AI Meeting Assistants for Accounting Firms: What Changed After IRS OPR 2026-19

Most AI meeting tools look alike at first glance — they join your Zoom call, transcribe the conversation, and save a searchable summary. Before IRS OPR Alert 2026-19, that was essentially the full analysis a CPA firm needed to make.

After June 2026, it is not.

The guidance applied Circular 230's confidentiality duty to AI tool selection. Any tool that processes client data — meeting notes qualify — without a written data processing agreement is now explicitly framed as a compliance risk. That changes the evaluation from "which AI notetaker for CPA firms is cheapest?" to "which tools have the right contracts in place?"

The compliance shift: why your meeting tool is now a Circular 230 issue

IRS OPR Alert 2026-19 applied two existing Circular 230 provisions to AI use. The provision that gets the most attention is the unconscionable fee rule — billing clients at pre-AI rates when AI cut your delivery time. But for meeting tools specifically, the confidentiality provision is the more direct hit.

Circular 230's confidentiality duty covers any client information a practitioner obtains while representing a client. When a client discusses their tax situation on a Zoom call and an AI meeting assistant is running in the background — transcribing, summarizing, storing — that transcript is client data. If the tool processes it on external servers without a written agreement between the tool vendor and the CPA firm, the OPR has explicitly said that creates a compliance exposure.

"Without a written data processing agreement" is the key phrase. This is not a rule against using AI meeting tools. It is a rule against using them without a contract.

For a full breakdown of Alert 2026-19 and its billing implications, see our post on IRS OPR 2026-19 and AI billing ethics for CPA firms.

The three categories of AI meeting tools for CPA firms

When you sort current meeting AI tools through this lens — who has signed data agreements, and on what terms — they fall into three groups.

Tools with enterprise data agreements (the safe tier)

These tools have data processing agreements readily available, typically as a Business Associate Agreement or vendor DPA:

Fathom — Fathom's paid tier (Fathom Team, from $19/user/month) includes a BAA for covered data and enterprise-grade data controls. Fathom's free individual tier is architecturally different: recordings are processed locally and stored on the user's machine rather than Fathom's servers, which makes it a lower-risk option for solo practitioners. For a firm deploying across staff, the paid tier with a formal data agreement is the right approach.

Otter.ai Business and Enterprise — The Business ($20/user/month) and Enterprise tiers include data agreements on request. Otter.ai will provide a DPA covering data handling, storage, and deletion. The free tier does not include this — see the next section.

Fireflies.ai Business — The paid Business tier ($19/user/month) provides a data processing agreement and restricts AI training use of your meeting data. Enterprise tier includes custom data residency. The free tier has no signed DPA.

Gong — For larger accounting firms (25+ seats) managing sales and client meetings, Gong's enterprise contract includes data processing agreements and SOC 2 Type II certification. More infrastructure than most small CPA firms need, but relevant for mid-sized practices with dedicated business development functions.

Fathom Team and Fireflies Business are the two that come up most often in reader conversations — both are appropriately sized for small CPA firms and both have contracts you can actually sign.

Tools with conditional compliance (requires verification)

Some tools occupy a middle tier: better data handling than free consumer products, but they don't publish their DPA terms publicly. For these, contact the vendor before using with client data.

Microsoft Teams + Copilot — If your firm is already on M365 Business Premium or higher, Teams meeting transcription with Copilot is covered under Microsoft's standard enterprise agreements. The compliance status depends on your specific licensing tier. If you're using a free or basic Teams tier, the enterprise data terms do not apply.

Zoom AI Companion — Included in paid Zoom plans, but data processing terms vary by tier. Business and Enterprise plans include data agreements; the basic paid plan may not. Check your Zoom contract before using AI Companion with client meeting data.

Free-tier tools that should not process client data

Otter.ai free tier — Meetings are processed on Otter's servers. The free tier has no DPA available and uses meeting data for service improvement. This is the specific risk profile the OPR guidance targets. Do not use Otter.ai's free tier for client meetings.

ChatGPT, Claude, Gemini (direct consumer use) — Pasting meeting transcripts into a general-purpose AI chatbot for summarization is a common workflow. Without an enterprise contract with privacy terms, this is processing client data without a written agreement. The consumer versions of these tools have no DPA available and default to using your data for model improvement.

Generic "free AI notetaker" apps — A category of free tools proliferated in 2025–2026. They join your calls, transcribe them, and offer summaries at no cost. The business model is typically data licensing or advertising. None of them have DPAs. None of them should be in your client-meeting workflow.

What to look for in a data agreement (4 non-negotiables)

When you review a vendor's data processing agreement before signing, check these four things:

1. Explicit data processing agreement or BAA. A privacy policy is not a data processing agreement. You need a signed document that designates you as the data controller and the vendor as the processor, and that specifies their obligations. Most enterprise tiers offer this on request; if the vendor won't provide one, that tells you what you need to know.

2. No AI training on your data. The agreement should explicitly state that your meeting data is not used to train the vendor's AI models unless you opt in. Some tools restrict this by default; others require you to find and change a setting. Verify before signing.

