Create an AI use-case inventory
Record business owner, users, data, model or service, tools, decisions affected, client impact, jurisdictions, risk tier, approvals, controls, and current status. Shadow experiments should have a safe disclosure and review path.
NIST's AI RMF offers voluntary govern, map, measure, and manage functions that organizations can adapt to their context.
Tier the risk
Document classification may differ materially from tax-position drafting, return-field population, client advice, or autonomous external action. Higher-risk uses require stronger evidence, human approval, testing, access control, monitoring, and fallback.
Prohibit or isolate uses that cannot meet the firm's taxpayer-data and professional-responsibility requirements.
Evaluate the full system
Assess model behavior, prompts or rules, retrieval sources, integrations, permissions, user interface, human workflow, vendor operations, and downstream actions. A model test alone cannot validate the production system.
Use representative and adversarial cases, including missing and contradictory evidence.
Control change and incidents
Require notification and re-evaluation for model, workflow, data, integration, subprocessor, and policy changes. Define monitoring, suspension, investigation, client-impact assessment, and reporting procedures.
Coordinate with the firm's written information security plan and incident response process.
Plan portability and exit
Document export, audit-trail retention, account closure, data deletion, integration removal, client continuity, and manual fallback. Avoid a dependency the firm cannot unwind during filing season.
Review the inventory and risk decisions on a scheduled basis and after material incidents or regulatory changes.
Sources and limitations
- AI Risk Management Framework — National Institute of Standards and Technology; reviewed August 15, 2026.
- Protect your clients; protect yourself — Internal Revenue Service; reviewed August 15, 2026.
This article is educational and is not tax, legal, accounting, security, or investment advice. Product capabilities and tax requirements can change. Confirm current vendor scope and authoritative guidance for the relevant facts, tax year, and jurisdiction.
How this article was prepared
We separate current sourced facts from operational recommendations, avoid invented performance claims, and show the primary sources and review date used.
Read the editorial methodology