Industry guide

Can a CPA firm sell data to AI? What IRC 7216 keeps out, and what a firm can license

AI data buyers name accounting firms as a target, and some accept firms with as few as 10 staff. Federal tax law and the AICPA code put client data out of reach. Here is what the rules say, with links to the text, and what firm-owned material can still qualify.

By Brian BoesenUpdated October 15, 2026Program terms checked October 15, 202613 min read

On this page

Why AI buyers want accounting records
What IRC 7216 covers
The 7216 consent rules
Why anonymizing doesn't fix 7216
The sale-of-practice provisions
Audit, advisory and bookkeeping clients
What can qualify, and what never does
How a firm should approach this
What a narrow scope is worth
If you refer clients to buyers
FAQ
Sources

The short answer

Anything a client gave you to prepare an income tax return, and anything you derived from it, is tax return information under 26 U.S.C. 7216. Disclosing it outside the regulations' narrow exceptions, without a valid written consent, is a federal crime when done knowingly or recklessly. Even an anonymous statistical compilation built from returns may not be sold for value except as part of selling the tax practice.

Client books and other client information need the client's specific consent under the AICPA code. What can qualify is firm-authored material with no client facts in it. Talk to a tax attorney before you talk to any buyer.

Why AI buyers want accounting firm records

Accounting is rule-bound, documented and repeated every month and every season, which makes it attractive training material. Five buyer programs name accounting work or accounting firms:

micro1 names “finance and accounting” among the six domains it buys (source: micro1, data partnerships).
Pewter lists “accounting and tax” as a sector. An accounting-firm example on its site describes “workpapers, reconciliations, financial models and tax files” (source: Pewter).
Endless names accounting firms and lists client onboarding, month-end close, reconciliation and SOPs as what it wants, with client books excluded (source: Endless).
HUMXN lists “accounting and tax” among its 24 seller types (source: HUMXN, sell company data).
Mode accepts accounting firms with 10 or more staff, below its usual floor of 20 (source: Mode, data program, BizBuyData, $50K referral).

Read those lists against the rules below. For a firm that prepares returns, client tax files and the workpapers built from them are tax return information under the regulations, so they are not records the firm can license, whatever an example on a buyer's site shows. Endless's exclusion of client books is the right instinct, though its other items, such as reconciliation records, still need a client-data review before anything leaves the firm.

For every program's eligibility and advertised terms, see who buys company data for AI.

What IRC 7216 covers, and what it means for AI training data

Section 7216 applies to anyone in the business of preparing income tax returns, or providing services in connection with preparing them, and to anyone who prepares a return for pay. It makes it a misdemeanor for that person to knowingly or recklessly:

disclose “any information furnished to him for, or in connection with, the preparation of any such return,” or
use that information “for any purpose other than to prepare, or assist in preparing, any such return” (source: 26 U.S.C. 7216 (Cornell LII)).

The criminal penalty is a fine of not more than $1,000 ($100,000 where the case involves identity theft under section 6713(b)), imprisonment of not more than one year, or both, together with the costs of prosecution (source: 26 U.S.C. 7216 (Cornell LII)). Section 6713 adds a civil penalty of $250 for each disclosure or use, up to $10,000 per calendar year, with higher amounts in identity theft cases (source: 26 U.S.C. 6713 (Cornell LII)).

The regulations define “tax return information” broadly. It means any information, including a taxpayer's name, address or identifying number, furnished in any form or manner for, or in connection with, preparing the taxpayer's return. It includes information from third parties, and it includes information the preparer “derives or generates” from tax return information in preparing the return (source: 26 CFR 301.7216-1).

For an accounting firm, that sweeps in more than the return itself:

The returns, the workpapers and the tax software files.
Source documents clients send for the return, such as W-2s, 1099s and K-1s.
Client books or ledgers you received in order to prepare the return.
Notes, emails and portal messages about the return.
Your client list, to the extent it is built from the people whose returns you prepare.

Licensing any of that to an AI developer would be a disclosure to a third party and a use outside return preparation. Section 7216 has no exception for AI training.

