much more strict and stringent security requirements than what like a 7216 requires. So I think we're kind of, what's the old phrase? We're, we're missing the forest by looking at the trees.

Yeah.

But if we go back to this, this notice, there's a really interesting line in here that I think is hinting at the direction the IRS is really looking to go. And I'm gonna read the, the verbatim here because I think that's super important. It says generative AI platforms may present risks regarding the unauthorized disclosure of sensitive taxpayer information. I think we can all agree on that, especially when data is uploaded to unsecured or public systems. Practitioners must strictly handle all client data using only secure enterprise-approved AI. That I think is the most telling piece of that entire message. And it was like hidden towards the bottom because they're not saying we can't use generative AI here. That was their easy win here. They could have just said, we believe, or according to this, generative AI is a risk. Instead, they stated strictly handle client data using secure enterprise-approved AI. That is a hat tip to the FTC safeguards rules, and that is pushing that off to our security plans to say you're responsible for your due diligence. You're responsible for ensuring that you are selecting the right tools, that you are using these right systems. So that to me was the IRS very clearly saying, we kind of are washing our hands of this. We're not out of the game. This is still in play, but it is your responsibility to ensure you're using secure enterprise-approved. So where we'll have a problem with that is back— going back to that shiny squirrel and the frontier models. If someone is out there playing with a new model, that may not be an enterprise-approved secure platform just yet. It hasn't gone through the due diligence. It hasn't gone through those systems. But if I've sat here and I've said, you know what, I've done my due diligence, we've configured, designed, and approved This exact setup of Claude to work, then we're in the realm of what they're speaking to here. So I very much think that the IRS is moving in that direction, and their wording here is, is hat-tipping to that. They, they had every chance they could have to say, hey, look, you can't be doing this, or hey, um, this is where the 72 is going to slap you. Instead, they left it very generically open with wording that is not typical IRS wording, that is very much wording from the FTC.

I mean, it sounds like it's hinting at, again, something you brought up earlier, ensuring that we are cautious about the beta, alpha, newest features being released. Before they go into more like production and stable states.

Correct. And I think what is going to protect firms the best is having a very, very clear, and I don't want to say strict, maybe just a very, very clear and precise AI governance policy. And that I think is what people are missing in their security plans. And that is every time I see a new WISP or written information security plan, I kind of weep a little inside. Because I'd say 99 out of 100 of them, I'm not seeing any discussion of AI or these models or platforms. And with the amount that most firms are using, there should be a large section of the security plan that approaches and discusses this, which is exactly what the IRS is saying in this paragraph.

Yeah, I mean, that's a good segue for What is my next question, which, you know, you brought up multiple times already, that sometimes the details of like the setting or the consent or the disclosures are the trees of a much bigger forest that people need to pay attention to.

Yes.

Based on our conversations here, you suggested that that bigger, biggest, bigger forest is AI governance, as you call it. What is AI governance and what does it encompass above and beyond some of the details, settings, some of the things we've been talking about. Yep.

And I wanna say, as we're talking through this, AI governance is gonna be a sister policy to what is known as data governance, which has been around for years. Just no one liked saying that because it sounded so formal and official. But what AI governance is, it's really your collection of policies. Which guides you on how you decide which AIs get used, built, bought, how they get monitored, how they get configured, and ultimately then who is responsible or accountable for overseeing this. So it's kind of like, for lack of a better, it's kind of like a WISP just for AI. And the tough thing is, like I said, we all love playing. I mean, if you saw my non-work computer, you'd see so many crazy systems and models and test environments, but that's what the governance is designed to protect us from. And for a lot of people who are out there wanting to play this, like, that governance policy really should be the separation of like church and state, the separation of here's my real-world firm and data. and here is the environment that I'm going to do a lot of my playing and practicing on.

Yeah.

