The AICPA client confidentiality rule and the prep notes: what they carry
Nobody pastes a whole return into ChatGPT. What goes in is the part slowing someone down: organizer notes to turn into a missing items list, a W-2 to check against last year’s, a notice that needs a reply, the email to a client who still owes you 1099s. Each carries the numbers tying a client to the IRS and the bank: SSN, ITIN, EIN, routing and account numbers.
The AICPA client confidentiality rule covers all of them. Its formal name is the Confidential Client Information Rule, ET sec. 1.700.001, and in August 2026 the Journal of Accountancy applied it to AI tools, noting that CPAs in public practice carry that rule as an added layer on top of everyone else’s duties. How redaction plays for accountants is covered in our guide on redaction before AI.
The person who answers for this is the Qualified Individual the FTC Safeguards Rule requires the firm to designate, and in a small firm that is usually the managing partner. The rule treats a tax preparer as a financial institution and expects a written information security program in place before the season starts, which in practice means before the first return is touched each January.
Client confidentiality at the keyboard: what reaches the AI
The preparer highlights the notes and hits the key. On that machine, every identifier Nonimo recognizes turns into a placeholder before the text goes to the chat. The AI answers in placeholders too, and Nonimo writes the real numbers back into its answer. Exactly what runs locally, and the little that reaches our server, is set out field by field on our security page.
Proof and suspicion are handled differently. A number with arithmetic behind it is masked without a question. One recognized by the words written before it is masked too, but in view, with the reason stated and one click to reverse it. Either way, the real numbers go back into the AI’s answer on the preparer’s machine, ready to check against the file.
In the example, the SSN beginning 000 cannot exist and was masked anyway, because “Taxpayer SSN” in front of it is the proof. The spouse’s ITIN, the business’s employer identification number and the routing number for the refund went the same way, each behind the words that name it, and the client’s name became a placeholder. Read the AFTER as you would a draft return before signature.
Before: what gets pasted
List what is still missing for this return. 2025 Form 1040, married filing jointly Client: Jane Doe Taxpayer SSN 000-00-0001 Spouse ITIN 970-00-0001 Schedule C business, employer identification number 00-0000001 Refund by direct deposit, ABA routing number 130000006
After: what the AI receives
List what is still missing for this return. 2025 Form 1040, married filing jointly Client: [PERSON_1] Taxpayer SSN [REFERENCE_1] Spouse ITIN [REFERENCE_2] Schedule C business, employer identification number [REFERENCE_3] Refund by direct deposit, ABA routing number [REFERENCE_4]
What the AICPA confidentiality rule and section 7216 ask of the firm
The question quoted here is the whole of the AICPA client confidentiality rule as it meets AI: before pasting, decide whether the text is confidential client information. Nonimo does not answer that for the preparer. When the answer is yes, the key masks the identifiers it recognizes before the text leaves, and the preparer reviews the result before sending.
For return information there is a statute behind the ethics rule. Section 7216 of the Internal Revenue Code makes it a misdemeanor for a preparer to knowingly or recklessly disclose information furnished for a return: up to a year in prison, a fine of up to $1,000 ($100,000 where section 6713(b) applies), or both. Disclosures under Treasury regulations, or with the taxpayer’s consent, are carved out.
A signed column in the Journal of Accountancy on July 1, 2026, written for the AICPA’s journal rather than issued by the AICPA, tells CPAs to learn “how and where information provided to each AI tool is stored, who has access to the information, whether the information is de-identified, and whether the information is used to feed and further train the tool.” Our ChatGPT data guide answers that for OpenAI.
Client confidentiality at the CPA firm: price and getting started
The app runs on Mac and on Windows. Nonimo’s free plan stops at a set number of words each month. Leave an email address on our license page and a free license file comes back that removes the cap through January 31, 2027, with no account to set up. The best time to install it is before the season, alongside the written program.
Install it on each preparer’s computer. Firm-wide, IT deploys a browser extension by policy that covers text unasked and, where the firm decides, blocks. In your written program, call the app what it is: a masking tool, not a block. The Qualified Individual the Safeguards Rule asks the firm to designate is the person to sign that description off.
As for what reaches us: no text from any return. The app records nothing about the swaps it made, and keeps the conversation encrypted where it sits, so the numbers can come back. Our security page lists everything the app does send. That is also the answer to the Journal of Accountancy’s question about where information is stored and who can access it.
- Free today, on Mac and Windows
- With a monthly word allowance
- The free license lifts it through January 31, 2027, no account needed
Questions from CPA firms
Can our staff use ChatGPT on client returns?
Only after answering the question the AICPA's own journal puts first: is this confidential client information? If it is return information, section 7216 of the Internal Revenue Code applies as well, together with its carve-out for disclosures the taxpayer consents to. Nonimo cannot make that call for the firm; once you have made it, the key changes what actually reaches the AI, starting with the SSN and ITIN.
We have a business plan with our AI vendor. Isn't that enough?
A signed column in the Journal of Accountancy on July 1, 2026 does not say so. It tells CPAs to find out how and where the information is stored, who can access it, whether it is de-identified and whether it trains the tool. For our own part of that list the answer is short: the matching runs on the preparer's computer, and no text from a return reaches Nonimo.
Does pasting a return into ChatGPT violate section 7216?
Not automatically. Section 7216 makes it a misdemeanor for a preparer to disclose return information knowingly or recklessly, with up to a year in prison, a fine of up to $1,000, or both, and it carves out disclosures under Treasury regulations or with the taxpayer's consent. Nonimo does not make a disclosure lawful or unlawful; it cuts down how much of the taxpayer leaves the machine in the first place.
Does Nonimo belong in our written information security program?
It can, as long as the description is accurate. The FTC Safeguards Rule, 16 CFR Part 314, requires every tax preparer to keep a written information security program, and firms holding information on 5,000 or more consumers also need a written risk assessment and incident response plan. Describe Nonimo as it is: a masking tool on each workstation that the preparer triggers with a key.
Will Nonimo see our clients' returns?
No. All of the matching happens on the preparer's computer, and no text from any return is ever sent to us. What our server does receive is a single usage count per day, carrying the allowance consumed, the build and the system it runs on, every field of it published on our security page. The conversation itself stays on the preparer's disk, encrypted, so the numbers can be restored.