For much of the past two years, discussions regarding generative artificial intelligence (AI) in professional services seems to have focused on lawyers, and perhaps for good reason. Courts have sanctioned attorneys who submitted briefs containing fabricated case citations. In response to these and other mishaps, several state bars issued ethics opinions often applying existing professional obligations to AI such as technological competence, confidentiality, supervision, and billing. Those same themes, however, are increasingly relevant to other professional service providers, such as tax professionals, including employee benefit plan advisors in some cases.

When Do the IRS OPR Guidelines Apply?

The IRS has now made clear that ethics and compliance obligations extend well beyond litigation and the legal profession generally. In June 2026, the Internal Revenue Service’s Office of Professional Responsibility (OPR) issued Introductory Guidelines for Responsible AI Use in Federal Tax Practice (Alert 2026-19), explaining how existing Circular 230 obligations apply when tax practitioners, including attorneys, certified public accountants (CPAs), and enrolled agents, use generative AI. Specifically, the Alert arises out of IRS Circular 230 which governs practice before the IRS and establishes standards of competency, diligence, ethical behavior, and procedures for discipline. Rather than creating AI-specific rules, the Alert applies these existing obligations to the use of AI. It confirms an emerging regulatory principle likely to apply across virtually every licensed profession: AI may assist professional judgment, but it may not replace it.

The work of tax professionals extends well beyond Form 1040 preparation (individual federal tax return preparation). By way of example, professionals working on corporate tax issues, payroll taxes, estate taxes, and the qualified plan rules for employee benefit plans may all need to consider Alert 2026-19 when incorporating AI into their practice.  The Alert offers a roadmap for ethical AI use that such professionals can adapt when performing tax-related services and advising clients.

How Do The Guidelines Address Accuracy?

One of the central themes of the Alert is that AI-generated work must always be independently verified, a principle familiar to every practicing attorney.

When using GAI, practitioners must thoroughly review all AI-created documents and language incorporated into writings before delivery to a client or submission to the IRS. Due diligence requires verifying the accuracy of facts, citations, and calculations produced by AI. Practitioners cannot rely solely on AI; human scrutiny and editing are essential to ensure correctness and compliance with IRS expectations.

In short, AI-generated content should be treated as a draft requiring professional review rather than as a final work product, whether that content is a tax return filed with the IRS, a tax memorandum to the client, or a benefit plan communication addressing tax consequences.

How Do The Guidelines Address Competence?

The IRS also emphasizes that professional competence increasingly requires understanding the technology itself.

Practitioners must understand both the law and the technology used in their representation of clients before the IRS, including AI systems’ operational mechanics, limitations, and risks.

They must understand how AI develops content, recognize the potential for bias or errors, and be able to evaluate whether AI outputs are suitable for use in IRS matters. Lack of technological competence could lead to improper advice or flawed filings.

This mirrors a growing consensus among regulators and professional organizations that technological competence is no longer optional. Professionals need not become computer scientists, but they should understand:

  • when AI is appropriate to use;
  • when independent research or analysis remains necessary;
  • what information AI systems retain or transmit;
  • what risks exist regarding confidentiality and cybersecurity; and
  • how AI outputs should be validated before being relied upon.

Professional competence today increasingly includes the ability to use and supervise the use of AI effectively. The challenge of addressing AI “hallucinations” is not limited to litigation attorneys who fail to identify miscited or nonexistent caselaw. A Bloomberg Tax article, AI Hallucinations in Tax: The Risks and How to Mitigate Them, discusses several examples of AI hallucinations facing tax professionals:

Errors that silently compound across calculations. A single inaccurate assumption can flow through provision calculations, effective tax rate analyses, and disclosures without immediate detection. These errors can then distort financial reporting across entities, jurisdictions, and reporting periods.

Understanding the limitations of the technology is critical for all users and, in particular, for those with professional obligations.

How Do The Guidelines Address Confidentiality and Data Security?

The IRS guidance also underscores another issue rapidly becoming central to AI governance: protection of confidential client information.

Practitioners must strictly handle all client data using only secure, enterprise-approved AI. AI systems should be utilized with robust confidentiality safeguards firmly in place. Willful mishandling of taxpayer information through AI may lead to disciplinary actions under Circular 230.

Whether preparing individual tax returns, payroll taxes, or representing a client in connection with a tax audit of its qualified retirement plan, tax professionals very likely are processing their client’s sensitive confidential information, which may not be limited to personal information. Including such information in AI prompts or documents uploaded to an LLM can present significant risks to the confidentiality of that information. Among the questions organizations should consider are:

  • Has the AI vendor contractually agreed not to use prompts or uploaded information to train its models?
  • Is client data encrypted in transit and at rest?
  • Where is information stored?
  • Does the platform comply with applicable privacy laws and contractual confidentiality obligations?
  • Are employees prohibited from entering confidential client information into consumer AI platforms?

What Role Do Governance, Policies and Procedures Play Under the IRS Guidance?

The IRS makes clear that individual diligence is not enough on its own:

  • Firms must deploy internal policies and procedures for compliance with Circular 230 in the AI space, with coverage that includes:
    • Staff: Comprehensive training on use of AI (the risks, technological and otherwise, and the requirements).
    • Rules applicable internally (within the firm): Established protocols for secure data handling, AI accuracy monitoring, etc.
    • Contracting with external providers: Outsourced or third-party AI tools should be vetted.

Organizations that provide professional services, including law firms, accounting firms, consulting firms, engineering firms, benefit consultants, and healthcare providers should treat AI governance not merely as an IT initiative, but as an enterprise-wide professional responsibility. For example, policies governing approved AI platforms, employee training, confidentiality safeguards, validation procedures, documentation, and client communications are quickly becoming as important as traditional cybersecurity policies.