What I find to be very scary is this new push with a lot of the vibe coding where people are, and I love it. I'm a developer, so I'm vibing with the vibe coding. But it scares me when I see people building something on the actual environment where their datasets Because again, we know that AIs are not perfect. We know that they make mistakes and hiccups and hallucinations. So that real AI governance is what steps, how I'm making decisions, how do I protect everything as we're moving forward?

Yeah.

And some of it is local, some of it is your own firm, and some of it is actually governmental. What do we have restriction-wise in place? So within the AI governance, we would have to have accountability Or a 7216 where it applies.

Yeah, we have a good question here that Matt asked, uh, several minutes ago that would be worth, uh, walking through because I think it relates to what we're talking about. He says, are firms implementing an internal AI policy to instruct team members who want to redact or us? Also, are any firms giving clients an option as to opt in to their firm using AI with their data or opt out?

Okay. No, and honestly, Matt, this is an amazing question. So I'll actually address it as 2 separate because the second one, I can tell you in our firm, we do give the option. We allow people to say that for whatever reason they do not want that. And we feel that again, it's their data, so they have the right to choose. And we started that several years ago before AI. Because we use tools and not everyone likes the exact tools we use. I actually had a former Microsoft employee as a client, and they specifically requested that we not use, at that time, Azure as our backup system for their data because as a former employee, they had concerns over how that system worked. I think we're going to see more people having that opt-in or opt-out. The challenge we'll have with that is how in the world do you as a firm owner manage that process? How are you building systems and especially automation to say yes or no? And how are you specifically wording those questions? Are you saying, is it all right, or would you like us to use AI in your systems? Because There are firm owners who are using AI to manage their email inbox. Does that, like, so I think the wording and specificity of that disclosure or request is going to be important. But I know we're, we've been doing it for years just because we had a hiccup a couple years ago over that. Now, on the first point, when you say an internal AI, Let me put the question there again. So an internal AI policy. So I think there's a double-edged sword with this one because when we have a policy in place, we then have to have a system to manage and monitor it. And that gets really challenging, especially if you have teams that are remote and work from home. It's really hard sometimes to manage those things. But I would, I would rather see, are there ways that we can mitigate how we have to go about redaction and some of those things? So are there systems that we can use or ways that we could export data where we don't need as many other systems or, or as such of a worry to redact? And one thing I think we're going to see a little bit more of is I think we're going to see people deploying Internal systems themselves. So less of that cloud hosting. And I've seen a lot of people who have now recently built an internal redaction system.

Yeah.

Where it's just a really small AI model that they run in their own walls that they send documents through and it redacts those documents because then that never leaves their wheelhouse or their firewall. I think we're going to see these policies expand, but yes, there are definitely people who have policies already. I'm sure if you would like, we can absolutely get some samples and templates of those out there.

Yeah, definitely. Talking about redactions, we actually built a client sanitizer tool recently.

Oh, that is cool.

They had a requirement where they didn't want to use AI, so we kind of built it just off of like old OCR and just code and runs locally.

Um, well, go ahead. No, I was gonna say, I think you just brought up such a key point that we're missing in the whole AI conversation. AI doesn't have to be the solution to everything. There are still so many automation and, and technology tools that are actually more efficient and more accurate. But I think like, because AI's the new shiny, the shiny object everyone wants to use and play and it makes it easier. But no, there's, there's a lot of data exchanges and APIs that we built out a couple years ago. For example, we import from 2 different vendors at the moment, 2 different exchanges. We import all of the 1099 consolidated from those vendors. They had APIs. It was so much better than having to manually retype. Now with AI, it's more accurate than having an AI attempt to read and scan those. I think we still need to look at those other options. AI is not the only solution. In a lot of cases, why introduce more problems if there's another solution that could work? I think we want to keep that in focus as well.

Yeah, and it's something I'll be hammering home, so I appreciate you bringing pointed out, which is like the fact that we have AI doesn't mean we need to use AI to process the thing. Sometimes we can use AI to build the thing that then processes without AI moving forward.

