TPB AI Guidance: Client Data and Review

TPB AI guidance applies your existing professional duties to AI use: protect client information, review output and supervise staff. If staff paste client details into a chatbot, pause that use until you establish what leaves the practice and whether the client permitted it.

The TPB’s AI Guidance

The final guidance is TPB(GS) 55/2026, The use of Artificial Intelligence and the Code of Professional Conduct. It is a published Guidance Statement for registered tax agents and BAS agents, following an earlier exposure draft. It explains existing obligations under the Tax Agent Services Act 2009 and Code Determination, without creating new legal duties.

The TPB’s published AI guidance covers embedded AI as well as separate AI tools. You remain responsible for the services you provide. A tool’s polished answer cannot establish that you have met the Code of Professional Conduct.

Client Data and Permission

Code item 6 requires client permission before you disclose information about their affairs to a third party, unless you have a legal duty to disclose. Entering information into an AI tool can create that disclosure. Assess the tool’s actual settings and arrangements before deciding whether information stays within the practice.

Under the TPB’s confidentiality guidance, permission can be recorded in an engagement letter, signed consent or another client communication. The communication needs to explain the disclosure and who receives the information. Permission to prepare a return does not automatically answer every question about a separate provider’s use of that information.

The Office of the Australian Information Commissioner (OAIC) recommends keeping personal information out of publicly available generative AI tools as best practice. Its commercial AI privacy guidance also calls for examining provider terms and settings. Where the Australian Privacy Principles apply, assess the proposed use or disclosure under APP 6.

Before approving a tool, record these details.

• List the information that leaves the practice, including information inside attachments.
• Identify each recipient, including any provider reached through a connected feature.
• Record the storage location and how long prompts and outputs remain.
• Establish whether the provider can use the information to train models or develop its services.
• Identify the settings that prevent unwanted sharing and the staff who can change them.
• Match the proposed disclosure to the client’s recorded permission.

Removing a name alone can leave someone identifiable through the remaining details. Use invented information for staff exercises, and approve any real-client use separately. Our recording client permission helps you record what the client authorises.

The OAIC’s TFN guidance explains that the TFN Rule protects individuals’ TFN information. Use or disclosure must have a permitted purpose under the relevant law. A client’s general consent to AI use cannot create that authority. Set a practice rule that staff exclude every TFN from general AI prompts and attachments.

Reviewing AI Output

Review AI output against the client’s actual circumstances and the relevant authority before relying on it for advice or lodgement. Reasonable care depends on the task and circumstances. The TPB guidance calls for documented verification and professional judgement throughout the work.

Use the following review sequence for substantive tax work.

1. Compare the AI’s assumed facts with the client file. Resolve any missing fact that changes the answer.
2. Open each cited authority at its original source. Confirm that the document exists and that the cited passage supports the conclusion.
3. Check the provision’s application to the relevant entity and income year. Examine exceptions that affect this client.
4. Recalculate any figures independently. Follow the reasoning from the facts to the proposed advice.
5. Record what the reviewer corrected and the basis for the final advice. Refer work beyond the reviewer’s competence to an appropriately qualified person.

In a fictional example, an assistant drafts advice for a company and cites an ATO ruling that the reviewer cannot find. The draft also assumes a loan qualifies for a concession without establishing the borrower’s circumstances. The reviewer holds the advice, obtains the missing facts and replaces the unsupported conclusion with analysis of the actual authority. The file keeps that reasoning before any advice goes to the client.

That review establishes the basis for the advice. Merely asking the same chatbot whether its first answer is correct supplies another output, with the same need for assessment.

Supervising Staff AI Use

Give staff a written AI rule that identifies approved tasks, permitted inputs and the person who reviews each output. The TPB’s supervision and quality-management guidance requires appropriate supervision and documented, enforced policies. Match review responsibilities to staff knowledge and the complexity of their work.

For each approved tool, keep a short approval record. Name the account arrangement, permitted uses, data restrictions and responsible reviewer. Record the settings assessed and the reason the practice accepts them. Reassess that decision when the provider’s terms, connected features or your intended use change.

A useful staff rule can distinguish rewriting a generic reminder from drafting tax advice using client information. The first task can use an invented example. The second needs the approved data arrangements, relevant client permission and substantive review before use.

Train staff to recognise invented citations and unsupported assumptions. Give them a route to report accidental uploads immediately. Review samples of actual work to establish whether staff follow the rule. Our AI for accountants guide explains practical uses by task.

Tax Genie’s AI Review Boundaries

Tax Genie removes every TFN before AI review and checks submitted client forms automatically. Rule-based checks cover format, register matches, consistency and missing documents. AI then reviews the answers for common client mistakes, such as GST registration with no reporting frequency.

Staff can turn individual checks on or off. Tax Genie emails fixable issues straight to the client as a plain list and reopens only the affected sections on the same private link. Your practice receives the corrected form, and staff changes record who changed what and when.

Those checks help you start professional work with cleaner client information. Your practice applies its tax knowledge to that information, decides the advice and signs off the work for lodgement. Record the permitted use of AI-reviewed forms in your practice’s approval procedure, alongside the client-data arrangements.

TFN removal addresses one specific data restriction. Assess permission for the other client information involved in AI review through the same disclosure questions you apply to any approved tool.

Tell Clients What Matters

Explain the proposed disclosure before sending client information to a third party, and retain the client’s permission. The AI guidance recommends explaining who receives the information, where disclosure and storage occur and whether AI tools may be used. A general third-party authority can be acceptable when it covers the disclosure.

A practical explanation names the work AI assists with and the information the provider receives. Separate that explanation from permission to disclose. A notice saying the practice uses technology does not, by itself, establish that the client authorised this particular disclosure.

Where applicable, reflect AI use in your privacy policy and collection notices, as the OAIC recommends. Describe professional review in terms of what the practice actually does. Avoid promising that AI cannot make mistakes or that information stays in Australia without a factual basis.

For the staff chatbot use you discovered, compare the actual uploads with the recorded permission and approved settings first. Then give staff the permitted task, prohibited inputs and reviewer’s name before that use resumes.