Your engagement letter has room for four short lines about AI, and all four are worth writing. It’s a contract for services, so it’s the right place to say how your firm works and who carries the work. Permission is the one thing to keep out of it. For a 1040 client, consent written into the letter is legally empty.
- The AI paragraph most firms draft first is a policy statement, and a contract is a hard home for one. Every line in a letter is a term, and a term is something a client can hold you to.
- For a client outside the 1040 series, the regulation names the engagement letter as a fine home for consent. For a 1040 client, the same regulation gives consent a sheet of paper of its own.
- The reason runs deeper than formatting. Consent has to be voluntary, and a client who must sign to be taken on has no choice.
- Write the letter so it outlives the software. You re-sign it once a year, and the vendor underneath it changes sooner than that.
What the letter is actually for
An engagement letter does a short list of jobs. It sets out the work you’re engaged to do, and the work that sits outside it. It says what each side provides, what it costs, and who’s responsible for what. It says how either of you gets out. Firms about to connect an AI tool reach for that document, because it’s the one thing every client signs every year without being chased twice. The reach is right. The wording is what needs work.
What gets written is a paragraph about artificial intelligence. The firm uses AI responsibly. Appropriate safeguards are in place. Client data is protected at all times. Read that as a client and it’s reassuring. Read it as a term of a contract and it’s a promise to an unstated standard. You drafted it, a client can enforce it, and nobody has defined it.
So the test for each sentence is narrow. Would you want to be held to this, for this year’s work, by this client, read later by somebody without goodwill? “We use AI responsibly” fails that test. “We may use AI-assisted software in performing the services, and the work remains ours and is reviewed by a person before it is issued” passes it. You can keep that promise, and you’d want to.
Your letter already has four places where this belongs. How the work gets done. Confidentiality, and who else may see the file. Who’s responsible for the result. What you charge. A sentence that fits under one of those four is engagement-letter material. Anything else is a policy for your own staff, written for a different reader and a different purpose, or it’s a consent, and the next section is about those.
The consent it cannot carry
If you prepare federal returns, §7216 governs the permission you want from a client. The regulation under it has an explicit view on where that permission sits. The view changes between two clients you might bill in the same week.
For a client filing outside the Form 1040 series, the answer is generous. Consent “may be in any format, including an engagement letter to a client, as long as the consent complies with the requirements of §301.7216-3(a)(3)(i)” (26 CFR §301.7216-3, checked August 19, 2026). Those requirements read as a checklist. Both names. What the disclosure is for. Who specifically receives it. Which information it covers. The client’s signature and the date. Your 1065 and 1120 letters can carry all of that.
For a 1040 client, the same regulation hands the format to guidance, and the guidance is Rev. Proc. 2013-14 (checked August 19, 2026). A paper consent goes on letter-size paper or larger, in at least 12-point type. Then comes the clause that settles it. All of the text on each sheet of paper must pertain solely to the disclosure or use the consent authorizes. An engagement letter is a sheet of paper covered in other text. The rule is about what else is on the page, and no drafting gets around that.
The reason behind the rule is worth having, because it explains why the answer feels so absolute. Consent under this regulation “must be knowing and voluntary”. The regulation then says what destroys the second half: “conditioning the provision of any services on the taxpayer’s furnishing consent will make the consent involuntary, and the consent will not satisfy the requirements of this section.” A clause in an engagement letter is a condition of the engagement. Sign it, or we don’t act for you. The separate sheet is what a real choice looks like on paper. Your client can decline it and stay your client.
That general bar has an exception, and it’s honest to say it’s the one most likely to be in play here. A preparer may condition its services on consent to disclose return information to another tax return preparer “for the purpose of performing services that assist in the preparation of, or provide auxiliary services in connection with the preparation of, the tax return.” Whether the tool you’re connecting sits inside that description, or inside one of the other permitted disclosures, is a real analysis. Take it to your own adviser, alongside the general duty and the questions to send a vendor. The format holds either way. Even where you can properly condition the engagement on it, a 1040 consent lives on its own sheet.