3. Data deletion timeline. When a client engagement ends, what happens to their meeting transcripts? The agreement should specify how long data is retained and how you can request deletion. "We delete on contract termination" is good. "We retain indefinitely for product improvement" is a problem.

4. Subprocessor disclosure. Who else does the vendor share your data with? Most AI meeting tools rely on third-party transcription or AI services. A compliant DPA lists these subprocessors and holds them to the same standards as the vendor. A DPA with no subprocessor list is an incomplete agreement.

What your engagement letter needs to say (template language)

Post-Alert 2026-19, your engagement letter needs a paragraph that covers AI tool use — including meeting tools. This paragraph does three things: names the category of tools used, confirms they are covered by data agreements, and gives clients a path to object.

Here is practical template language to adapt:

This firm uses artificial intelligence tools, including meeting transcription and summarization tools, to support service delivery. These tools are covered by written data processing agreements that restrict use of client information to service delivery purposes. Meeting transcripts are retained for [X] days and accessible only to firm staff working on your matter. If you prefer that AI transcription tools not be used in your meetings, please notify your engagement manager before scheduling calls.

Keep it in plain language. This paragraph creates the informed consent the OPR's confidentiality provision requires. It does not need to be longer.

If your engagement letter is more than six months old, it predates this guidance. Update it before your next client onboarding.

For engagement letter templates across billing, data handling, and AI disclosure, see our AI disclosure in engagement letters guide.

The meeting AI tools our readers use most

Based on reader conversations and tools covered in previous issues of The Crossing Report:

Fathom Team is the most common starting point for small CPA firms. The free individual tier works for solo practitioners managing their own client calls. The paid team tier ($19/user/month) includes the DPA needed for a staff-wide deployment.

Fireflies.ai Business is the second most common — particularly for firms that want call analytics alongside transcription: who spoke most, topic tagging, action item extraction. The Business tier includes the data agreement. The free tier does not.

Microsoft Copilot in Teams is the right answer for firms already standardized on M365 Business Premium or higher. You are likely already covered by Microsoft's enterprise data terms, and there is no additional contract overhead.

The pattern across all three: pick the paid tier, get the data agreement signed, update your engagement letter. That combination puts you on the right side of the OPR guidance regardless of which tool you choose.

FAQ

Which AI meeting tools are safe for client data in a CPA firm?

Tools with an available data processing agreement or business associate agreement at the paid tier: Fathom (Team tier), Otter.ai (Business or Enterprise), Fireflies.ai (Business tier), and Gong for larger firms. The distinguishing factor is the signed data agreement — not the brand. An enterprise-contracted version of any of these tools meets the Circular 230 confidentiality standard. Free-tier versions of the same tools typically do not, because there is no signed DPA in place.

Does IRS Circular 230 apply to AI meeting notes taken during client calls?

Yes. Circular 230's confidentiality provision applies to any client information obtained during professional representation — and that includes what is said on a client call. A transcript of a meeting in which a client discusses their tax situation, financial records, or business details is client data. If an AI meeting assistant processes that transcript on external servers without a written data agreement, IRS OPR Alert 2026-19 frames that as a Circular 230 confidentiality risk.

What language should CPA firms add to engagement letters about AI meeting tools?

Your engagement letter needs a paragraph that: (1) discloses that AI tools including meeting transcription tools are used, (2) confirms they are covered by data processing agreements, (3) states the data retention period, and (4) gives clients a clear way to opt out of AI transcription. A short plain-language paragraph handles all four. See the template in the section above — it is designed to be short enough that clients actually read it and sign it without pushback.

Can I use the free version of Otter.ai or Fathom with clients?

For Fathom: the free individual tier processes recordings locally on the user's machine, not on Fathom's servers. That architecture makes it a lower-risk option than most free-tier tools. It is not covered by a signed DPA, but the data exposure is more contained than cloud-processed tools. For staff-wide deployment, the paid Team tier with a formal agreement is the right call.

For Otter.ai: the free tier processes data on Otter's servers without a DPA available. That is the specific risk profile IRS OPR Alert 2026-19 targets. Use the Business or Enterprise tier with a signed agreement instead.

How do I tell clients I'm using an AI notetaker?

Two steps: verbal disclosure at the start of the call, and written disclosure in the engagement letter. Verbal: "I use an AI transcription tool during client calls to capture accurate notes. The recording is stored securely and used only for your matter." Written: see the template language in the engagement letter section above. Some clients will ask follow-up questions — having your tool's privacy terms and your firm's signed data agreement on file lets you answer them specifically. The goal is informed consent before the call starts, not an apology after.

---

AI meeting tools are one piece of a broader compliance picture that has shifted since IRS OPR Alert 2026-19. Every week, The Crossing Report covers the AI adoption decisions that matter to firm owners — including the compliance updates that the general AI press misses.

Subscribe to The Crossing Report — the weekly intelligence briefing for professional services firm owners navigating the AI transition.