Four short things, and the one most firms draft first is not among them. An engagement letter is a contract for services, so it is a good place to say how your firm works and who carries the work. It is the wrong place, and for a 1040 client a legally empty one, to ask permission.
- What usually gets written is a small policy statement, and a contract is a poor home for one. Everything in a letter is a term, and a term is something a client can hold you to.
- For a client not filing a 1040, the regulation names the engagement letter as a perfectly good home for consent. For a 1040 client the same regulation puts it on a sheet of paper by itself.
- That is not a formatting rule with a formatting reason. Consent has to be voluntary, and something a client must sign to be taken on is not a choice.
- Write the letter so it outlives the software. It is re-signed once a year, and the vendor underneath it will change sooner than that.
What the letter is actually for
Engagement letters do a short list of jobs: what you are being engaged to do, what you are not, what each side has to provide, what it costs, who is responsible for what, and how either of you gets out. Firms about to connect an AI tool reach for that document because it is the one thing every client signs, every year, without being chased twice. The reach is right. What tends to get written is not.
What gets written is a paragraph about artificial intelligence. The firm uses AI responsibly. Appropriate safeguards are in place. Client data is protected at all times. Read that as a client and it is reassuring. Read it as a term of a contract and it is a promise to an unstated standard, drafted by you, enforceable against you, and defined by nobody.
So the test for each sentence is narrow. Is this something I want to be held to for this year’s work, by this client, in front of somebody reading it later without goodwill? “We use AI responsibly” fails it. “We may use AI-assisted software in performing the services, and the work remains ours and is reviewed by a person before it is issued” passes, because you can keep it and would want to.
There are four places in a letter you already have where this belongs: how the work gets done, confidentiality and who else may see the file, who is responsible for the result, and what you charge. A sentence that does not fit under one of those four is not engagement-letter material. It is a policy for your own staff, which has a different reader and a different purpose, or it is a consent, which the next section is about.
The consent it cannot carry
If you prepare federal returns, the permission you want from a client is governed by §7216, and the regulation under it has an explicit view on where that permission may sit. The view is different for two clients you may bill in the same week.
For a client not filing a return in the Form 1040 series, the answer is generous. Consent “may be in any format, including an engagement letter to a client, as long as the consent complies with the requirements of §301.7216-3(a)(3)(i)” (26 CFR §301.7216-3, checked 19 August 2026). Those requirements are a checklist rather than a hurdle: both names, what the disclosure is for, who specifically receives it, which information is covered, and the client’s signature and date. Your 1065 and 1120 letters can carry it.
For a 1040 client, the same regulation hands the format to guidance, and the guidance is Rev. Proc. 2013-14 (checked 19 August 2026). A paper consent has to be on letter-size paper or larger, in at least 12-point type, and then the clause that settles it: all of the text on each sheet of paper must pertain solely to the disclosure or use the consent authorizes. An engagement letter is a sheet of paper covered in other text. There is no drafting clever enough to get around that, because the rule is about what else is on the page.
The reason behind the rule is worth having, because it explains why the answer feels so absolute. Consent under this regulation “must be knowing and voluntary”, and the regulation then says what destroys the second half: “conditioning the provision of any services on the taxpayer’s furnishing consent will make the consent involuntary, and the consent will not satisfy the requirements of this section.” A clause in an engagement letter is a condition of the engagement. Sign it or we do not act for you. The separate sheet is not tidiness. It is the physical form of a client being able to decline and still be your client.
That general bar has an exception, and it is honest to say that it is the one most likely to be in play here. A preparer may condition its services on consent to disclose return information to another tax return preparer “for the purpose of performing services that assist in the preparation of, or provide auxiliary services in connection with the preparation of, the tax return.” Whether the tool you are connecting sits inside that description, or inside one of the other permitted disclosures, is a real analysis rather than an assumption, and it belongs with your own adviser alongside the general duty and the questions to send a vendor. What does not move either way is the format. Even where you may properly condition the engagement on it, a 1040 consent still cannot be a paragraph inside the letter.
Which leaves one thing worth naming plainly. A firm that writes the consent into a 1040 engagement letter has done something worse than fail to obtain consent. It has produced a document that looks like consent, and a file that looks answered stops anybody asking the question again.
