AICPA AI Tax Risk Group: What It Means for CPA Duties

The AICPA and former IRS Commissioner Danny Werfel formed the Council on AI Risk in Tax on September 22, 2026, an AICPA AI tax risk group built around a 20-risk framework.

The council, known as CART, brings together leaders from accounting, law, technology, government and academia. The AICPA announced it in Washington. Its stated aim is responsible AI use in both tax administration and tax practice.

For firms, the practical point is what CART is not. It cannot bind a practitioner, and it does not replace the conduct rules that already apply. The IRS Office of Professional Responsibility applied those rules to AI in an alert on June 24, 2026, three months before the council existed.

What the AICPA AI tax risk council will do

The announcement sets three tasks. CART will test and strengthen the AI risk framework so it stays current. It will identify further tools, guidance and resources for managing AI risk. And it will give participants a forum to share lessons and emerging practices.

Melanie Lauridsen, vice president of tax policy and advocacy at the AICPA, said in the announcement that “AI in tax is not simply an opportunity, it has become a strategic necessity.”

Werfel said: “Tax is high-stakes, and we cannot assume that emerging AI tools will police themselves.”

The council will meet four times a year, Werfel said in an interview. Smaller working groups inside it may meet more often.

Who sits on the council and who leads it

The AICPA names two participating organisations: the National Association of Enrolled Agents and the Federation of Tax Administrators. It refers to “several others” without naming them. San Jose State University has also been listed among participants.

Werfel said the aim was a cross section of the tax community, so membership is drawn from organisations rather than individuals.

The AICPA has not published a charter, a chair, a full membership roster or a voting procedure. Those gaps matter for a body that wants to be seen as a neutral reference point.

Werfel’s role is outside government. He led the IRS from March 2023 to January 2025 and is now an executive in residence at Johns Hopkins and a Polis Distinguished Fellow at Duke. He leads CART alongside the AICPA and wrote the framework it will maintain. His article carries the caveat that the views are the author’s and not necessarily the AICPA’s.

The framework at the centre of AICPA AI tax risk work

Werfel published the framework on August 31, 2026, in The Tax Adviser, the AICPA’s journal. It runs to two registers.

The register for tax authorities lists 20 risks in four categories: information integrity, fairness and legitimacy, security and data, and institutional capacity. The register for preparers lists 15 risks in five categories: technical, practice, legal and regulatory, business, and workforce and strategic. Five risks appear in both.

Risks are ranked in three tiers, and Tier 1 risks must be addressed before launch. The worked scenarios include a chatbot wrongly telling a taxpayer she qualifies for the earned income credit, a hallucinated deduction in a return, audit targeting bias and a junior associate accepting AI output without checking it.

Werfel said he wrote it because there was no systematic way to assess AI risk in tax. Anyone trying to show diligence, he said, found “nothing to tether to.”

His intended use is a defence of process. An executive asked what diligence was done before an AI rollout can point to a published framework that was reviewed by CART.

Guidance, not standards: what is promised

The framework is voluntary. Werfel compared it to the sustainability frameworks that organisations adopt because they serve a purpose, not because a regulator requires them. Lauridsen said that with AI changing monthly, issuing a standard now “would be remiss.”

Werfel said he hopes CART’s output is seen as “the right, responsible way to do things, not the required way to do things.” If Congress, the IRS or another standard-setter later wants a mandate, he said, CART could supply the community input.

The deliverables and the aspirations need separating. The only dated commitment is a second version of the framework in about six months, which points to spring 2027, followed by annual updates. The rest is a wish list.

Werfel said he would like CART to publish whitepapers, send members to conferences and build educational materials. He suggested newsletters and practice alerts on emerging AI risks might follow. Within five years he wants the framework to be the go-to reference for the tax community.

None of that has been published. Lauridsen said the tools would be practice guides on using AI “responsibly, thoughtfully, and carefully.”

The council also depends on a behavioural change that no document can deliver. Werfel said firms treat AI developments as proprietary and are reluctant to share problems with competitors. He asked firms to share instead: “Let other accounting firms drive into the same tree” is the alternative he wants to avoid.

How this fits with Circular 230 and existing AICPA work

The legal duties sit elsewhere. The IRS Office of Professional Responsibility issued Alert 2026-19 on June 24, 2026, applying Circular 230 to AI-assisted work.

On section 10.22, the alert says practitioners must check AI-generated content, including facts, citations and calculations, before giving it to clients or the IRS. They cannot rely on AI alone.

It reaches further. Section 10.35 requires practitioners to understand how AI generates content and where it fails. Section 10.36 requires firm leaders to take reasonable steps to have adequate procedures, which the alert says should cover staff training, data handling, accuracy monitoring and vetting of outside AI tools. Section 10.37 requires written advice to rest on reasonable assumptions, so AI output must be independently verified.

Section 10.27 bars unconscionable fees. The alert says billing for time not spent, or double-billing for AI-assisted work, may breach it, and that practitioners should pass efficiency gains to clients. The AICPA has asked the IRS to clarify that language, arguing it does not appear to allow value pricing and overlooks the cost and risk of implementing AI.

Werfel’s framework does not cite Circular 230 or section 10.22. A firm that follows it has not thereby met a conduct rule, though a documented risk process is the kind of evidence that supports a diligence defence.

The AICPA already publishes introductory guidelines and FAQs on responsible AI use in federal tax practice. CART is meant to add a shared risk vocabulary on top of those, not to replace them.

What AICPA AI tax risk guidance means for firms

Werfel’s two messages are simple. Deploy AI in small stages, he said, so teams can study risks and retrain staff. A 25% efficiency gain, such as a process falling from four weeks to three, is “nothing to sneeze at.”

And keep people in the process. “The biggest takeaway is slow your roll and don’t get rid of the humans,” he said, naming hallucination, scope creep and perceptions of surveillance as his worries.

Firms setting policy can use the framework as a checklist alongside their AI agent governance work and their quality management documentation. Section 10.36 expects written procedures, and a staff AI literacy and AI use pack covers the training the alert mentions. Practices weighing how far to take automation can read how tax advisers are integrating AI into client work.

The framework also covers tax authorities, though it does not describe specific IRS deployments. It treats audit selection, pattern detection and taxpayer chatbots as areas where authorities carry risk. Practitioners dealing with IRS automation can use that register to frame questions, but it is not a statement of IRS policy.

The next marker is the second version of the framework, due in about six months. Its changes, and whether CART publishes a roster and charter before then, will show how much weight the council carries.