# Confidentiality Compliance Memo — Supervised AI Agents Under AICPA Rule 1.700.001 **Template memorandum for adaptation by a CPA firm's professional-standards function** > **This is not legal advice.** This memo is an educational artifact published by the > Org.AI Foundation's tax.org.ai program. It is analysis for adaptation, not an opinion > for reliance; it creates no attorney-client or accountant-client relationship, and > nothing here is offered for sale or as a solicitation of clients. **Have your firm's > counsel adapt it** to your engagements, your vendor's actual contractual terms, your > state board's rules, and the current state of the law. No court has squarely held that > a supervised AI agent receives *Kovel* treatment; where this memo describes privilege > outcomes, it describes the best-available doctrinal structure, not settled law. --- **TO:** [Professional Standards / Ethics & Independence] **FROM:** [ADAPT] **DATE:** [ADAPT] **RE:** Use of supervised AI agents in client engagements — confidentiality compliance under AICPA Code Rule 1.700.001, consent mechanics, and privilege posture --- ## I. Questions presented 1. May the firm permit a supervised AI agent to participate in client work consistent with the confidentiality rule of the AICPA Code of Professional Conduct? 2. What consent or contractual mechanics does the Code require before client information reaches the agent's platform? 3. What is the evidentiary-privilege posture of agent-assisted tax advice, and what does it not cover? 4. Which service lines are categorically out of scope? ## II. Short answers 1. Yes, if the platform relationship is papered correctly. The Code's service-provider interpretation gives two compliance paths; contractual confidentiality safeguards (zero-retention, no-training terms) satisfy the first without client-by-client consent. 2. Either (i) a contractual agreement binding the provider to confidentiality with safeguards against unauthorized disclosure, or (ii) specific client consent. Use (i) as the floor; add (ii) where the engagement letter can carry it cheaply. 3. Fragile by default, and never to be oversold. IRC §7525 gives tax advice a privilege that incorporates attorney-client common law by reference — but it is perforated (noncriminal federal tax matters only; no return prep; no shelter promotion). Robust protection comes from the *Kovel* structure: counsel engages the agent, not the firm and not the client. A companion template implements that structure. 4. Audit and all attest work. *United States v. Arthur Young & Co.*, 465 U.S. 805 (1984), makes audit-side confidentiality contrary to declared federal policy. No AI confidentiality workflow changes that, and this memo does not apply to the attest side. ## III. The confidentiality rule — and what it is not AICPA Code Rule 1.700.001: "a member in public practice shall not disclose any confidential client information without the specific consent of the client." The Code's exceptions cover compliance with professional standards, a valid subpoena or summons or applicable laws and regulations, peer review, and ethics-division or board investigations. **State this plainly wherever the firm discusses the rule: Rule 1.700.001 binds the CPA; it creates no evidentiary privilege for the client.** The Supreme Court has confirmed that "no confidential accountant-client privilege exists under federal law, and no state-created privilege has been recognized in federal cases." *Arthur Young*, 465 U.S. at 817 (citing *Couch v. United States*, 409 U.S. 322 (1973)). A workflow can be fully Code-compliant and still fully discoverable. Confidentiality compliance (Parts III–V) and privilege posture (Part VI) are separate questions and must never be conflated in client communications. ## IV. The operative hook — Interpretation 1.700.040 (third-party service providers) Interpretation 1.700.040 governs disclosure of confidential client information to a third-party service provider. Before client information reaches the provider, the member must either: - **(i)** have a **contractual agreement** with the provider requiring it to maintain the confidentiality of the information, with **safeguards against unauthorized disclosure**; or - **(ii)** obtain **specific client consent**. A supervised-AI platform is a third-party service provider under this interpretation. Path (i) is the firm's floor, and enterprise terms satisfy it when they include, at minimum: 1. a confidentiality covenant covering all client information processed by the agent; 2. **zero-retention** terms — client information is not retained beyond [session/operational window] and is irretrievably deleted; 3. **no-training** terms — client information is never used to train, fine-tune, evaluate, or improve any model, by the provider or any subprocessor; 4. flow-down of 1–3 to subprocessors, with subprocessors identified; 5. breach notification and a covenant of no voluntary disclosure, with prompt notice of any subpoena or demand; 6. an express statement that these terms override any conflicting consumer terms of service. Consumer-tier AI products fail path (i) on their face where their terms permit retention, training, or disclosure. The firm should maintain an approved-platform list; only platforms under conforming enterprise terms qualify. **Tax-side overlay.