Why anonymizing doesn't fix 7216

Many owners assume that stripping names and Social Security numbers turns tax data into something else. The regulations say otherwise.

Tax return information “includes statistical compilations of tax return information, even in a form that cannot be associated with, or otherwise identify, directly or indirectly, a particular taxpayer” (source: 26 CFR 301.7216-1). Anonymous data from returns is still tax return information.

The regulations do let a preparer build anonymous statistics without consent, but only for narrow purposes: the internal management or support of the tax practice, or bona fide research or public policy discussion about taxation. Any compilation disclosed must be anonymous and cannot include an aggregate figure drawn from fewer than ten returns (source: 26 CFR 301.7216-2). And then the key line, from 26 CFR 301.7216-2(o)(2):

“A tax return preparer may not sell or exchange for value a statistical compilation of data described in § 301.7216-1(b)(3)(i)(B), in whole or in part, except in conjunction with the transfer of assets made pursuant to the sale or other disposition of the tax return preparer's tax return preparation business.” (source: 26 CFR 301.7216-2)

A buyer's promise to de-identify the data after it leaves your firm does not change any of this. The disclosure happens when the data leaves.

Exclude client data on your side, not theirs

Buyers describe their de-identification in good faith, but under 7216 the question is what you disclosed. Keep anything derived from returns out of the set entirely rather than relying on someone else to scrub it (source: Frankfurt Kurnit, Oct 1, 2026).

The sale-of-practice provisions cover a successor, not an AI buyer

Retiring owners often hear that 7216 has a sale-of-practice exception. It does, and it is narrow.

Taxpayer lists, paragraph (n). A preparer may keep a list limited to items such as client names, addresses, email addresses, phone numbers, entity type and return form number. It may only be used to contact those taxpayers with tax information or general business or economic information for educational purposes, or to solicit more tax return preparation work. The list may not be transferred to anyone “unless the transfer takes place in conjunction with the sale or other disposition of the compiler's tax return preparation business” (source: 26 CFR 301.7216-2).
Statistical compilations, paragraph (o). The same transfer rule applies to compilations, as quoted above (source: 26 CFR 301.7216-2).
The buyer inherits the limits. Whoever acquires the list or compilations in a practice sale falls under the same provisions (source: 26 CFR 301.7216-2).

Read together, these let a successor firm take over a tax practice and keep serving its clients. They do not describe licensing client data to an AI developer, which is not buying a tax return preparation business, and any acquirer would be bound by the same limits on use anyway. That is our reading of the text. Have a tax attorney confirm it for your facts before you rely on it.

A retiring owner can still look at licensing firm-authored material, on the same terms as an operating firm. The broader picture for closing companies is in our guide to licensing company data to AI companies.

Audit, advisory and bookkeeping clients: the AICPA confidentiality rule

Section 7216 covers income tax return work. Most firms do more than that, and the AICPA Code of Professional Conduct covers the rest. ET 1.700.001, the Confidential Client Information Rule, says:

“A member in public practice shall not disclose any confidential client information without the specific consent of the client.” (source: AICPA Code of Professional Conduct (updated Sep 2026))

The code defines confidential client information as any information obtained from the client that is not available to the public (source: AICPA Code of Professional Conduct (updated Sep 2026)). That covers client books and ledgers you keep or review, audit and review evidence, advisory deliverables, and payroll data you process for clients. Your state board of accountancy's rules apply as well.

If you prepare taxes, there is a security angle too. The FTC lists tax preparation firms among the financial institutions covered by its Safeguards Rule, which governs how customer information is protected (source: FTC, Safeguards Rule: What your business needs to know). Giving an outside party broad access to systems that hold client data cuts against that.

What an accounting firm can license to AI, and what never qualifies

The line: if it came from a client, or was built from something that did, it stays out. If the firm wrote it for itself and it contains no client facts, it can be considered after review.

