IRS Circular 230 AI Liability for CPAs

Published: October 1, 2026 | By: The Crossing Report

Most CPA firms using AI right now are running an invisible liability. Not because they're doing anything reckless — because no one told them the rules changed.

On June 24, 2026, the IRS Office of Professional Responsibility issued a clarification that every accountant using AI tools needs to understand: CPAs are fully liable for errors in AI-generated work product, and "over-reliance" on AI output without independent professional oversight is itself a Circular 230 violation.

This isn't new law. It's existing law — the diligence, accuracy, and competence standards in Circular 230 — applied explicitly to the AI context. The OPR didn't wait for Congress. They applied what's already on the books.

Here's what that means for your firm.

What Circular 230 Says About AI (The June 2026 Clarification)

Circular 230 (31 CFR Part 10) is the regulation governing practice before the IRS. It applies to anyone who prepares returns, provides written tax advice, or represents clients in IRS matters — CPAs, enrolled agents, tax attorneys, and others.

The core obligations haven't changed. Section 10.22 requires diligence as to accuracy. Section 10.35 requires competence — the knowledge, skill, and thoroughness appropriate to the engagement. Section 10.37 sets standards for written advice.

What the June 2026 OPR clarification did was make explicit what those standards mean when AI is in the workflow:

The AI is not the practitioner. You are.

When you sign a return, deliver a tax memo, or advise a client on a position — you are the person responsible for that work. The tool that helped you draft or research it doesn't appear in the OPR's disciplinary process. You do.

That's the full scope of the clarification: AI doesn't change who is responsible. It only changes how work gets done. And if how you're doing the work involves accepting AI output without adequate review, you're already in violation territory.

The "Over-Reliance" Standard — Where the Line Is

The OPR framing that matters most is "over-reliance on AI output without professional oversight."

Over-reliance doesn't mean using AI. Using AI to draft, research, calculate, or organize is fine. The line is whether you're exercising independent professional judgment over what comes out.

What over-reliance looks like in practice:

AI generates a research memo; you review the formatting and send it to the client
AI completes a draft return; staff checks for obvious errors and queues it for filing
An AI assistant answers a client's tax question in a client portal; no CPA reviews before delivery
Staff uses AI to identify deductions; the deductions go into a return without substantive verification against the facts and applicable law

In each case, the AI is doing real work and the CPA is not independently vouching for the conclusions. That's the exposure.

What adequate review looks like:

The test the OPR applies is essentially: could the CPA explain and defend every position in the AI-assisted work without pointing to the AI? If the CPA's only basis for a position is "that's what the software said," that CPA has relied rather than reviewed.

This doesn't require re-doing the work from scratch. It requires a practitioner to apply their professional knowledge to the AI's conclusions — checking the logic, verifying that cited authorities actually say what the AI claims, and confirming the positions are consistent with the client's facts.

Adequate review is substantive. Spot-checking formatting is not adequate review.

Three Scenarios That Create Circular 230 Exposure

Scenario 1: AI-Drafted Written Advice

A client asks whether a business transaction qualifies for a favorable tax treatment. Your firm uses an AI tool to research the question, generate a memo outlining the applicable code sections and authorities, and draft a conclusion.

A CPA reviews the memo quickly, agrees it looks right, and sends it to the client.

The exposure: The AI's citation to a revenue ruling was partially inaccurate — the ruling had been modified by a subsequent notice the AI missed. The client relies on the advice, takes the position, and gets audited. The OPR receives a referral.

Under Circular 230 Section 10.37, written advice must be based on reasonable factual and legal assumptions, reasonably consider all relevant facts, and not rely on representations the practitioner knows or should know are false. The practitioner signed off on advice they didn't independently verify.

Scenario 2: AI-Assisted Return Preparation

Your firm uses AI to assist with return preparation — inputting data, identifying deductions, flagging anomalies. The AI-assisted process is significantly faster, and staff have grown accustomed to treating the AI's outputs as the starting point for filing.

For one client, the AI misapplied a complex passive activity loss rule. The staff reviewer didn't catch it. The return was filed with an understatement of tax.

The exposure: Section 10.22 requires diligence as to accuracy. "The preparer wasn't checking the AI outputs closely" is not a defense — it's a description of the violation.

Scenario 3: AI-Powered Client Communication

A client portal or email assistant handles routine client questions using an AI model trained on tax guidance. A client receives an answer about estimated tax payments that was based on outdated IRS guidance. They underpay and face a penalty.

The exposure: If a licensed practitioner didn't review that advice before delivery, you delivered professional services without professional oversight. Circular 230 applies to tax advice in any form.

What "Adequate Supervision" of AI Output Looks Like

The OPR guidance points to three elements of adequate supervision. These are not aspirational standards — they're the minimum floor for Circular 230 compliance when AI is in the workflow.

1. A documented review step

Every AI-assisted work product needs a point in the workflow where a licensed CPA reviews and approves it before it leaves the firm. This step should be documented. If an OPR investigation asks "who reviewed this AI-generated advice and when," you need an answer.

A workflow that treats AI output as a finished product — rather than a draft requiring sign-off — has already failed this test.

2. Substantive verification, not formatting checks

Review means verifying that the conclusions are accurate. For tax research: checking that cited authorities say what the AI claims, and that no contrary authority was missed. For return preparation: verifying that the positions are consistent with the client's actual facts and applicable law.

This is not the same as scanning the document for obvious errors. Circular 230's diligence standard applies to the substance.

3. Professional judgment applied

The CPA reviewing AI-assisted work must be able to independently explain why the position is correct. If a CPA's only basis for a position is that the AI flagged it as favorable — without the CPA independently understanding why — that's the over-reliance the OPR is describing.

What this looks like operationally:

For most small CPA firms, adequate supervision means one structured review step added to the workflow: AI generates a draft, a licensed CPA reviews the substantive conclusions against primary sources, approves, and the work goes out. That review might take 15-20 minutes for a complex memo that AI drafted in 5 minutes. That's still faster than writing the memo from scratch — and it's compliant.

The firms that have built this review step into their workflows aren't slowing down. They're running more engagements with the same headcount and sleeping fine.

The Firms Already in Production Are Ahead of This

The CPA firms that started integrating AI 12-18 months ago and built systematic review processes from the beginning have a compounding advantage now.

They are faster — AI drafts what used to take hours in minutes. They are also protected — the human review step is built into the workflow, not an afterthought. They didn't wait for the OPR guidance to build compliant processes; they built compliant processes because it was the right way to integrate a new tool.

The firms that are behind are not the ones that tried AI and failed. They're the ones that never built the review step — firms where AI outputs flow out of the firm with minimal CPA oversight because the speed gain was too tempting to slow down.

If that describes your firm, the OPR guidance gives you the specific correction: add the review step, document it, and make sure your CPAs can defend every AI-assisted position independently.

The firms that adapt now will look back at the June 2026 clarification as the moment they got ahead of the next wave of peer discipline actions — not the moment they got caught.

The One Thing to Do This Week

Pull one AI-assisted work product your firm sent to a client in the last 30 days. Ask: could the CPA who signed off on this independently verify every substantive conclusion without pointing to the AI output?

If the answer is yes, you have a defensible process. Write it down.

If the answer is no, that's your starting point. Build the review step before the next engagement, not after the next OPR inquiry.

Want a weekly roundup of AI compliance updates for professional services firms — with specific guidance on what to do, not just what changed? Subscribe to The Crossing Report — free for the top insights, premium for the deep-dive implementation guides.

Related reading:

IRS Circular 230 and AI: What CPA Firms Are Now Liable For