Yes.

But going back to kind of AI governance, just trying to like put some notes for clarity for the audience, it's fair to say that essentially AI governance is both the kind of written stance of the firm on their policies, clarity on who's accountable for those, to keep those updated, and then making sure the team understands, correct, and seems trained on those.

And also the before, the during, and the after.

Yeah, um, but beyond, I guess, clarity on the who, training on the people, and the written policy, is there anything else This would also where we include that due diligence we talked about earlier.

So when we're, when we're looking and researching new tools, are, are, do they have the capability to comply with our policy? And if they're gonna require a, a variance or an exception to the policy, that has to raise a concern over, is this something new? Or is it a, an issue with the system that we're having to make an exception for? Because as these are growing, our policies are gonna have to keep changing because 2, 3 years ago, no one was talking about like Claude Cowork and having it come in and interact with our systems. So the first time that came up, that would've been a, oh my gosh, this doesn't fit our AI governance at all. But now there's a lot of firms who are touching and dabbling in that. So the governance policy would need adjusted during that due diligence process just to ensure that whatever we want to happen is going to happen. And the big thing during the governance really would be what we call the trust and IAM. IAM, or identity management, is making sure that we do have those protections in place.

Yeah, perfect. Well, great discussions, Brad. I think I'd love to start wrapping up here and move towards some Q&A for the people in the audience. We asked some of them, but we have more in the chat. I do want to like make sure the firms listening here today leave with an actionable next step. Of everything we've talked about, what would you suggest is their next best step to start moving to a more responsible and secure use of AI?

Yeah, so absolutely. I think step number 1, and again, it's never the exciting stuff that we start with, unfortunately. Step number 1 is really designing and creating that policy. Because without having that policy in place, everything else we do is up in the air. So it really is about creating that policy of What is permitted? How is it permitted? When do we need to have exceptions? What do we do with the data? That policy is number one. Then we really need to determine what are the actual hard security requirements that are going to be in place. And these are things such as the geolocation of the data, which systems allow the inhibiting, which systems allow multifactor authentication. Which systems will permit the security policy, which we probably already or should already have done in our security plan. So step 2 is actually probably a little easier than we were thinking because we should have a chunk of it already done.

Yeah.

Third part would be, again, starting that vendor due diligence. And this might be that catch-up phase. If you haven't done this in the past, it may be looking at what systems you have now And going back and performing that due diligence. And what I would warn with this one, check your credit card statements. I would not be surprised if there's a lot of people out there who started subscribing to different tools because it was really fun and cool 5 months ago, but they've forgotten about them and stopped using. So use that due diligence process to also double-check to make sure that your billing is on point.

Yeah, definitely. Perfect. Well, those are some good next steps for the audience there. Um, I know many of you have been asking questions and we're gonna dive in, so if there's any questions you have, feel free to drop them now. I will go through some of the ones that we haven't been able to answer quite yet, um, in the next couple minutes. So Cindy asked like, how required is the ability of having audit logs in your AI system? Setup.

So, and, and this is a tough one, and I'm going to say this is also based upon, um, any credentialing or licensing that someone may have. So for example, um, a non-credentialed preparer may have lower or different audit requirements as, say, a financial planner. So a lot of it is going to be— I would actually check with your organizations that are your highest overseeing, so like AICPA, CFP, some of those, and say, what are these specific logs? But I still go back to the, without the log, how in the world do you have any idea what happened? So part of our security plan before we even added our AI governance policy to it was we have to know every single time that client data is touched, by us or by any technology system, what happened with it, where did the data go, and why.

Yeah, that's fair.

The only thing we have is we don't require that on individual files for backup. We have one nightly log that says data was backed up, the number of files, and a list of the files. We don't update the log for each file every night because that would be a little overwhelming. To me, it's what are you gonna have to defend, which then brings us to the question of checking with your E&O insurance as well. Because if there's a breach or if there's a disclosure, you're gonna be having to contact them. And they may have different requirements based upon who you work with. So for example, I work with travelers a lot. They have some pretty strict requirements. requirements, but I also have a very powerful policy with them that protects me beyond anything. There's a lot of others that aren't as strict, so I would check with E&O as well as any of your specific federal governing bodies to see if they have specifics yet.

