Can an accounting firm sell its data to AI labs? What section 7216 allows

An accounting firm can license some of its records to AI labs, but anything that came in for a tax return needs each client’s written consent under IRC section 7216 first, and de-identifying it does not remove that rule. The records that are simplest to license are the firm’s own: how it runs closes, reviews work and manages a busy season. Client bookkeeping and audit files sit in between and need client consent under the AICPA’s confidentiality rule. If you want a sense of what your firm’s records could be worth before you weigh any of this, get a confidential estimate.

Owners and partners usually say they want to “sell” the data. In practice you license it: the firm keeps ownership and grants an AI lab a written right to use a copy. Our overview, can you sell your company’s data to AI companies?, covers the basics.

This guide sets out what the statute, the Treasury regulations and the professional rules say, with links to each. It is general information, not legal or ethics advice. Talk to your own counsel and check your state board of accountancy’s rules before you decide anything.

Does section 7216 apply to licensing data to an AI lab?

Section 7216 applies to any firm that prepares tax returns, and it reaches a data license. 26 U.S.C. 7216 covers anyone “engaged in the business of preparing, or providing services in connection with the preparation of,” returns who knowingly or recklessly discloses return information or uses it for anything other than preparing a return. It is a misdemeanor, with a fine of up to $1,000 (up to $100,000 where section 6713(b) applies) and up to one year in prison. Section 6713 adds a civil penalty of $250 for each disclosure or use, up to $10,000 a year, or $1,000 each and $50,000 a year where the disclosure is tied to identity theft. All read Oct 30, 2026.

The definition of what is protected is wide. Under 26 CFR 301.7216-1(b)(3), tax return information is “any information, including, but not limited to, a taxpayer’s name, address, or identifying number, which is furnished in any form or manner for, or in connection with, the preparation of a tax return.” It includes what clients send you, what third parties send you, and what the firm “derives or generates” from it. Workpapers, organizers, client emails about deductions and the return files in your tax software all fall inside it.

The regulations list the uses allowed without consent in 301.7216-2, such as quality and peer reviews. Licensing records to an AI lab is not among them. That leaves written consent.

Does de-identifying tax data get around section 7216?

De-identifying tax data does not take it outside section 7216. The definition in 301.7216-1(b)(3) expressly includes “statistical compilations of tax return information, even in a form that cannot be associated with, or otherwise identify, directly or indirectly, a particular taxpayer.” The regulations do let a preparer build anonymous compilations for its own practice or for bona fide tax research, under 301.7216-2(o). The next paragraph closes the door on licensing them: “A tax return preparer may not sell or exchange for value a statistical compilation” of that data, “in whole or in part, except in conjunction with the transfer of assets made pursuant to the sale or other disposition of the tax return preparer’s tax return preparation business” (read Oct 30, 2026).

Mode, Centific and Turing each say they remove personal data before records are used, and that protects clients. It does not make tax return information something the firm may license without consent.

One detail matters for firms that also keep clients’ books. In an example in 301.7216-1, information sitting in a database is not tax return information until it is used to populate a return; once it is, “the information associated with the return becomes tax return information.” Bookkeeping records the firm used to prepare a client’s return may therefore be covered too. Ask your counsel where that line falls for your engagements.

What does a valid 7216 consent need?

26 CFR 301.7216-3 sets the rules for every client (read Oct 30, 2026). The consent must name the firm and the client, state the purpose, identify the specific recipient and specify the information to be disclosed, and it must be “signed and dated by the taxpayer.” It must come before any disclosure, and it must be “knowing and voluntary”: making your services conditional on the client signing makes the consent invalid. If it states no end date, it lasts one year from signing. The client gets a copy.

The format then depends on the return the client files.

The Tax Adviser described the same split on Aug 31, 2026.

The mandatory 1040 wording also warns the client that once information is disclosed, “Federal law may not protect your tax return information from further use or distribution.” For a data license that warning is accurate, and clients will read it before they sign.

What does the AICPA confidentiality rule add?

Section 7216 covers tax work. The AICPA rule covers everything else a CPA firm holds. Rule 1.700.001 of the AICPA Code of Professional Conduct says: “A member in public practice shall not disclose any confidential client information without specific consent of the client,” as quoted by the Washington State Board of Accountancy in a 2024 consent order. The Journal of Accountancy describes confidential client information as “any information obtained from the client that is not available to the public,” and advises that consent “should specify the nature of the information that may be disclosed” (Mar 1, 2015).

That reaches audit and review files, bookkeeping records, advisory work and client correspondence, whether or not a return was involved. State boards enforce their own versions. In the Washington order, a firm owner agreed that confidential client information sent to a client’s old address was a violation of the state’s accountancy statute and rules.

