Lesson 3: The Exceptions Framework (§301.7216-2)

← Study Guide home · Lesson 3 of 12

What you can do without consent

Learning Objectives

After completing this lesson, you will be able to:

• Identify the major exceptions to §7216's consent requirement
• Apply the auxiliary service provider exception to cloud AI vendor scenarios
• Explain the four-part test for whether an AI vendor qualifies under the auxiliary service exception
• Distinguish exceptions that apply in typical firm operations from those relevant to AI use
• Identify what Rev. Rul. 2010-4 and Rev. Rul. 2010-5 established

Overview: Roughly 18 Exceptions

Treasury Regulation §301.7216-2 establishes a series of exceptions to the general prohibition in §7216. If a disclosure falls within an exception, no consent is required. There are approximately 18 enumerated exceptions across the regulation's subsections.

For the average tax practice, only a handful are regularly relevant. For AI use specifically, one exception dominates the analysis: the auxiliary service provider exception under §301.7216-2(d). But understanding the full menu of exceptions is important because it helps you understand what doesn't need consent, which clarifies where the gaps are.

The Most Important Exceptions for a Tax Practice

1. Disclosure Within the Same Firm (§301.7216-2(b)(2))

Text: A disclosure may be made to "an officer, employee, or member of the same tax return preparer as the officer, employee, or member making the disclosure."

Practical effect: Sharing a client file with another CPA in your same firm does not require consent. Everyone in the same entity is treated as the same preparer.

AI application: If your firm deploys a private, firm-controlled AI instance that runs entirely within your firm's own infrastructure and is operated exclusively by firm personnel, this exception may be relevant. However, the moment data leaves the firm's systems, even to a cloud server operated by an AI vendor, you are no longer within this exception.

2. Disclosure to Another Preparer for Return Preparation (§301.7216-2(b)(1))

Text: A disclosure may be made to "another tax return preparer... for the purpose of preparing or assisting in preparing a tax return..."

Practical effect: Sending client data to a co-preparer at another firm (for example, to a specialty firm for a complex pass-through issue) does not require consent if the recipient is also a tax return preparer working on that return.

AI application: A cloud AI vendor that provides services specifically in connection with preparing a specific return, and that is itself a "tax return preparer" within the meaning of §7216, may qualify under this provision. However, general-purpose LLMs are not clearly tax return preparers for this purpose.

3. The Auxiliary Service Provider Exception (§301.7216-2(d)): The One That Matters Most for AI

This is the exception that most practitioners and analysts rely on when arguing that cloud AI vendor use does not require client consent. It deserves detailed analysis.

The full text of §301.7216-2(d)(1) provides:

"Except as limited in paragraph (d)(2) of this section, an officer, employee, or member of a tax return preparer may disclose tax return information of a taxpayer to another tax return preparer (other than an officer, employee, or member of the same tax return preparer) located in the United States (including any territory or possession of the United States) for the purpose of preparing or assisting in preparing a tax return, or obtaining or providing auxiliary services in connection with the preparation of any tax return, so long as the services provided are not substantive determinations or advice affecting the tax liability reported by taxpayers."

Let's identify each element:

Element (a): "Located in the United States"

The vendor must be located in the United States, including U.S. territories and possessions. This requirement was added in the 2009 regulations specifically to address offshore outsourcing concerns. It now directly governs cloud AI.

⚠️ RISK: Consumer-tier versions of ChatGPT, Claude, and Gemini route data through multi-region infrastructure that includes non-US regions by default unless enterprise data residency is specifically configured. A vendor that processes data on non-US servers may not satisfy this element even if the company's headquarters is in the U.S.

Element (b): "For the purpose of preparing or assisting in preparing a tax return"

The services must be in connection with return preparation, not general business use, research for marketing, or any purpose outside of preparing a specific taxpayer's return.

