SafeAI Kit · getsafeaikit.com

Is it safe to put client returns into ChatGPT?

1-page checklist for tax preparers and bookkeepers

Check each line. Every “No” is a gap to fix.

Data	We never paste SSNs, ITINs, EINs, bank or card numbers, or full returns into free or personal chatbots.	Yes No
Data	Before asking AI for help, we remove or replace client names, addresses and account numbers (e.g. “Client A”).	Yes No
Tools	We use a business AI plan whose provider says it doesn’t train on our content by default (e.g. ChatGPT Business/Enterprise).	Yes No
Settings	On any personal account, “Improve the model for everyone” is turned off (ChatGPT: Settings → Data controls).	Yes No
Settings	We don’t use “share link” on chats about clients, and we’ve deleted old shared links.	Yes No
People	We have a written list of who may use AI, which tools, and for what tasks.	Yes No
Plan	Our WISP (written information security plan) and risk assessment mention AI tools.	Yes No
Plan	AI providers are treated like other service providers that may receive customer information.	Yes No
People	Every staff member has had security training that covers AI, with a yearly refresher.	Yes No
Review	A person checks every AI-drafted number, letter or summary before it reaches a client.	Yes No

Already pasted client data into a chatbot?

Stop. Delete the chat and any shared links to it.
Tell the person who runs your security program (your “Qualified Individual”) and write down what was shared, when, and where.
Check whether you must report it: the FTC Safeguards Rule requires notice to the FTC within 30 days for breaches involving 500+ customers’ unencrypted information.
If client data was stolen, IRS Pub 4557 says to report it to your local IRS Stakeholder Liaison.

Need the AI section for your WISP? The SafeAI Kit gives you a ready-to-use AI policy, safe-settings guides and staff training, in English and Spanish. getsafeaikit.com

Sources:

FTC — Safeguards Rule: What Your Business Needs to Know — ftc.gov/…/ftc-safeguards-rule-what-your-…
IRS Publication 4557, Safeguarding Taxpayer Data (Rev. 6-2024) — irs.gov/pub/irs-pdf/p4557.pdf
IRS Publication 5708, Creating a WISP (Rev. 8-2024) — irs.gov/pub/irs-pdf/p5708.pdf
OpenAI Help Center — Data controls in ChatGPT — help.openai.com/en/articles/7730893-data-controls-faq

Checklist for general information only. Not legal advice and not a compliance certification. Not affiliated with the IRS, FTC or OpenAI. Version: October 2026.