** For tax return information, IRC §7216 and its regulations impose a separate, criminal-backed disclosure regime with its own rules for auxiliary service providers and taxpayer consents. Section 7216 analysis is distinct from the Code analysis and must be run separately by the firm's tax practice before any return information touches an agent platform. [ADAPT: insert the firm's §7216 procedure; this memo does not analyze §7216.] ## V. Client-consent mechanics Even where path (i) is satisfied, the firm should [ADAPT to firm policy] disclose agent use in the engagement letter and, where practicable, obtain path (ii) consent as well. Elements of an effective consent clause: - identifies that the firm uses supervised AI agents operated under enterprise terms meeting the safeguards in Part IV; - names the categories of information involved and the purpose (performance of the engagement only); - states the confidentiality, zero-retention, and no-training commitments in one sentence of plain language; - states that the client may ask which platforms are used and may decline agent use for the engagement [ADAPT: if the firm offers an opt-out]; - is **specific** — Rule 1.700.001 requires "specific consent of the client"; a buried general boilerplate sentence is weak both under the Code and with the client. Consent under the Code is a disclosure permission. It is not a privilege waiver analysis; where privilege matters, Part VI governs and counsel should review the consent language so it does not recite facts that undercut a later privilege claim. ## VI. Privilege posture for tax advice ### A. IRC §7525 — real, incorporated, and perforated Section 7525(a)(1): "With respect to tax advice, the same common law protections of confidentiality which apply to a communication between a taxpayer and an attorney shall also apply to a communication between a taxpayer and any federally authorized tax practitioner to the extent the communication would be considered a privileged communication if it were between a taxpayer and an attorney." Two consequences: 1. **Incorporation by reference.** Whatever the common law of attorney-client privilege comes to hold about supervised AI agents flows into §7525 automatically, by the statute's own text. No separate rule change is required on the accounting side. 2. **The perforations are severe and must be stated whenever §7525 is discussed:** - assertable only in noncriminal tax matters before the IRS and noncriminal tax proceedings in federal court brought by or against the United States (§7525(a)(2)) — no criminal matters, no state courts or agencies, no private litigation, no non-tax federal proceedings; - no privilege for written communications in connection with promotion of participation in a tax shelter (§7525(b), broadly construed); - no return preparation. *United States v. Frederick*, 182 F.3d 496, 500–01 (7th Cir. 1999): return-prep information "is furnished for the purpose of enabling the preparation of the return, not the preparation of a brief or an opinion letter. Such information therefore is not privileged"; "a dual-purpose document — a document prepared for use in preparing tax returns and for use in litigation — is not privileged." And: "Nothing in the new statute suggests that these non-lawyer practitioners are entitled to privilege when they are doing other than lawyers' work." *Id.* at 501. **Firm rule: §7525 is never to be represented — internally or to clients — as the reason an AI workflow is "safe."** It is a narrow privilege that inherits whatever the common law settles, nothing more. ### B. The robust structure — counsel-engaged (*Kovel*) Where privilege genuinely matters (controversy, litigation support, sensitive advice), the durable structure is the one *United States v. Kovel*, 296 F.2d 918 (2d Cir. 1961), built for accountants themselves: **counsel** — not the firm, not the client — engages the agent platform as counsel's agent to make the legal consultation effective, under counsel's documented direction, on contractual confidentiality terms, segregated from all non-legal work. The first considered AI-privilege ruling, *United States v. Heppner*, No. 25 Cr. 503 (S.D.N.Y. Feb. 17, 2026), denied privilege for solo consumer-AI use for exactly the reasons that structure supplies: no counsel engagement, no contractual confidentiality terms, no legal purpose, no documented attorney direction. *Heppner* is negative-space guidance — it identifies the failure modes; it does not hold that the inverted structure succeeds — and it is currently known through published analysis of the ruling rather than the memorandum itself. Honest residual risks the firm should track with counsel: *United States v. Ackert*, 169 F.3d 136 (2d Cir. 1999), limits *Kovel* to third parties who improve comprehension of attorney-client communications (independent analysis is a circuit-dependent risk), and *Frederick* strips dual-purpose material (hence: dedicated agent instance per matter, never the return-prep channel). The companion artifact, *Kovel Engagement Letter — Template for a Counsel-Engaged Supervised AI Agent*, implements this structure with the drafting requirements embedded. Firm personnel do not set up *Kovel* engagements; the client's counsel does. ## VII. Out of scope — audit and attest *United States v. Arthur Young & Co.