What Is IRS Section 7216? Consent Rules for Cloud Hosts, AI Tools, and Offshore Preparers

What Is IRS Section 7216? Consent Rules for Cloud Hosts, AI Tools, and Offshore Preparers

Every tax season, your firm shares client information with more people and systems than the year before: a cloud host, a client portal, an AI assistant, and sometimes an offshore preparation partner. IRS Section 7216 is the federal rule that decides which of those hand-offs are allowed, which need the client’s signed consent, and which can expose a preparer to criminal penalties. It’s also one of the most misunderstood rules in tax practice. Firms often assume a vendor’s security certifications settle the question, or that a confidentiality clause in the engagement letter counts as consent. Neither assumption holds up.

In this post, I’ll explain:

• What Section 7216 covers
• When consent is and isn’t required
• How the rules apply to cloud hosting, AI tools, and offshore preparers
• What a valid consent must include

I’m writing as a security leader, so treat this as a practical starting point and confirm your specific workflows with counsel.

What Is IRS Section 7216?

IRS Section 7216, formally Section 7216 of the Internal Revenue Code (IRC), is a federal law that makes it a misdemeanor for tax return preparers to knowingly or recklessly disclose or use a client’s tax return information for any purpose other than preparing the return, unless a specific exception applies or the client gives prior written consent. Section 6713 adds a related civil penalty for the same conduct.

The rule reaches further than the person who signs the return. Under the Treasury regulations, anyone who prepares returns or provides auxiliary services in connection with preparation can be a “tax return preparer” for Section 7216 purposes.

The regulations specifically say that contractors who receive return data while servicing your tax preparation equipment or software are treated as tax return preparers themselves. The IRS keeps links to the statute, regulations, and consent guidance in its Section 7216 information center.

What counts as tax return information

Tax return information is broader than the finished return. It generally includes anything a client gives you for, or in connection with, preparing a return, such as their name, address, and identifying number, along with information you receive from third parties and information you derive or generate during preparation. An intake spreadsheet, a folder of source documents, and a client list built from your tax software can all qualify.

Disclosure vs. use

Section 7216 restricts two separate things:

1. A disclosure means making tax return information known to any other person in any manner, whether that’s emailing a file, granting system access, or uploading a document to a third-party service.
2. A use means relying on tax return information as the basis for an action, such as deciding which clients to market a financial product to.

A single consent document can cover several disclosures or several uses, but it can’t cover both. Disclosures and uses each need their own document.

Section 7216 Penalties for Tax Preparers

A violation of Section 7216 is a federal misdemeanor. According to Rev. Proc. 2013-14, the penalty is up to one year in prison, a fine of up to $1,000, or both, plus the costs of prosecution. The criminal fine cap rises to $100,000 when the disclosure or use is connected to identity theft. The civil penalty under Section 6713 is $250 for each unauthorized disclosure or use, up to $10,000 per calendar year. When the violation is connected to a crime involving misuse of someone’s taxpayer identity, those amounts rise to $1,000 per violation and $50,000 per year.

Source: 26 U.S. Code § 7216, Cornell Legal Information Institute

The dollar amounts look small next to most data privacy penalties, but I’d encourage firms not to read them that way. A criminal statute attached to client data creates a reputational risk before a financial one. Clients don’t distinguish between a breach and a disclosure they never agreed to.

When Do Tax Preparers Need Section 7216 Consent?

Start with the exceptions. The regulations in 26 CFR 301.7216-2 list situations where you can disclose or use tax return information without asking the client. If one applies, you don’t need consent. If none applies, you need a signed consent before the disclosure or use happens. 26 CFR 301.7216-3 doesn’t allow retroactive consent.

Common situations that don’t require consent

• Sharing inside your firm in the US. Staff at a US-based firm can use and share client information with colleagues at the same firm to prepare the return or provide auxiliary services.
• Disclosing to another US preparer for processing. You can send information to another preparer in the US to process the return, compute the tax, or e-file, as long as that preparer isn’t making substantive determinations or giving advice that affects the client’s tax liability.
• Contractors who service your tax systems. You can disclose information to a contractor for programming, maintaining, repairing, testing, or procuring the equipment or software you use to prepare returns, but only to the extent the contractor needs it, and only if every individual who receives the data gets a written notice describing Sections 6713 and 7216.
• Other accounting services for the same client. A CPA firm that prepares a client’s return can use that information within the firm for related accounting work for that client, such as books and records or financial statements.
• Legal and regulatory requests. Disclosures to your attorney for legal advice, in response to court orders or subpoenas, and for qualifying quality or peer reviews are also covered.