One thing here is worth naming plainly. A firm that writes the consent into a 1040 engagement letter ends up with a document that looks like consent, which is worse than collecting none at all. A file that looks answered stops anybody asking the question again.
The four lines worth writing
Here’s what the letter can carry, written to be signed rather than admired.
How the work gets done. Say that the firm uses software, including AI-assisted tools, in providing the services. Describe it by function rather than by brand. Reviewing correspondence, drafting replies, pulling figures out of the documents clients send you. Function survives a change of supplier. A product name in a signed letter turns every software decision into a contract amendment. That’s a cost you pay in year two for a sentence that impressed nobody in year one.
Who is responsible. The work stays the firm’s, formed by your professional judgment, checked by a person before it’s issued. That’s the sentence clients want, and the only one most of them remember. It costs you nothing, because it restates what you already owe them. The temptation to resist sits right beside it: a clause disclaiming liability for errors arising from AI tools. Whatever it does for you legally, it tells a client that something reaches them unchecked. That’s the opposite of the sentence above, sitting in the same paragraph.
What the client sends you, and how. Most letters skip this clause, and it’s the only one of the four that changes anybody’s behavior. If you want documents through the portal rather than pasted into email, the engagement letter turns that preference into a term. It’s also the thing to point at in March, when the same client emails a photograph of a W-2 for the fourth year running.
What you charge. If you bill by time and the software takes some of the time out, decide what that means and write it once. Usually it means nothing, because the fee is for the work and the judgment rather than the hours spent producing it. Saying so is cleaner than leaving it to be inferred. Leave the AI billing paragraph that appears in every law-firm template where you found it. It exists because attorneys bill in fractions of an hour, against a standard of reasonableness a court will review. Copy it into an accounting engagement and you import a question your client never asked.
All four stay clear of product names, models, vendors and features. That’s the point. The letter is the slowest-moving document in the relationship, and the software underneath it is the fastest-moving thing in your practice.
What you can promise is capped by what you bought
A second document has the same shape as the 1040 consent, and it sits on the other side of you. Firms tend to find it late.
Standard software terms in this category carve out the data you actually hold. Point’s own are a fair example, and they’re published, so you can check them. The standard service is “not designed, priced, or offered as a regulated-data service” unless Point expressly accepts a separate supplement. The list of data that needs one names tax-return information directly. The terms then say the commitment has to be explicit. In their words, “no sales material, security questionnaire, privacy policy statement, support response, or product feature” creates it. It takes a separate written document, identifying the covered service, the data category and the effective date (terms, §1.5 and §5.1).
That’s the shape of the category rather than a Point peculiarity. Every vendor here handles data somebody else’s statute governs the same way, and it should look familiar, because it’s the same instinct as the separate consent sheet. The taxpayer and the supplier both want the commitment on paper that’s about one thing. Something buried in a general document binds neither of them.
So the order of work is settled, and it runs backwards from how most firms do it. The vendor supplement first, because it tells you what you’re allowed to say. The client consent second, on its own sheet where it belongs. The engagement letter last, describing an arrangement that already exists. A letter written first is a letter written about a hope.
When the letters have already gone out
Almost nobody adopts this software in January. You connect something in August, and every engagement letter for the year went out in the spring. So the question is what to do about the ones already signed.
Start with the fixed constraint. Consent runs forwards only. The regulation says a taxpayer “must provide written consent before a tax return preparer discloses or uses” the information. A form signed in October covers October onwards, and leaves August as it was. This document only comes in a forward version, so a firm that collects one the following spring has collected an answer to a different question.
That leaves three honest paths, and which one you take is a judgment for your adviser. The tool waits for the next engagement cycle, for the clients it would touch. Or the consent goes out now, as its own document, separately from anything else you send. Or you establish, before you connect rather than after, that the disclosure sits inside one of the permitted categories, where no consent is required at all.
The email everybody sends sits outside those three. A note to the client list saying the firm now uses AI, with a line inviting anyone uncomfortable to say so, is notice. Notice is worth giving, you can give it any time, and it’s genuinely useful, because it’s the version of this conversation you get to have calmly. Here’s the one distinction to hold on to. Notice is not consent, and it leaves a letter you’ve both signed exactly as it was. Keeping those two apart in your own head is most of the work here.