Never in scope	Can qualify after review
Tax returns and the workpapers behind them	Audit programs and checklists the firm wrote, with no client facts
Client books and ledgers	Internal close and reconciliation SOPs, stripped of client data
Client correspondence, including email and portal messages	Training curricula the firm owns
Engagement files for audit, review, compilation or advisory work	The firm's own HR and operations policies
Payroll data processed for clients	The firm's own (not clients') financial and operating records, with client names and billing detail removed
Client lists drawn from returns	Blank engagement letter, checklist and workflow templates

Based on 26 U.S.C. 7216, 26 CFR 301.7216-1 to -3 and AICPA ET 1.700.001 (source: 26 U.S.C. 7216 (Cornell LII), 26 CFR 301.7216-1, 26 CFR 301.7216-2, 26 CFR 301.7216-3, AICPA Code of Professional Conduct (updated Sep 2026)). General information, not legal advice.

The right-hand column still needs care:

Checklists and audit programs. A blank program is the firm's. A completed one, with tick marks, findings and notes from a real engagement, is client information.
Procedures. A close procedure that says “for the dental group, reclass the lab fees” describes a client. Write it out in general terms or leave it out.
The firm's own books. Revenue records are built from client billing. Strip client names and billing detail, and remember that staff personal data raises separate questions.

What firm-authored material looks like

A useful test: could you hand this to a new hire on day one without any client knowing or caring? A blank audit program, a month-end checklist written in general terms, a staff training deck and a remote-work policy usually pass. Anything that needed a client to exist does not.

How an accounting firm should approach AI data licensing

Talk to a tax attorney first. Section 7216 is a criminal statute. Describe what you are considering before any buyer call, and check your state board's rules at the same time.
Inventory firm-authored material. List the programs, checklists, procedures, training and policies the firm wrote for itself, and who wrote each one.
Wall off every system that holds client data. Tax software, document management and client portals, practice management, email, and any client accounting files you host or can log into are out as whole systems. Pull firm-authored items into a separate, reviewed set.
Write the scope down with named exclusions. The license should list exactly what is included and name what is excluded: returns, workpapers, client books, client correspondence, engagement files, client payroll data and client lists.
Refuse system-wide connectors. Buyers often ask to connect to accounting and payroll systems. Handshake lists QuickBooks, NetSuite and Paychex among its sources (source: Handshake AI, license your data), and Mode names QuickBooks and NetSuite (source: Mode, data program). At an accounting firm, those connections reach client books.
Treat buyer de-identification as a backstop, not a plan. Anonymous compilations from returns are still tax return information, so the exclusions have to happen on your side.
Have a partner review the final set. Read what is actually going out, not a summary of it.

What a narrow scope is worth

A firm limited to firm-authored material is licensing far less than a company sharing its whole operating history, and buyers price on breadth and depth.

No program publishes an accounting-firm rate. The ranges buyers advertise describe broad records: micro1 advertises $100K+ for a qualified partnership (source: micro1, data partnerships), Mode advertises $100K to $5M with a calculator it labels indicative only (source: Mode, data program), and Handshake says partnerships range from $100K to $4M+ depending on the data shared (source: Handshake AI, data partnerships). Those are each company's own advertised figures for much wider datasets, such as email, files, CRM and accounting systems across a whole company. They are not offers and not a guide to what audit programs and procedures would fetch.

A narrower scope means a smaller deal, and some buyers may decline a set that small. For an accounting firm, a modest license of clearly firm-owned material, or no license, is the right outcome. Our data value checker shows which factors move price, and the law firm guide covers the parallel rules under ABA Model Rule 1.6.

If you refer clients to AI data buyers

Several buyers pay introducers, and CPAs are an obvious channel. The AICPA code limits this. Under ET 1.520.001, a member may not take a commission for recommending or referring a product or service to a client, or one to be supplied by a client, when the firm also performs an audit or review of that client's financial statements, certain compilations, or an examination of prospective financial information. Where a commission is permitted it must be disclosed, and any referral fee for recommending a CPA's services must be disclosed to the client (source: AICPA Code of Professional Conduct (updated Sep 2026)).

For how each program pays introducers, see AI data referral programs compared.