Situations that require consent

• Anyone outside the US. Disclosing information to a preparer, employee, or contractor located outside the US requires consent first, even when they only view data stored on a US server.
• A second opinion from another firm. Sending a client’s information to a different firm for advice or a substantive determination on their return requires consent.
• Non-tax uses. Using return information to market other products or services, such as loans, insurance, or investment accounts, requires a use consent that names each type of product or service.
• Third parties with no tax role. Sharing information with a lender, a business partner, or any other party outside the exceptions requires a disclosure consent that names the recipient and purpose.

Does Using a Cloud Host, AI Tool, or Offshore Preparer Count as a Disclosure?

The answer depends on what the provider does with the data, where the people with access are located, and whether a specific exception fits.

Cloud hosts and managed IT providers

Giving a hosting or IT provider access to systems that contain client data is a disclosure. The question is whether an exception covers it. The contractor exception for programming, maintaining, repairing, testing, or procuring tax preparation equipment and software is the one most firms look to, but it comes with conditions: access limited to what the contractor needs, and a written Section 7216 and 6713 notice to every individual who receives the data. The regulations were written before today’s cloud hosting models, so confirm with counsel how your vendor relationship maps to them. From a practical standpoint, ask your provider four questions:

1. How does your contract address Section 7216?
2. How do you deliver the required written notice to your staff?
3. How is access to our environment limited and logged?
4. Where is every person with access located?

That last answer matters most, because support staff outside the US change the analysis. For more on evaluating providers, see our guide to cloud security for accounting firms.

AI tools

In June 2026, the IRS Office of Professional Responsibility issued OPR Guidance 2026-19, its first guidance on responsible AI use in federal tax practice. It applies existing Circular 230 duties to AI and points back to Sections 6713 and 7216, but it doesn’t settle when AI use requires client consent.

In the meantime, a professional liability column in the AICPA’s Journal of Accountancy makes the case for disclosing AI use to clients as a precaution. The risk is highest with consumer AI tools. Free and personal accounts often allow the provider to retain conversations and, in some cases, use them to train future models. That’s a disclosure to a third party with no tax role, and none of the exceptions covers it.

Enterprise agreements that prohibit training on your data, limit retention, and give you administrative controls are a much stronger position, but they’re still a question for counsel rather than a settled exception.

I cover the broader risks in AI tools and client data security, and our AI policy template for accounting firms is a good starting point for setting rules your staff will follow.

Whether sending return data to an AI provider counts as a disclosure is a question I’d want counsel answering before anyone hits Enter. What I can say from the security side is that the account tier matters. A free consumer account and an enterprise agreement with no training on your data and defined retention are two very different data flows, even when the chat window looks identical.

Offshore preparers and staff

Offshore work has the clearest rule: you need the client’s signed consent before any disclosure to a preparer, employee, or contractor outside the US. That includes remote access.

The regulations give the example of an offshore contractor who can view, but not download or print, client data on a server in the US. Consent is still required, because the person viewing the data is outside the country.

A US employee who is temporarily traveling abroad isn’t treated as being located outside the US.

Form 1040 clients add a stricter rule for Social Security numbers.

A US preparer can’t get consent to disclose an SSN to an offshore preparer unless both preparers maintain an adequate data protection safeguard, as defined in Rev. Proc. 2013-14, and the consent includes the IRS’s mandatory SSN statement. Otherwise, the SSN must be masked or redacted before the information leaves the US.

For the access-control side of offshore work, see how to keep remote, outsourced, and offshore accountants secure.

Could you prove where every client file went?

Consent forms, vendor notices, and access logs only help if you can produce them when a client, insurer, or regulator asks.

Get the eBook

Three Section 7216 Scenarios Firms Run Into

The following scenarios are hypothetical. They’re meant to show how the rules play out, not to describe real clients or firms.

Scenario 1: Moving tax software to a hosted environment

A 12-person firm moves its tax software and client files to a hosted cloud environment so staff can work remotely. The provider’s engineers maintain the servers and occasionally access the environment to troubleshoot.

This is a disclosure, but it can fit the contractor exception if:

• The provider’s staff are in the US
• Access is limited to what support requires
• Each person who can reach client data has received the written Section 7216 and 6713 notice

The firm’s next steps are to confirm those three points in writing, record the provider in its vendor inventory, and ask counsel to confirm the exception fits the arrangement.

Scenario 2: A staff accountant pastes a K-1 into a free AI chatbot

During busy season, a staff accountant pastes the details of a client’s Schedule K-1 into a free consumer AI tool to help interpret an unusual allocation. No exception covers this, and the tool’s terms may allow the provider to keep and reuse the data.

The firm should treat it as a potential unauthorized disclosure. Stop further use, document what was shared, and bring in counsel to assess the exposure and any obligations to the client.

The incident response steps in the firm’s data breach response plan apply here. The longer-term fix is a written AI policy, an approved enterprise tool, and security awareness training that explains why the rule exists.