Element (c): "Obtaining or providing auxiliary services"

"Auxiliary services" are ministerial, processing, or administrative services, not substantive tax analysis. The critical distinction is whether the service involves processing data versus deciding something about the tax treatment of that data.

Element (d): "So long as the services provided are not substantive determinations or advice affecting the tax liability reported by taxpayers"

This is the hardest line to draw with AI tools. The regulation intends to exclude services that make substantive tax decisions from the no-consent exception. This means:

• OCR scanning a W-2 → auxiliary service (ministerial processing)
• Organizing scanned documents into folders → auxiliary service
• Summarizing a client's fact pattern to suggest deductions → substantive determination (likely)
• Drafting a memo on whether a home office qualifies → substantive advice (clearly)
• Classifying a transaction category → arguably substantive
• Generating a letter explaining a tax position → substantive

⚠️ GUIDANCE GAP: No IRS guidance directly addresses where the "auxiliary vs. substantive" line falls for generative AI. The 2010 rulings addressed document scanning and outsourced data entry. The Pittman/Williford/Becker analysis in The Tax Adviser (January 2024) offers the current practitioner-canonical reading: scan-only, OCR-only, and data-formatting services are inside the exception; summarization, drafting, classification, and reasoning are outside it. But this has not been confirmed by IRS guidance.

The Four-Part Test Applied to AI Vendors

Combining the regulatory elements, here is the test for whether a cloud AI vendor qualifies for the auxiliary service exception under §301.7216-2(d):

✅ COMPLIANCE NOTE: The only cloud AI tools that have a credible argument for fitting within §301.7216-2(d) are enterprise-tier tools with: (1) contractually committed US-only data residency, (2) no-train/no-use-for-AI-training clauses, (3) scope-limited contracts covering tax preparation services, AND (4) limited to non-substantive use cases (OCR, formatting, document organization). Even then, conservative practitioners and most practitioners' E&O carriers would recommend obtaining consent as well.

4. Quality/Peer Review (§301.7216-2(e))

Disclosure in connection with a peer review, conducted by a CPA, attorney, EA, or enrolled actuary eligible to practice before the IRS, does not require consent. This applies to practice reviews sponsored by the AICPA, state CPA societies, and similar organizations. It does not apply to using AI to "review" your own work.

5. Professional Liability Insurance (§301.7216-2(g))

Disclosure to obtain or maintain professional liability insurance coverage does not require consent, to the extent necessary to obtain the coverage. This is a narrow exception, it covers disclosures to your E&O carrier in the underwriting context, not general sharing.

6. Disclosure to the IRS (§301.7216-2(a))

Disclosure to the IRS in connection with preparing, processing, or filing a return does not require consent. This is perhaps the most intuitive exception, you obviously need to send the return to the IRS.

Rev. Rul. 2010-4 and Rev. Rul. 2010-5

These rulings, issued in January 2010 in connection with the finalized 2009 regulations, addressed specific §7216 disclosure scenarios. They are worth knowing for what they actually held, and for one caution about how they are sometimes mis-cited.

Rev. Rul. 2010-4 addressed a preparer's use and disclosure of tax return information to communicate with taxpayers: contacting clients about tax-law changes affecting returns the preparer already prepared, and disclosing a list of client names and addresses to a third-party service provider that produces newsletters or similar bulletins. It did not address document scanning or storage.

Rev. Rul. 2010-5 addressed disclosure to the preparer's own professional liability insurance carrier: to obtain or maintain coverage, to report or investigate a claim, and to secure legal representation under the policy. It treated those as permitted auxiliary-related disclosures under §301.7216-2(d)(1), to the extent necessary. It did not address outsourced data entry.

⚠️ CAUTION: These two rulings are sometimes described, incorrectly, as the "scanning company" and "data-entry company" rulings. They are not. If you see that characterization (including in earlier drafts of AI-compliance material), treat it as an error.

