AI in the tax firm: what is allowed — and why the client file is more sensitive than it looks

Tax advisers handle other people's secrets for a living — and depending on the country, professional confidentiality is backed by criminal law, professional regulation or contract. A client file also rarely stays at plain financial data: medical expenses reveal health, union dues reveal membership. An assessment notice pasted into a general-purpose AI tool for summarising is therefore not a convenience question but a confidentiality question.

By Patrick de Kathen, Founder of KlarComply · Reviewed on 28 August 2026

What actually applies in a firm

For small and medium-sized enterprises, the lower of the two AI Act values applies (Art. 99(6)). Under the GDPR, the higher one does.

The client file is more sensitive than it looks

Financial data as such is "ordinary" personal data under the GDPR. A real client file rarely stops there. Three examples from everyday practice:

• Medical expenses claimed as deductions tell a health story — health data under Article 9(1) GDPR.
• Union dues among the deductions reveal trade-union membership — likewise Article 9.
• In some member states, payroll and tax records even encode religious affiliation — in Germany, the church-tax attribute does exactly that.

Feeding a complete tax return or assessment into an AI tool therefore almost always processes special categories too, with the stricter standard that attaches to them. "It's only numbers" does not hold.

Professional confidentiality: the rule that outranks convenience

Across Europe, tax advisers and auditors are generally bound by professional confidentiality — under criminal law, professional regulation, contract, or a combination — with the exact scope set by national law. The operative point for AI is the same everywhere:

If your firm is in Germany: tax advisers and auditors are named expressly in § 203(1) of the Criminal Code — up to one year's imprisonment for unauthorised disclosure — flanked by the professional duty of confidentiality in § 57 of the Tax Advisory Act for tax advisers and in § 43 of the Public Accountants Act for auditors. The lawful route exists twice over: § 203(3)–(4) of the Criminal Code and § 62a of the Tax Advisory Act both allow involving service providers where the provider is contractually bound to confidentiality; a data processing agreement alone is not enough, because it covers data protection, not criminal and professional law. Outside Germany, check your national rules — the safe baseline is the same everywhere: client data goes into no tool whose provider is not contractually bound.

Practice-software AI and the two contracts

The AI features of established practice software are the most convenient route — if the paperwork is right. Two documents belong in your records before the feature goes live:

• the data processing agreement under Article 28 GDPR, with server location and the question whether inputs are used for training, and
• the confidentiality undertaking your national law requires for service providers. Established professional-market vendors have it ready; a general-purpose AI provider rarely can. A provider unwilling to sign is telling you something.

Booking bot and firm marketing

If a bot answers on your website, people must be able to tell a machine is writing — one sentence is enough: "You are chatting with an automated assistant." Since 2 August 2026, Article 50 of the AI Act also requires labelling AI-generated or materially AI-edited images, audio and video. And professional advertising rules for regulated advisers demand factual, unexaggerated communication in most member states — an AI that drafts sweeping success claims does not fit that frame.

And the training?

Since 2 February 2025, Article 4 of the AI Act has obliged you to take measures to foster AI literacy among your staff — since the Digital Omnibus a duty of effort, not of result, and without a standalone fine (Article 99(4) lists the sanctioned duties exhaustively; Article 4 is not among them). Why the record still matters: in a firm where client data passes through many hands daily, the first question after any incident is: did your staff know what they were doing? A dated training record answers it — to the professional body, the regulator and the client.

A roadmap you can finish in an afternoon

1. Inventory: practice-software AI, dictation, text drafting, research tools, booking bot — including what staff use privately.
2. Write down the client-data rule: no client reference in general-purpose tools; keep an approved-tools list.
3. Vet providers: data processing agreement and confidentiality undertaking in writing; training use switched off.
4. Label the bot and your content: a disclosure sentence on the bot, a label on AI content.
5. Train the team and file the record — dated, per person.

Frequently asked questions