Excellent. Denise asks, now a lot of tax preparation tools have AI and AI agents as well as practice management. Does this need to have 7216?

Excellent question. And I love these type of questions because it shows we're actually thinking through the process and that's what we need to be doing. So if it is for tax preparation or practice management, we do not need that 7216 put in there. Where we have to be careful is, and this is where that due diligence comes in, if I'm working with a tool and that tool is sending my data offshore, then I may need a 7216. But if we're being honest, that may then be the question of, is it worthwhile continuing use of that tool if it means every time I work with a client I'm going to need a 7216? But yeah, for tax preparation and practice management, um, we do not need a specific 7216.

Sounds like it goes back to location and use it.

Yes.

The determinants there. Dennis had a follow-up. If we use SharePoint and OneDrive, does that expose a location risk?

Okay, so thank you for adding the location risk because again, risk of just accessing data versus location risk is different. So again, it goes back to the configuration and settings. I'll be very honest, we use SharePoint and OneDrive pretty heavily in our office. Because it is Microsoft, they do allow for you to limit the geolocation of your data. So just make sure under your settings, and I absolutely appreciate, I will apologize in advance, I know the Microsoft Admin Center is a hot mess, but you can set it up in there. The only thing I would warn is I would turn off the co- Copilot feature, because Copilot is the piece that, that does not, um, play nice with, um, with our geolocation.

Awesome. Uh, John asked a funny question, and he's related— uh, he's, uh, talking about specifically the clients that you may need to opt out. At what point does the cost of accommodating these folks see the value of having them as a client. In other words, am I going to deal with 1 or 2 people, Microsoft employee? Am I better off not working with them any further rather than putting rules and systems in place to accommodate them?

And I think that's an amazing practice management and just firm selection because we don't have to work with specific clients. I just love the fact— I love this client, so it's one that I did not want to lose. And I've actually worked with them for things like they've spoken to my classroom and things. So I did not want to risk that environment. But the more exceptions we put in place, the more complicated our world becomes. And the more complicated that becomes, the greater risk of, of just breakages we have. So I do think it's a great question to say, how many exceptions or how difficult or challenging of exceptions do we allow? And I think that really comes down to How much is that client going to be worth to the overall, whether it is just dollar amounts, whether it's reputation or marketing or any of that. So I love that question because it shows like that bigger oversight. But it is, it's a tough thing because I've seen people who say, I won't get out of bed for X amount per return. Then there are others who say, if they wink at me a certain way, I'm disengaging them. So it really comes down to that firm selection, and we tend to be more embracing, but I know there's a lot of firms that are very, very strict because they want their policy and they want their exact process.

Yeah, definitely. All right, Matt asked, uh, said, Isaac, I'd be interested in that local reduction tool you built. Can we connect? Definitely. I put my email address there if you want to reach out. And Cindy says, I would love to see some sample AI use policy templates. Do we have some? Can we provide some to the audience?

I have one. I'll have to go through and do redaction because it is my live one. I stopped using my— I had a template I was providing back when I owned a consulting firm. But it's been about 6 months since I updated it, so it's definitely dated. Um, but give me, give me a day or two and I can get that redacted and I can get it over to Isaac to share out for whoever would like it.

Perfect. Excellent. Well, thanks for your time, Brad. We are here at the hour. Uh, here, if you have any other questions, feel free to drop them now. Otherwise, it was a blessing, a pleasure to have you, sir. Very articulate and clear in your answers. So we appreciate you coming on to answer some of the questions people have.

Anytime you need.

Excellent. Well, Brad, thanks for your time then.

All right, thank you so much.

All right.