Scenario 3: Adding an offshore preparation partner for busy season

A firm signs an agreement with an offshore preparation partner to handle simpler individual returns from February through April. Consent is required before the first file moves.

Because the disclosure is to another preparer for preparation, the firm can decline to prepare a return if the client doesn’t consent, but the consent has to use the IRS’s mandatory language for that situation. The firm also needs to decide whether SSNs will be masked or disclosed under an adequate data protection safeguard.

Collecting consents with the engagement letter, rather than in March, keeps the busy season on schedule.

Section 7216 Consent Checklist for Form 1040 Clients

For business clients that don’t file a Form 1040-series return, a consent can take any format, including an engagement letter, as long as it meets the core requirements in 26 CFR 301.7216-3. Consents for individual Form 1040 clients must also follow Rev. Proc. 2013-14.

Use this checklist to review your forms, and use the IRS’s exact mandatory wording from the revenue procedure rather than a paraphrase.

What every consent must include

1. Get consent before the disclosure or use. Consent can’t be applied retroactively.
2. Name the preparer and the taxpayer. Both names must appear on the consent.
3. Be specific. Identify the tax return information involved, the purpose, and the specific recipient for a disclosure, or the particular use for a use consent.
4. Keep disclosures and uses on separate documents. One document can cover several disclosures, or several uses, if each is separately identified and the client can select each one individually.
5. Include the mandatory statements in the required order. Rev. Proc. 2013-14 provides different required language for disclosures outside tax preparation, disclosures to another preparer for preparation or auxiliary services, and uses.
6. Include the TIGTA statement. Every consent must tell the client how to contact the Treasury Inspector General for Tax Administration about improper disclosure or use.

How to collect a valid consent

7. Require an affirmative opt-in. Pre-selected boxes and opt-out designs aren’t allowed.
8. Don’t condition your services on consent. The exception is consent to disclose to another preparer for preparation or auxiliary services, which must use the specific statement for that situation.
9. Meet the format rules. Paper consents must be on 8.5 x 11 inch or larger paper in at least 12-point type, with every word on the page relating to the consent. Electronic consents must use text at least as large as the site’s standard body text, with enough contrast, and must be printable.
10. Collect a valid signature and date. Paper consents need a handwritten signature. Electronic consents need the client to type their name, enter a PIN of at least five characters, or enter at least five characters unique to them, and none of these can be filled in automatically.
11. Never leave blanks to complete later. You can’t alter a consent after the client signs it.

Duration, copies, and special cases

12. State the duration. If the consent doesn’t specify one, it lasts one year from the date the client signs.
13. Offer a narrower option for full-return disclosures. A consent to disclose the entire return must tell the client they can request a more limited disclosure.
14. Give the client a copy. Provide it at signing or let the client print or save the electronic version.
15. Add the offshore statements when they apply. Disclosures to a preparer outside the US need the required offshore statement. Disclosures that include an SSN need the longer SSN statement and an adequate data protection safeguard on both sides.
16. Follow the timing limits for solicitations. You can’t request consent for unrelated solicitations after you give the client a completed return to sign, and you can’t ask again for a substantially similar purpose after a client declines.

Section 7216 is one rule. How many others apply to your firm?

Federal and state requirements overlap, and a gap in one can undo the work you’ve put into the rest.

Get the Compliance Map

How Section 7216 Fits Into Your WISP

Section 7216 answers whether you’re allowed to share client information. The FTC Safeguards Rule under GLBA and IRS Publication 4557 address how well you protect it. Your written information security plan is where those two questions meet.

A WISP that accounts for Section 7216 should cover:

• Which vendors receive tax return information
• Where their people with access are located
• Which exception or consent applies to each
• Where signed consents and contractor notices are stored
• What your AI policy allows

Most firms already need a WISP for PTIN renewal, so this is an extension of existing work rather than a new program.

Our guide to WISP requirements for accountants covers the rest of what the plan should include. If your WISP lists every system that touches return data and the reason you’re allowed to use it, you’ve already done most of the hard work.

Make Section 7216 Part of Every New Vendor Decision

Section 7216 doesn’t stop firms from using cloud hosting, AI tools, or offshore help. It asks you to decide, before data moves, whether an exception applies or consent is needed, and to keep the evidence.

Build that check into vendor onboarding, update your consent forms against Rev. Proc. 2013-14, and give staff an approved path for AI so they don’t create their own.

Rather not build the documentation alone? WISP for Firms gives you a written information security plan developed with your team through intake and review meetings, which your firm then puts into practice.

This article is for general informational purposes and isn’t legal or tax advice. Talk with a qualified attorney about how Section 7216 applies to your firm’s specific workflows.