AI Tools and Your WISP: What Tax Preparers Need to Document in 2026

AI adoption in tax practices is happening fast — document summarization, client communication drafting, research assistance, workflow automation. Tools like Microsoft Copilot, ChatGPT, and practice-specific AI add-ons are making their way into accounting and tax workflows. The FTC Safeguards Rule doesn't have an "AI exemption." When AI tools touch client data — names, SSNs, income figures, bank accounts — they become part of your data handling environment. That means they belong in your WISP. Most tax professionals haven't updated their security program to reflect this. The gap between adoption and documentation is widening, and regulators are not waiting for firms to catch up. If your WISP doesn't mention AI, it doesn't describe your actual information environment. The firms that act now will have a documented, defensible position. The firms that wait will be explaining gaps after a breach or audit. This article explains what you need to document and why, with specific language you can add to your WISP today.

When does AI become a WISP issue?

Any AI tool that receives, processes, stores, or retains client data — including inadvertently as training data — becomes a service provider under FTC 16 CFR Part 314. That triggers the full vendor management requirements: a security assessment, a data handling agreement, and ongoing monitoring. The threshold is not whether the AI vendor calls it an enterprise product. It is whether nonpublic personal information flows through the tool. A single prompt containing a client name, Social Security number, or income figure is enough to bring the tool into scope. The same applies to uploaded documents, transcripts, or email drafts. If the AI service retains, logs, or trains on that input, your firm has shared taxpayer data with a third party. The WISP must record that relationship, the data involved, and the safeguards in place. Ignoring it because the tool is convenient does not remove the compliance obligation. The Qualified Individual must be able to name every AI tool and explain the data it touches.

What the FTC Safeguards Rule says about vendors and AI

The FTC Safeguards Rule requires you to select service providers capable of maintaining appropriate safeguards, contractually require them to protect customer information, and monitor their compliance. These three obligations apply directly to AI vendors. The first step is understanding which tier you are using. Enterprise agreements from OpenAI, Microsoft, and Anthropic typically include data protection commitments, opt-outs from training use, and encryption standards. Consumer tiers — free ChatGPT, standard Copilot, or personal Claude accounts — often explicitly reserve the right to use prompts and outputs for model improvement. That means your client's tax data could become part of a training dataset. The WISP must document which tier is in use, the contractual protections, and the rationale for the selection. If a staff member is using a consumer account for client work, that is an ungoverned risk that the Qualified Individual must address. The difference between enterprise and consumer is not a marketing distinction. It is a compliance boundary.

The five AI tools most commonly used by tax preparers and what your WISP needs to say about each

Most tax firms are already using AI tools without realizing they need WISP documentation. Here are the five most common and what your WISP should record about each.

• Microsoft Copilot — In the enterprise tier, data stays within your M365 tenant and inherits your existing protections. Document your subscription level and confirm that data handling terms match your firm's security standards.
• ChatGPT by OpenAI — The consumer tier uses data for model training. The enterprise and API tiers do not. Your WISP must state which version is approved and why.
• Claude by Anthropic — Similar enterprise and consumer split. Verify the data retention and training opt-out terms in your agreement.
• Practice-specific AI tools — New tax and accounting AI platforms appear regularly. Do not assume they are secure. Review their data agreements, SOC 2 reports, and retention policies before adding them to your approved list.
• Document automation tools — If an AI tool reads, summarizes, or extracts data from client documents, it is in scope regardless of whether you call it AI.

What to add to your WISP today

Your WISP needs an AI-specific section that is practical and enforceable. Here is template language you can adapt.

This language maps directly to the Safeguards Rule's requirements for vendor oversight, risk assessment, and staff training. It also gives the Qualified Individual a clear basis for saying no to unapproved tools.

How WISPWolf helps you track AI vendor risk

WISPWolf treats AI tools as service providers, not exceptions. The vendor inventory section of your WISPWolf dashboard flags any AI tool that lacks a completed security assessment, a data handling agreement, or a quarterly review date. This prevents the most common compliance failure: an approved tool that was never documented. As AI adoption accelerates, this section of the WISP becomes a focal point in FTC reviews and cyber insurance underwriting. Carriers increasingly ask whether AI tools are governed by the same controls as other software. Regulators want to see that the Qualified Individual knows what AI is in use and has assessed it. WISPWolf's structured vendor fields make it easy to demonstrate that knowledge without hunting through emails or spreadsheets. The result is a WISP that reflects your actual technology stack, including the AI layer you added last quarter. When the FTC or an insurance underwriter asks about AI, you will have the answer ready. The platform also links AI vendor records to your risk assessment and training logs, so the entire compliance story is connected.

Conclusion

AI is not a separate category in tax practice. It is a new layer of information systems that must be absorbed into the WISP you already maintain. The firms that handle this well will document their AI tools the same way they document any other vendor: with a risk assessment, written safeguards, and a review schedule. The firms that ignore it will find their WISP out of date the moment an auditor or insurance underwriter asks the question. The best time to update your WISP for AI was before the first prompt was submitted. The second-best time is now. Update your inventory, add the policy language, train your staff on the prohibited use rules, and set a quarterly review. Your WISP should describe what your firm actually does — and in 2026, that includes AI.

Get Your Compliance Score

Related resources

• Security Awareness Training for Tax Preparers
• How to Document WISP Changes Year-Round
• WISP Compliance Proof: What Records to Keep
• FTC Safeguards Rule WISP Checklist for Tax Preparers
• IRS Publication 5708: The Complete Guide