Then use the cycle you already have. The engagement letter is the one recurring appointment you keep with every client. Draft the version you can leave alone for three renewals while the software changes twice underneath it.
Where does Point fit?
Point is an AI email client. A practice connecting it is doing the thing this page is about, and the documents behave the way this page describes.
- If your mailbox carries return information, the supplement is the first conversation rather than the last. Point’s standard terms leave that data out until a separate written document brings it in, and the terms are explicit that only that document does it, rather than a security page, a questionnaire answer or a product description. Ask before you connect, rather than after your staff have grown fond of it.
- A promise that the work is reviewed is a promise about a setting. Point’s autonomy runs by type of action rather than across the board, and review is where Point ships. A reply is prepared and waits for you. Push one type to the top of the dial and Point completes that work without coming back. So the review sentence in your letter describes how you have Point configured. Check it against the configuration once a year, when the letter goes out.
- Keep the list of who else touches the file where you can produce it, rather than in the letter. Subprocessors names the companies rather than describing them. That’s the right shape for something a client may ask about, and something no client wants pre-emptively.
- What Point does with your content is settled in the terms rather than on a page of reassurance, including the position on training, which is the specific promise a client-facing sentence tends to lean on.
Everything Point does is the full inventory. Point for accountants puts the same ground in a practice’s own language. The calm version of the whole idea is Point itself.
Common questions
Can I just add a sentence about AI to our standard engagement letter?
Yes, and you should. Be clear about which of two jobs the sentence is doing. A sentence describing how your firm works belongs in the letter and does useful work there. A sentence obtaining the client’s permission is a consent. For a 1040 client, the regulation puts that on a page carrying nothing else, so a paragraph in the letter is a different thing altogether rather than a weaker version of one.
Does the client have to agree, or is telling them enough?
They’re separate acts with separate homes, and this whole page turns on that. Telling clients is notice. Give it whenever you like, in the letter or in a covering note, and it makes the conversation easier. Consent is a signature on a document the client was free to decline. Make it a condition of being taken on and, in the regulation’s own words, it stops being voluntary. The narrow exception for disclosures to another preparer is the one place that holds.
We connected a tool in June. What about the letters already signed?
The letters are the calm part. Consent runs forwards, so a form signed now starts now, and June needs its own answer. The question is what covered that period, rather than how to paper it afterwards. Take the three paths in the section above to your adviser. If the answer is that a consent was needed, handle it now as a consent on its own sheet, rather than folding it into next spring’s letter.
Should the letter name the software we use?
No. Describe what the software does for the work instead, which is how the four lines above are written. Naming a product ties a signed contract to a purchasing decision you’ll revisit, so every change of tool becomes a change of terms and a conversation with every client. A description by function stays true across suppliers. Keep the actual list of who processes the mail somewhere you can produce it when asked.
Is a clause limiting our liability for AI errors worth adding?
Read it out loud and hear what it says. The most valuable sentence you can give a client is that a person checks the work before it leaves. A carve-out for the software’s mistakes sits in the same document, telling them that sometimes one doesn’t. If the review is real, the clause adds nothing. If the review needs work, the clause is the smaller of your two problems.
The short version
- The letter is a contract, so treat every sentence in it as a term you can be held to. The AI policy you feel like writing is a different document, with a different reader.
- Consent for a client outside the 1040 series can live in the engagement letter, and the regulation says so in those words. A 1040 consent gets a sheet of its own, because all the text on that sheet has to be about the consent.
- The reason underneath is that consent must be voluntary, and a condition of engagement leaves the client no choice. A real exception covers disclosures to another preparer, and the format stays the same.
- Four lines carry the load. How the work is done. Who’s responsible. What the client sends, and how. What you charge. All four stay clear of product names, which is what lets the letter outlast the software.
- Consent runs forwards only, and your vendor’s commitment on regulated data is its own document too. So the order runs supplement, then consent, then letter.
The wider question of whether to connect at all, and what to put to a vendor in writing first, is in the client data guide. What an AI email client is defines the category. AI email for accountants covers which of the five kinds of product a practice is really choosing between.