Somewhere in your firm, a return or a set of workpapers has already been pasted into a chatbot. Under the law your practice is a financial institution, and that data is your responsibility. We're the human bridge that makes AI a defensible tool in your firm, not an exposure you find out about in an audit.
Under the Gramm-Leach-Bliley Act, a tax and accounting firm is a financial institution. That means the FTC Safeguards Rule and IRS Publication 4557 already require a written information security plan with named controls, whether or not the firm has one on paper. The moment a staffer pastes a client return into a consumer chatbot, the firm has an AI question and a compliance question at the same time, and most firms are answering neither on purpose.
A generic AI consultant has never read Pub 4557. An AI vendor is paid when you buy, not when you stay compliant. We take no commissions and sell no software. We read the tool's terms, decide which tools may touch which data, write the AI addendum into your security plan, and keep the partners in command of the decision. The result is a firm that can use AI to move faster through busy season and still answer for every client record it touches.
An AI addendum to your written information security plan: the approved tools, the data each may touch, and the human review that keeps a person on every return.
Read more ›An independent read on whether your IT provider is earning its invoice, and whether the AI features in your tax and practice software are handling client data the way they should.
Read more ›A fixed-scope, fixed-price read on where your firm actually stands on AI and client-data risk, and what to fix first, before busy season, not during it.
Read more ›A steady hand on call when a new tool, a client question, or a vendor pitch lands mid-season, so the partners are never deciding technology alone under deadline.
Read more ›Independent technology and vendor reviews for multi-partner professional firms, including a managed-services and spend audit that put real numbers behind a firm's suspicion that it was overpaying and underprotected. Firm engagements are anonymized by default; we speak to the work and share references privately, never a public client roster.
Yes, with guardrails. The risk is not AI itself, it is client financial data flowing into tools whose terms let them retain or train on it, with no record of who approved what. We set which tools are allowed for which data, get the data-use terms in writing, and name it all in your written information security plan so the firm can defend it.
In practice, yes. Under the Gramm-Leach-Bliley Act a tax and accounting firm is a financial institution, so the FTC Safeguards Rule and IRS Publication 4557 require a written information security plan with named controls. Any AI tool that touches client data falls inside that plan, whether or not the firm has written it down yet.
You should. A written information security plan that is silent on AI while your staff paste returns and workpapers into consumer chatbots is not defensible. We add an AI addendum that names the approved tools, the data each may touch, and the review that keeps a human on the return.
It depends entirely on which tier and which terms. Consumer tiers often reserve the right to retain and train on inputs; business and enterprise agreements can be negotiated to prevent it. We read the specific terms before your firm relies on a tool, and choose the tier and settings that keep client data out of the model.
We take no commissions and sell no software. Your IT provider keeps the network running and an AI vendor is paid on the sale. We sit on the firm's side of the table, know Safeguards Rule and Pub 4557, and keep the partners in command of the decision through an independent read on the vendors you already pay.
I use AI to make good people faster, sharper, and harder to beat, never to replace them. Better, faster, stronger: the goal is a firm that grows and hires more humans, not fewer.
Before busy season, before an audit, before the exposure you didn't know you had. One straight conversation about where your firm stands and what to fix first.
No pitch deck. No sales process. Just a straight conversation about what you're facing.