The four lines worth writing
Here is what the letter can carry, written to be signed rather than admired.
How the work gets done. Say that the firm uses software, including AI-assisted tools, in providing the services, and describe it by function rather than by brand: reviewing correspondence, drafting replies, pulling figures out of documents you are sent. Function survives a change of supplier. A product name in a signed letter turns every software decision into a contract amendment, which is a cost you will pay in year two for a sentence that impressed nobody in year one.
Who is responsible. The work remains the firm’s, formed by your professional judgment, checked by a person before it is issued. This is the sentence clients want and the only one most of them will remember, and it costs you nothing, because it is a restatement of what you already owe them. The temptation to resist sits right beside it: a clause disclaiming liability for errors arising from AI tools. Whatever it does for you legally, it announces to a client that something reaches them unchecked, which is the exact opposite of the sentence above and in the same paragraph.
What the client sends you, and how. The clause most letters skip, and the only one in the four that changes anybody’s behaviour. If you want documents through the portal rather than pasted into email, the engagement letter is where that stops being a preference and becomes a term. It is also the thing to point at in March, when the same client emails a photograph of a W-2 for the fourth year running.
What you charge. If you bill by time and the software takes some of the time out, decide what that means and write it once. Usually it means nothing, because the fee is for the work and the judgment rather than the hours spent producing it, and saying so is cleaner than leaving it to be inferred. The clause not to import is the AI billing paragraph that appears in every law-firm template. It exists because attorneys bill in fractions of an hour against a standard of reasonableness a court will review. Copying it into an accounting engagement imports a question your client had not asked.
Notice what is absent from all four: no product, no model, no vendor, no feature. That absence is the point. The letter is the slowest-moving document in the relationship, and the software underneath it is the fastest-moving thing in your practice.
What you can promise is capped by what you bought
There is a second document with the same shape as the 1040 consent, on the other side of you, and firms find it late.
Standard software terms in this category tend to exclude the data you actually hold. Point’s own are a fair example, and easy to check because they are published: the standard service is “not designed, priced, or offered as a regulated-data service” unless Point expressly accepts a separate supplement, and the list of what you must not process without one names tax-return information directly. The terms then say the commitment is never implied, that “no sales material, security questionnaire, privacy policy statement, support response, or product feature” creates it, and that it has to be a separate written document identifying the covered service, data category and effective date (terms, §1.5 and §5.1).
That is not a Point peculiarity, and it is not a warning about Point. It is how every vendor in the category handles data somebody else’s statute governs, and it should look familiar, because it is the same instinct as the separate consent sheet. Neither the taxpayer nor the supplier is willing to be bound by something buried in a general document. Both of them want the commitment on paper that is about nothing else.
Which fixes the order of work, and it is the reverse of how most firms do it. The vendor supplement first, because until it exists you do not know what you are allowed to say. The client consent second, on its own sheet where it belongs. The engagement letter last, describing an arrangement that already exists rather than promising one you intend to arrange. A letter written first is a letter written about a hope.
When the letters have already gone out
Almost nobody adopts this software in January. You will connect something in August, having sent every engagement letter for the year in the spring, and the question is what to do about the ones already signed.
Start with the constraint that cannot be negotiated: consent runs forwards only. The regulation says a taxpayer “must provide written consent before a tax return preparer discloses or uses” the information, so a form signed in October covers October onwards and does nothing for August. There is no retrospective version of this document, and a firm that collects one in the following spring has collected an answer to a different question.
That leaves three honest paths, and which one you take is a judgment for your adviser rather than a preference. The tool waits until the next engagement cycle for the clients it would touch. Or the consent goes out now as its own document, separately from anything else you send. Or you establish, before you connect rather than after, that the disclosure sits inside one of the permitted categories and needs no consent at all.
What is not one of the three is the email everybody sends. A note to the client list explaining that the firm now uses AI, with a line inviting anyone uncomfortable to say so, is notice. Notice is worth giving and can be given at any time, and it is genuinely useful, because it is the version of this conversation you get to have calmly. It is not consent, and it does not amend a letter the two of you have both signed. Keeping those two apart in your own head is most of the work here.
