Yes, but with conditions. The Tax Practitioners Board's guidance says tax and BAS agents must get each client's permission before disclosing their information to a third party, which can include entering it into AI tools, and should tell clients where their data will be stored and whether AI may be used. You stay responsible for every output, so AI work has to be checked and documented. And since 1 July 2026, many small practices are inside the Privacy Act for their AML/CTF work.
What is TPB(GS) 55/2026?
It is the TPB's guidance statement The use of Artificial Intelligence and the Code of Professional Conduct, issued on 22 July 2026 after an exposure draft in March. It applies to registered tax agents and BAS agents and explains how the existing Code under the Tax Agent Services Act 2009 applies when you use AI. It does not create new obligations, but it tells you how the TPB reads the ones you already have.
The tone is not hostile. The TPB says AI tools, used appropriately, offer "a significant opportunity to increase productivity". It then adds the part that matters: practitioners "are still ultimately responsible for the tax agent services they provide to their clients."
What does it say about confidentiality?
Code item 6 says you must not disclose any information relating to a client's affairs to a third party without the client's permission, unless you have a legal duty to do so. The guidance makes three points that catch people out:
- A third party is any entity other than the client and you. An AI provider is a third party.
- The information only has to relate to the client's affairs. It doesn't have to belong to them or have come from them.
- You "must obtain permission from each client prior to divulging client information to a third party (which can include entering client information into AI models and tools, depending on how these tools are configured and used)."
When you ask for permission, the TPB recommends you clearly tell the client about the proposed disclosure, "including noting to whom and where the disclosure will be made, where data will be stored and whether AI tools may be used."
Permission can come through a signed letter of engagement, signed consent, or another communication such as a fact find and consent. The TPB says a general authority consenting to disclosure to third parties may also be acceptable.
The guidance also says you are responsible for due diligence on the AI tools you use, including checking that information will be kept secure and Privacy Act requirements are met. Where tax file numbers are involved, the Privacy (Tax File Number) Rule 2015 adds further obligations.
What does it say about checking AI output?
The competency section draws on Code items 7 to 10 (competence, knowledge and skills, and reasonable care) and the 2024 Determination's rules on records, supervision and quality management. The key lines:
- Practitioners "must exercise their own professional judgement when advising clients and should not rely on AI output as a substitute for their own analysis of a client's circumstances."
- AI "may hallucinate or provide inaccurate information" and can't replace tax knowledge, experience or expertise.
- You should verify AI content "throughout each step of the workflow", set up processes to understand and contest AI outputs, and document those steps.
Whether you took reasonable care depends on the circumstances, including whether you checked the output before relying on it. In practice that means a reviewer, a record of the review, and an AI policy that sits inside your quality management system.
Does the Privacy Act apply to a small practice now?
For many practices, at least partly. The Privacy Act generally exempts businesses with a turnover of $3 million or less. But from 1 July 2026, AML/CTF obligations extend to "tranche 2" entities, which the OAIC's guidance for reporting entities says includes professional service providers such as accountants, lawyers, conveyancers and trust and company service providers.
Small businesses that are reporting entities must comply with the Privacy Act for personal information handled in connection with their AML/CTF obligations. Their other activities stay outside it unless another reason applies, and the OAIC names handling tax file numbers under the TFN Rule as one of those reasons. If your practice provides a designated service, assume the client identity documents and due diligence records in your files are covered.
The risk is not abstract. Of the 1,205 data breach notifications the OAIC received in 2025, 81 came from legal, accounting and management services.
For what the OAIC expects from any business using AI with personal information, see can you put client information into ChatGPT?
Which AI uses are low risk, and which aren't?