How Do The Guidelines Address Client Fees?

Perhaps the most interesting portion of the IRS guidance concerns professional billing.

Circular 230 prohibits unconscionable fees, and the OPR goes further, cautioning that billing should reflect any efficiencies AI brings to research, drafting, or analysis.

Practitioners should not only disclose, in general or specific terms as needed, the AI activities performed, but also fairly credit to the client’s account any cost reductions.

For example, if AI reduces an eight-hour task to two hours, firms should consider how that efficiency affects client billing—though the guidance does not address offsetting costs, such as AI licensing, training, and maintenance.

Looking Ahead

The IRS guidance is noteworthy not because it creates new obligations, but because it reinforces a broader reality. Generative AI is changing how professionals perform their work. It is not changing who remains responsible for that work. Whether the practitioner is a lawyer, CPA, enrolled agent, engineer, consultant, or another licensed professional, the emerging regulatory message is remarkably consistent: AI may be an extraordinarily valuable assistant, but it is not the professional of record nor a substitute for sound judgment.

Photo of Joseph J. Lazzarotti Joseph J. Lazzarotti

Joseph J. Lazzarotti is a principal in the Berkeley Heights, New Jersey, office of Jackson Lewis P.C. He founded and currently co-leads the firm’s Privacy, Data and Cybersecurity practice group, edits the firm’s Privacy Blog, and is a Certified Information Privacy Professional (CIPP)…

Joseph J. Lazzarotti is a principal in the Berkeley Heights, New Jersey, office of Jackson Lewis P.C. He founded and currently co-leads the firm’s Privacy, Data and Cybersecurity practice group, edits the firm’s Privacy Blog, and is a Certified Information Privacy Professional (CIPP) with the International Association of Privacy Professionals. Trained as an employee benefits lawyer, focused on compliance, Joe also is a member of the firm’s Employee Benefits practice group.

In short, his practice focuses on the matrix of laws governing the privacy, security, and management of data, as well as the impact and regulation of social media. He also counsels companies on compliance, fiduciary, taxation, and administrative matters with respect to employee benefit plans.

Privacy and cybersecurity experience – Joe counsels multinational, national and regional companies in all industries on the broad array of laws, regulations, best practices, and preventive safeguards. The following are examples of areas of focus in his practice:

  • Advising health care providers, business associates, and group health plan sponsors concerning HIPAA/HITECH compliance, including risk assessments, policies and procedures, incident response plan development, vendor assessment and management programs, and training.
  • Coached hundreds of companies through the investigation, remediation, notification, and overall response to data breaches of all kinds – PHI, PII, payment card, etc.
  • Helping organizations address questions about the application, implementation, and overall compliance with European Union’s General Data Protection Regulation (GDPR) and, in particular, its implications in the U.S., together with preparing for the California Consumer Privacy Act.
  • Working with organizations to develop and implement video, audio, and data-driven monitoring and surveillance programs. For instance, in the transportation and related industries, Joe has worked with numerous clients on fleet management programs involving the use of telematics, dash-cams, event data recorders (EDR), and related technologies. He also has advised many clients in the use of biometrics including with regard to consent, data security, and retention issues under BIPA and other laws.
  • Assisting clients with growing state data security mandates to safeguard personal information, including steering clients through detailed risk assessments and converting those assessments into practical “best practice” risk management solutions, including written information security programs (WISPs). Related work includes compliance advice concerning FTC Act, Regulation S-P, GLBA, and New York Reg. 500.
  • Advising clients about best practices for electronic communications, including in social media, as well as when communicating under a “bring your own device” (BYOD) or “company owned personally enabled device” (COPE) environment.
  • Conducting various levels of privacy and data security training for executives and employees
  • Supports organizations through mergers, acquisitions, and reorganizations with regard to the handling of employee and customer data, and the safeguarding of that data during the transaction.
  • Representing organizations in matters involving inquiries into privacy and data security compliance before federal and state agencies including the HHS Office of Civil Rights, Federal Trade Commission, and various state Attorneys General.

Benefits counseling experience – Joe’s work in the benefits counseling area covers many areas of employee benefits law. Below are some examples of that work:

  • As part of the Firm’s Health Care Reform Team, he advises employers and plan sponsors regarding the establishment, administration and operation of fully insured and self-funded health and welfare plans to comply with ERISA, IRC, ACA/PPACA, HIPAA, COBRA, ADA, GINA, and other related laws.
  • Guiding clients through the selection of plan service providers, along with negotiating service agreements with vendors to address plan compliance and operations, while leveraging data security experience to ensure plan data is safeguarded.
  • Counsels plan sponsors on day-to-day compliance and administrative issues affecting plans.
  • Assists in the design and drafting of benefit plan documents, including severance and fringe benefit plans.
  • Advises plan sponsors concerning employee benefit plan operation, administration and correcting errors in operation.

Joe speaks and writes regularly on current employee benefits and data privacy and cybersecurity topics and his work has been published in leading business and legal journals and media outlets, such as The Washington Post, Inside Counsel, Bloomberg, The National Law Journal, Financial Times, Business Insurance, HR Magazine and NPR, as well as the ABA Journal, The American Lawyer, Law360, Bender’s Labor and Employment Bulletin, the Australian Privacy Law Bulletin and the Privacy, and Data Security Law Journal.

Joe served as a judicial law clerk for the Honorable Laura Denvir Stith on the Missouri Court of Appeals.