*, 465 U.S. 805, 817–18 (1984): "By certifying the public reports that collectively depict a corporation's financial status, the independent auditor assumes a public responsibility transcending any employment relationship with the client," and this "'public watchdog' function demands that the accountant maintain total independence from the client at all times and requires complete fidelity to the public trust." The Court refused work-product protection for auditors' tax accrual workpapers and enforced the IRS summons. The audit function is defined by non-confidentiality: the auditor's loyalty runs to the investing public. No confidentiality or privilege structure in this memo — human or AI — applies to attest work, and the firm must not permit any suggestion otherwise. Everything above concerns the advice side only: tax advice, controversy representation, litigation support. ## VIII. State-law notes (three text-verified states only) State accountant-privilege statutes vary; the firm should rely only on verified text for the states where it practices. Three states verified as of this memo's source date: - **Colorado** — C.R.S. §13-90-107(1)(f): a CPA "shall not be examined without the consent of his or her client" as to "any communication made by the client to him or her in person or through the media of books of account and financial records or his or her advice, reports, or working papers"; the statute extends the same protection to "a secretary, stenographer, clerk, or assistant of a certified public accountant." - **Missouri** — RSMo §326.322.2: "A licensee shall not be examined by judicial process or proceedings without the consent of the licensee's client as to any communication made by the client to the licensee ... or the licensee's advice, reports or working papers," with the same extension to "a secretary, stenographer, clerk or assistant of a licensee," and an exception where the material is relevant to the defense of an action against the licensee. §326.322.1 states the parallel confidentiality duty. - **Idaho** — I.R.E. 515 (the only state where the privilege lives in a Supreme-Court-adopted evidence rule): "representative of the accountant" means "one employed by the accountant to assist the accountant in the rendition of professional accounting service"; confidential communications are those "not intended to be disclosed to third persons other than those to whom disclosure is made in furtherance of the rendition of professional accounting services to the client or those reasonably necessary for the transmission of the communication." The client holds the privilege; the accountant may claim it only on the client's behalf; standard exceptions (crime-fraud, etc.) apply. Whether an "assistant" or "representative" clause reaches a supervised AI agent is an open question everywhere — some codes read those categories as persons. These state privileges are **optional, post-precedent clarifications** relevant chiefly to CPA-without-counsel work; the counsel-engaged structure in Part VI.B does not depend on them. Remember also that no state accountant privilege is recognized in federal cases (*Arthur Young*, 465 U.S. at 817). ## IX. One-page checklist **Before any client information reaches an agent platform (all engagements):** - [ ] Platform is on the firm's approved list under enterprise terms - [ ] Contract has: confidentiality covenant; zero-retention; no-training; subprocessor flow-down; subpoena notice; consumer-ToS override (Interpretation 1.700.040 path (i)) - [ ] Engagement letter discloses agent use; specific client consent obtained where firm policy requires (Rule 1.700.001; path (ii)) - [ ] Tax return information: §7216 procedure cleared separately - [ ] Client-facing materials never describe Code compliance as privilege **For tax-advice engagements where privilege matters:** - [ ] §7525 limits confirmed against the matter: noncriminal, federal, IRS/federal-court only; no shelter writings; no return prep - [ ] Agent instance for advice work is separate from any return-prep channel; separate logs (*Frederick*) - [ ] If the matter warrants it, client's counsel establishes a *Kovel* engagement: counsel retains the platform; documented direction; audit-logged; dedicated instance (see companion template) - [ ] No agent output reused outside its engagement (waiver traps) **Always out of scope:** - [ ] No agent confidentiality workflow on audit or attest engagements (*Arthur Young*) ## Sources Every legal proposition above traces to the primary sources cited in text and to the Org.AI Foundation research brief, *The Accounting Analog: CPA Confidentiality, Privilege, and the Supervised AI Agent* (2026-08-01): - AICPA Code of Professional Conduct, Rule 1.700.001 and Interpretation 1.700.040 - IRC §7525; IRC §7216 (flagged, not analyzed) - *United States v. Arthur Young & Co.*, 465 U.S. 805 (1984); *Couch v. United States*, 409 U.S. 322 (1973) - *United States v. Kovel*, 296 F.2d 918 (2d Cir. 1961); *United States v. Ackert*, 169 F.3d 136 (2d Cir. 1999); *United States v. Frederick*, 182 F.3d 496 (7th Cir. 1999) - *United States v. Heppner*, No. 25 Cr. 503 (S.D.N.Y. Feb. 17, 2026), described through published analysis of the ruling; the memorandum should be read directly before reliance - C.R.S. §13-90-107(1)(f); RSMo §326.322; Idaho R. Evid. 515 *Educational analysis. Not legal advice. No attorney-client relationship. Have your counsel adapt this.*