Does GLBA apply to an accounting firm’s client data?

GLBA applies to an accounting firm that prepares tax returns. The FTC’s Safeguards Rule defines a financial institution to include “an accountant or other tax preparation service that is in the business of completing income tax returns” (16 CFR 314.2, read Oct 30, 2026). The Gramm-Leach-Bliley Act then limits disclosing individual clients’ nonpublic personal information to unaffiliated third parties without notice and a chance to opt out (15 U.S.C. 6802).

CPAs are exempt from GLBA’s privacy notice requirement in 6803(a), but only because their state rules already prohibit disclosure “without the knowing and expressed consent of the consumer” (15 U.S.C. 6803(d), read Oct 30, 2026). The exemption exists because consent is already required. The Safeguards Rule’s security duties still apply, which matters when you decide how a buyer gets access to anything.

So what can an accounting firm license?

Think in three groups.

The firm’s own operations are the simplest

Practice workflow, job templates, close checklists, staffing and deadline patterns, internal training material and how reviewers clear points, with client details removed. Labs want records of how skilled work gets done step by step. A firm’s own process is that record. Our accounting firms page lists the systems these usually live in.

Bookkeeping, audit and advisory files need client consent

These are confidential client information under the AICPA rule, and any of them used to prepare a return may also be tax return information. Some clients may consent to a specific, limited license, especially business clients you already have a close relationship with. Expect many to decline.

Tax files need a 7216 consent per client

Returns, organizers, workpapers and tax correspondence. Without a signed consent that names the AI lab, the purpose and the information, they stay out. Pewter published one accounting deal, a 60-person firm licensing for $350,000, that included “Five years of workpapers, reconciliations, financial models and tax files” (Pewter, read Oct 30, 2026). Pewter says it has not verified its published deal figures, and the page does not say how client consent was handled. If a buyer’s offer depends on tax files, ask how consent will be collected before you sign anything.

Which buyers accept accounting firms?

Each program below names accounting work on its own page, read Oct 30, 2026, unless another date is given. Wider price figures are in our market index.

• Mode lists a minimum of “10+ for accounting, finance, and medical,” against 30 for most businesses, and an indicative range of $100K–$5M (Mode).
• Centific lists finance and accounting, including close-to-report cycles, reconciliations and payables and receivables. It publishes no amounts and pays on acceptance (Centific).
• Turing’s Project Lazarus lists “Finance & accounting” among six kinds of work, described as “How teams close the books, reconcile accounts, and prepare reporting end to end,” for a single payment of up to $1M (Turing).
• Pewter, an intermediary, names accounting among its high-demand sectors and wants 20 or more full-time staff and three years of records (Pewter).
• micro1 wants 30 or more employees (micro1, as of Oct 26, 2026).

For how these figures compare across the market, see how much company data is worth.

A sequence that keeps the firm on the right side of the rules

1. Sort the records into the three groups above, and start with the firm’s own operations.
2. Have counsel review the scope against section 7216, the AICPA rule and your state board’s rules.
3. For any client files, draft a consent per client that names the AI lab, the purpose, the records and the duration. Use the Rev. Proc. 2013-14 format for 1040 clients. Never make it a condition of service.
4. Exclude anything an engagement letter, NDA or regulator keeps confidential, and your own staff’s HR and payroll files.
5. Ask the buyer to de-identify inside your environment, and review a sample before signing.
6. Put field of use, no re-identification and deletion into the license. Our guide to data licensing agreements covers those clauses.

Law firms face a similar consent problem under Rule 1.6; our guide on whether a law firm can license its data covers it. For the wider legal picture, see is it legal to sell company data to AI?

Marin Data does not give legal or ethics advice. We help firms work out what is worth licensing and to whom, and we say where counsel is needed. It costs the firm nothing up front, and nothing at all if no deal closes; Marin Data is paid by the AI lab.

Get a confidential estimate.

Sources

• 26 U.S.C. 7216 and 26 U.S.C. 6713, read Oct 30, 2026
• 26 CFR 301.7216-1, 301.7216-2 and 301.7216-3, read Oct 30, 2026
• IRS, Rev. Proc. 2013-14, read Oct 30, 2026
• The Tax Adviser, Tax ethics and risk management, Part 1, Aug 31, 2026
• Journal of Accountancy, AICPA’s revised confidentiality rule and Sec. 7216, Mar 1, 2015
• Washington State Board of Accountancy, consent agreement ACB-1566, 2024
• 16 CFR 314.2, 15 U.S.C. 6802 and 15 U.S.C. 6803, read Oct 30, 2026
• Mode, Centific, Turing Project Lazarus, Pewter, read Oct 30, 2026; micro1, Oct 26, 2026