Relevance to AI: The principle that ministerial processing (OCR, scanning, formatting, data entry) is auxiliary while tax judgment is substantive does not come from these two rulings. It comes from the text of §301.7216-2(d) itself, which limits the exception to services "not substantive determinations or advice affecting the tax liability," together with the regulation's definition that "a substantive determination involves an analysis, interpretation, or application of the law," and from current practitioner analysis (the Pittman/Williford/Becker reading in The Tax Adviser, January 2024). A cloud AI tool that does more than scan-and-format almost certainly crosses the line into substantive services that fall outside the §301.7216-2(d) exception.

📌 PRACTICE TIP: When evaluating a specific AI tool, ask the vendor directly: (1) Where is our data processed, are there any non-US processing nodes? (2) Is our subscription agreement a "zero data retention" or "no training" agreement? (3) What is the scope of services in your terms, are they limited to return preparation assistance? (4) Will you sign a data processing agreement that explicitly limits use to our contracted services? The answers will tell you whether the auxiliary service exception argument is credible for that specific tool.

Key Takeaways

• There are approximately 18 exceptions to the §7216 consent requirement. For AI use, the auxiliary service provider exception under §301.7216-2(d) is the central one to analyze.
• The auxiliary service exception requires: (1) US-based vendor, (2) services in connection with return preparation, (3) non-substantive services only, and (4) contractual confidentiality obligations.
• Consumer-tier cloud AI tools fail this exception because they typically have multi-region data routing, no specific return-preparation scope, and engage in substantive analysis (summarizing, drafting, classifying).
• Enterprise-tier tools with US data residency, no-train clauses, and scope-limited DPAs may have a credible argument, but even those should be evaluated carefully, and conservative practitioners will obtain consent as belt-and-suspenders.
• The ministerial-vs-substantive line comes from the text of §301.7216-2(d) itself ("not substantive determinations or advice affecting the tax liability"), not from Rev. Rul. 2010-4 (taxpayer communications / newsletter list) or Rev. Rul. 2010-5 (professional-liability insurer), which are often mischaracterized as the scanning and data-entry rulings.

Quick Review: Match the Scenario

Match each scenario to the correct exception (or identify that no exception applies):

Scenario A: Your firm uses a US-based document scanning service to digitize paper client files. The service only scans, OCRs, and stores documents, no analysis.

Answer: Potentially §301.7216-2(d) (auxiliary service provider). Scan-and-store with no analysis is the clearest ministerial-processing case under the regulation. Provided the vendor is US-based, contractually bound to confidentiality, and limited to non-substantive services, no consent is required.

Scenario B: You share a client's complete file with another CPA partner at your same firm to help finish the return before a deadline.

Answer: §301.7216-2(b)(2) (same firm disclosure). No consent needed, everyone within the same tax return preparer entity shares the same preparer status.

Scenario C: You paste the client's complete fact pattern into ChatGPT Plus (consumer tier) to get help drafting a memo on their depreciation elections.

Answer: No exception applies. ChatGPT Plus is consumer-tier with multi-region data routing (fails US location element) and is being used for substantive tax analysis (fails non-substantive element). Consent is required under §301.7216-3.

Scenario D: Your firm's AICPA peer reviewer asks to see 10 client files as part of the firm's practice monitoring review.

Answer: §301.7216-2(e) (quality/peer review). No consent required, provided the reviewer is eligible to practice before the IRS (CPA, attorney, EA, or enrolled actuary).

Scenario E: You are using your firm's Microsoft 365 Copilot subscription (enterprise tier, US data residency configured, zero data retention addendum in place) to OCR and summarize document content for data entry purposes only.

Answer: Strong argument for §301.7216-2(d). This is the best-case cloud AI scenario. US data residency, contractual confidentiality, and limitation to non-substantive (OCR/summary for data entry) all point toward the exception. But note: if you extend use to drafting memos or recommending tax positions, you exit the exception.

← Lesson 2: IRC §7216: The Foundation · Study Guide home · Lesson 4: Consent: When and How (§301.7216-3) →