How Regulr is paid, and how we write these pages

Regulr is a sell-side advisor. When a business we introduce signs a license, we may be paid a fee by the buyer or through a program's referral terms. We list every program we can verify whether or not it pays us, order is never set by fees, and every figure is the company's own advertised term with a link to where it says so. Regulr has not closed a data deal yet, so nothing here describes our results.

Frequently asked questions

Can a CPA firm sell client data to AI companies?

No. Anything furnished for or derived from preparing a client's income tax return is tax return information under IRC 7216, and disclosing it outside the narrow exceptions in the regulations is a federal misdemeanor when done knowingly or recklessly. Client books and other client information from audit, advisory or bookkeeping work need the client's specific consent under the AICPA's confidentiality rule. What can qualify is firm-authored material with no client facts in it, after review.

Does IRC 7216 apply to AI training data?

Yes. Section 7216 does not care about the purpose of the disclosure. It covers any disclosure of information furnished for, or in connection with, preparing an income tax return, and any use of it for a purpose other than preparing returns. Licensing that information to an AI developer would be both a disclosure and a use outside return preparation.

Can a CPA firm sell anonymized client data?

Not if it comes from tax returns. The regulations define tax return information to include statistical compilations even in a form that cannot identify any taxpayer, and 26 CFR 301.7216-2(o) says a preparer may not sell or exchange such a compilation for value except as part of selling the tax return preparation business. Anonymized client data from non-tax work is still confidential client information under the AICPA rule.

What is the penalty for violating Section 7216?

Under 26 U.S.C. 7216, a knowing or reckless violation is a misdemeanor punishable by a fine of up to $1,000, or up to $100,000 where the case involves identity theft, up to one year in prison, or both, plus the costs of prosecution. A separate civil penalty under 26 U.S.C. 6713 is $250 per disclosure or use, capped at $10,000 per calendar year, with higher amounts in identity theft cases.

Does the 7216 sale-of-practice exception let me sell client data to an AI company?

No. The regulations let a preparer transfer its taxpayer list and statistical compilations only in conjunction with the sale or other disposition of its tax return preparation business, and whoever acquires them is bound by the same limits. Licensing data to an AI developer is not a sale of your tax practice. Have a tax attorney confirm how the rule applies to your facts.

Can my clients consent to their tax data being used for AI training?

The regulations allow some disclosures with a written consent, but the bar is high: each consent must be signed and dated before any disclosure, name the preparer, the taxpayer, the purpose and the specific recipient, specify the information, and be knowing and voluntary. A consent you make a condition of service is not voluntary. We do not treat client tax data as in scope for any introduction, and anyone considering this path needs a tax attorney first.

What accounting firm data can be licensed to AI companies?

Only material the firm wrote for itself that contains no client information. Examples are audit programs and checklists written by the firm, internal close and reconciliation procedures stripped of client data, training curricula, HR and operations policies, and blank templates. Each item needs a review, because a checklist annotated for a real engagement carries client facts with it.

How much do AI companies pay accounting firms for data?

No program publishes a rate for accounting firms. Advertised ranges such as micro1's $100K+ tier or Mode's $100K to $5M describe broad operating records across a whole company, not a narrow set of firm-owned procedures. A firm that keeps client data out, as it must, is licensing much less, so expect a smaller figure, and some buyers may pass.

Sources

Statute, regulation and AICPA code text read in full on October 15, 2026. Program terms checked against each company's own pages the same day.

Brian Boesen · Founder, Regulr AI

Brian runs Regulr AI, which works for established businesses that want to license de-identified records to AI companies. He checks each program's published terms against its own pages and updates these guides when they change. Last updated October 15, 2026.

This page is general information, not legal advice. Rules vary by state and by profession, and they apply to your facts, not to a category. Before you share anything, have your own counsel (and for law firms, your state bar's ethics hotline) confirm what is in scope.

Keep reading

Law firms and AI data licensingWhat a firm may license under Rule 1.6, and what never leaves the building.Who buys company data for AIEvery program we track, with eligibility, advertised pay and referral terms.What is my company data worth?Check which programs you likely qualify for and what each advertises.AI data referral programs comparedWhat each program pays introducers, and the rules for CPAs and lawyers.