Then use the cycle you already have. The engagement letter is the one recurring appointment you keep with every client, so the version to draft is the one you can leave untouched for three renewals while the software changes twice underneath it.
Where does Point fit?
Point is an AI email client, so a practice connecting it is doing the thing this page is about, and the documents behave exactly as described above.
- If your mailbox carries return information, the supplement is the first conversation rather than the last. Point’s standard terms exclude that data unless a separate written document says otherwise, and the terms are explicit that no security page, questionnaire answer or product description substitutes for it. Ask before you connect, not after your staff have grown fond of it.
- A promise that the work is reviewed is a promise about a setting. Point’s autonomy runs by type of action rather than across the board, and review is where it ships: a reply is prepared and waits for you. Push one type to the top and Point completes that work without coming back, so the review sentence in your letter is a claim about how you have it configured, and worth checking against the configuration once a year when the letter goes out.
- You should be able to produce the list of who else touches the file, without putting it in the letter. Subprocessors names the companies rather than describing them, which is the right shape for something a client may ask about and no client wants pre-emptively.
- What Point will and will not do with your content is settled in the terms rather than on a page of reassurance, including the position on training, which is the specific promise a client-facing sentence tends to lean on.
Everything Point does is the full inventory, and Point for accountants reads the same ground in a practice’s language. The unhurried version of the whole idea is Point itself.
Common questions
Can I just add a sentence about AI to our standard engagement letter?
Yes, and you should, as long as you are clear about which of two jobs the sentence is doing. A sentence describing how your firm works belongs in the letter and is useful there. A sentence obtaining the client’s permission is a consent, and for a 1040 client the regulation requires that to sit on a page carrying nothing else, so a paragraph in the letter is not a weaker version of one. It is not one.
Does the client have to agree, or is telling them enough?
They are separate acts with separate homes, which is the distinction this whole page turns on. Telling clients is notice: give it whenever you like, in the letter or in a covering note, and it makes the conversation easier. Consent is a signature on a document the client was free not to sign, and anything you make a condition of being taken on has, by the regulation’s own words, stopped being voluntary unless it falls in the narrow exception for disclosures to another preparer.
We connected a tool in June. What about the letters already signed?
The letters are not the urgent part. Consent only runs forwards, so nothing collected now reaches back to June, and the question is what covered the period rather than how to paper it afterwards. Take the three paths in the section above to your adviser, and if the answer is that a consent was needed, deal with it as a consent now on its own sheet rather than folding it into next spring’s letter.
Should the letter name the software we use?
No, and the four lines above are written to avoid it. Naming a product ties a signed contract to a purchasing decision you will revisit, so every change of tool becomes a change of terms and a conversation with every client. Describe what the software does for the work instead, which stays true across suppliers, and keep the actual list of who processes the mail somewhere you can produce it when asked.
Is a clause limiting our liability for AI errors worth adding?
Think about what it says out loud. The most valuable sentence you can give a client is that a person checks the work before it leaves, and a carve-out for the software’s mistakes sits in the same document telling them that sometimes one does not. If the review is real, the clause is unnecessary. If it is not real, the clause is the smaller of your two problems.
The short version
- The letter is a contract, so treat every sentence in it as a term you can be held to. The AI policy you feel like writing is a different document with a different reader.
- Consent for a client not filing a 1040 may live in the engagement letter, and the regulation says so in those words. Consent for a 1040 client may not, because all the text on that sheet must be about the consent and nothing else.
- The reason underneath is that consent must be voluntary, and a condition of engagement is not a choice. There is a real exception for disclosures to another preparer, and it does not change the format.
- Four lines carry the load: how the work is done, who is responsible, what the client sends and how, and what you charge. None of them names a product, which is what lets the letter outlast the software.
- Consent runs forwards only, and your vendor’s commitment on regulated data has to be its own document too. So the order is supplement, then consent, then letter.
The wider question of whether to connect at all, and what to put to a vendor in writing first, is in the client data guide. What an AI email client is defines the category, and AI email for accountants covers which of the five kinds of product a practice is really choosing between.