The question to ask of any task is: what client information leaves my systems, where does it go, and who checks the result?
| Lower risk | Higher risk |
|---|---|
| Drafting a client email from notes with names, TFNs and figures removed | Pasting a TFN, tax return or bank statement into a free or personal AI account |
| Writing the wording for document reminders, with client details merged in by your own system | Sending client files to a tool that uses inputs for training or passes prompts to a search engine |
| Summarising workpapers in an approved business tool, with client permission in place and a reviewer signing off | Letting AI output reach a client, or the ATO, without a practitioner reading it |
| Researching a technical question, then checking the answer against ATO sources | Relying on an AI answer about the law without verifying it |
Notice that the same task can sit in either column. Summarising workpapers is reasonable in a tool your practice has vetted and clients have agreed to. It is not reasonable in a staff member's personal chatbot account.
What should go in our engagement letter and privacy policy?
The TPB points to the letter of engagement as one way to get permission, so it is the natural place to be specific. Consider covering:
- that you use AI tools in providing your services, and for what kinds of work
- which providers, or kinds of providers, receive client information
- where client data is stored, and whether any of it goes overseas
- that a practitioner reviews all AI-assisted work before it is relied on
- how a client can ask you not to use AI on their affairs
Your privacy policy should match. The OAIC's AI guidance says businesses should update privacy policies and notices with clear information about their AI use. If you are only covered because of AML/CTF, the OAIC says your privacy policy need only cover your AML/CTF-related handling. And from 10 December 2026, covered businesses that use computer programs in decisions significantly affecting individuals must describe them in their privacy policy. Drafting emails is unlikely to trigger that. Automated client risk ratings might.
Get your professional body or lawyer to review the final wording. This is a list of topics, not a template.
How are other practices using AI?
Xero's survey of 524 senior accountants and bookkeepers, released on 29 September 2026, found 85 per cent of practices have tried AI but only 52 per cent use it day to day. Most (88 per cent) don't expect AI to reduce team numbers over the next year. Practices using AI daily were far more likely to rate their core processes as well documented (94 per cent, against 40 per cent of practices not using AI).
That last finding fits what we see. AI works best on a process that is already written down. If your document chasing lives in three inboxes and a spreadsheet, fix that first.
Where does a client portal fit?
Most practices still collect documents by email. That means client files, ID documents and sometimes TFNs sitting in inboxes, attachments forwarded between staff, and no single record of what has been asked for and received. The TPB even has a separate guidance statement, TPB(GS) 36/2021, on TFNs in email communications.
A client portal gives documents, requests and deadlines one secure place, with access limited to the client and the staff who need it. It also gives AI somewhere safe to work. Reminder drafts and request lists can be generated inside your own system, from data that never leaves it, and a person approves anything before it reaches the client.
We built a client portal for an accounting and bookkeeping practice covering document sharing, client communication and deadlines. One recent quote for an accounting practice's client portal was $15,000 fixed, plus $130 a month for hosting and support. The data we host is stored and processed in Australia and is never used to train models. If your practice software already includes a portal that your clients actually use, keep it. A custom build makes sense when the off-the-shelf one doesn't fit how you work. More on how we approach it on our client portal development page, and on choosing what to fix first in which admin to automate first.
Frequently asked questions
Can I use ChatGPT for tax work under the TPB Code? You can use AI tools, but you need each client's permission before disclosing their information to a third party, which can include an AI tool depending on how it is configured. You must also check the output and apply your own professional judgement before relying on it.
Is a signed engagement letter enough permission? The TPB lists a signed letter of engagement as one way to get permission, along with signed consent or a fact find and consent. It recommends telling clients to whom and where information will be disclosed, where data will be stored and whether AI may be used.
Does the TPB ban free AI tools? The guidance doesn't name products. But the OAIC's best-practice advice is not to put personal information into publicly available generative AI tools, and a free account rarely lets you answer the TPB's questions about where data goes.
Do bookkeepers need to follow this too? Yes, if they are registered BAS agents. The guidance applies to registered tax agents and BAS agents.
If you'd like to talk through how AI and a client portal could fit your practice, book a free 30-minute chat at /book.
This article is general information, not legal or tax advice.