Short answer
Yes, a tax or accounting firm can use an AI receptionist, as long as it is set up inside the rules that already govern the firm. In the US, Section 7216 sets consent rules for the use and disclosure of tax return information by preparers, and under the FTC Safeguards Rule tax and accounting firms must keep a written information security plan and oversee their service providers. In Canada, PIPEDA or Quebec’s private-sector act applies, with a privacy impact assessment required in Quebec before a new system goes live. In practice, the safe split is simple: let the AI handle intake, scheduling, document checklists and follow-ups, and keep every tax question, every use of return data for marketing, and every judgment call with a person. Below: the rules, a checklist for any vendor, and prices.
The short answer: what to automate and what to keep human
| Task | AI receptionist | Keep with a person |
|---|---|---|
| Answering calls and texts after hours | Yes | Escalations |
| New client intake and booking | Yes, from your rules | Engagement acceptance and conflicts |
| Document checklists and follow-ups | Yes, for engagements in progress | Deciding a document is not needed |
| Deadline reminders | Yes, dates the firm has verified | Extensions and special situations |
| Questions on deductions, credits, structure | No: pass to the accountant | Always |
| Marketing other services from return data | No | Only with the consent the rules require |
ZeniTech checklist. We do not publish time-saved or response-rate figures: we found no official source and have no measured client result.
Section 7216: return information is not marketing data
The IRS maintains a Section 7216 information center for tax professionals. Its regulations set the rules and consent requirements for the disclosure or use of tax return information by tax return preparers, and the IRS guidance on that page addresses preparers’ liability for criminal and civil penalties under Internal Revenue Code sections 7216 and 6713.
One point matters directly for automation: the IRS states that the client lists preparers may compile under section 301.7216-2(n) may not be used to solicit non-tax-return-preparation services. If an AI tool reads return data, it must not be what decides who receives an offer for bookkeeping, planning or any other service. Build marketing lists from sources and consents that the rules allow, and have your consent forms reviewed.
IRS, Section 7216 information center (page last reviewed or updated September 7, 2026). General information, not legal or tax advice.
The FTC Safeguards Rule and your WISP
The FTC lists tax preparation firms among the financial institutions covered by the Safeguards Rule. IRS Publication 5708 states that under the Gramm-Leach-Bliley Act and the Safeguards Rule, tax and accounting professionals are considered financial institutions regardless of size, and that implementing and maintaining a written information security plan (WISP) is a requirement.
Adding an AI receptionist is a change to that plan. The FTC’s summary of the rule lists what to look at:
- A Qualified Individual who implements and supervises the program; if a service provider fills that role, a senior employee still supervises it.
- Encryption of customer information on your systems and in transit, or effective alternative controls approved by the Qualified Individual.
- Multi-factor authentication for anyone accessing customer information.
- Monitoring of service providers: contracts that spell out security expectations, ways to monitor the work, periodic reassessment.
- Notification to the FTC as soon as possible, and no later than 30 days after discovery, of a security breach involving the unauthorized acquisition of at least 500 consumers’ unencrypted information.
FTC, “FTC Safeguards Rule: What Your Business Needs to Know”; IRS Publication 5708 (Rev. 8-2024). General information, not legal advice.
In Canada: PIPEDA, Quebec and anti-spam rules
- PIPEDA applies to private-sector organizations that collect, use or disclose personal information in the course of commercial activity; Alberta, British Columbia and Quebec have their own substantially similar private-sector laws.
- Quebec: a privacy impact assessment is required for any project to acquire or develop an information system involving personal information (s. 3.3 of the private-sector act) and before personal information is communicated outside Quebec (s. 17). Collect only what is necessary (s. 5).
- Texts and emails: under Canada’s Anti-Spam Legislation, a message that facilitates or completes a transaction the client already agreed to, such as asking for the documents of an engagement in progress, needs no prior consent (s. 6(6)(b)). Promotions need express consent, or implied consent when the client bought from you in the previous two years (s. 10(9)(a) and 10(10)(a)), and every commercial message identifies the firm and offers an unsubscribe mechanism (s. 6(2)).
- Deadlines: for 2025 returns, the CRA set April 30, 2026 as the filing and payment deadline for most individuals, and June 15, 2026 as the filing deadline for self-employed individuals and their spouses or common-law partners, with payment still due April 30. An AI should only repeat dates your firm has verified for the current year.
OPC, “PIPEDA in brief”; LégisQuébec, CQLR c. P-39.1 (French version), current to August 12, 2026; Justice Canada, CASL, current to September 21, 2026; CRA, Important dates for individuals (modified September 17, 2026).
Calls, texts and telling clients it is an AI
In the US, automated calls and texts are governed by the Telephone Consumer Protection Act and state laws. The FCC ruled on February 8, 2024 that AI-generated voices are “artificial” under the TCPA, and telemarketing robocalls require prior express written consent. Collect each client’s consent to receive texts at intake and keep proof of it.
Say it is an assistant. California requires a clear disclosure when a bot communicates with a person online to incentivize a sale (Business and Professions Code s. 17941), and clients of a firm expect to know who they are talking to. ZeniTech agents introduce themselves as an assistant.
Questions to ask any AI vendor before tax season
- Where is client data processed and stored, and which subprocessors touch it? Get it in writing.
- Is client data used to train any model? Get the answer in writing.
- How is access limited so each client sees only their own file?
- What is logged, who can review conversations, and how long is data kept?
- How will you notify us of a breach, and how fast?
- Can the agent be stopped from answering tax questions, and how is the handoff to an accountant worded?
- What does it cost per month, and what happens with exceptional volumes in April?
Where Leo fits
Leo is ZeniTech’s AI agent for accounting and tax firms. According to its page, it tracks each client’s document checklist, says what is missing and follows up until the file is complete; clients can reply with a photo or a PDF. It sends filing, sales tax and instalment reminders, welcomes and qualifies new individual and business clients, answers questions about your services and fees from your fee schedule, and books meetings in the right accountant’s calendar, by phone, text, email and on your website.
Its guardrails are written down: it never gives tax advice and your accountant validates; it applies your confidentiality rules; each client sees only their own file; it answers from your documents and rules; every conversation can be reviewed. Access to your tools and client documents is monitored around the clock, and your data is not used to train a third party’s model. ZeniTech does not claim a compliance certification.
| Item | Detail | Notes |
|---|---|---|
| Timeline | 1–2 weeks; 3–4 weeks with CRM, calendar and follow-ups | Delivered remotely, in English or French |
Features from zenitech.dev/en/ai-agents/accounting-firms, checked October 2, 2026. Prices are published on zenitech.dev/en/pricing.
Frequently asked questions
Can a tax preparer use an AI receptionist?
Yes, inside the rules that already apply to the firm. Keep the AI on intake, scheduling, document checklists and reminders; keep tax questions and any use of return data for marketing with a person; add the tool and the vendor to your written information security plan; and check your Section 7216 consent forms with your advisor.
What is Section 7216?
It is the Internal Revenue Code provision, with its regulations, that governs the disclosure and use of tax return information by tax return preparers. The IRS information center describes the consent requirements and addresses criminal and civil penalties under sections 7216 and 6713.
Does the FTC Safeguards Rule apply to small accounting firms?
Yes. IRS Publication 5708 states that under the GLBA and the Safeguards Rule, tax and accounting professionals are considered financial institutions regardless of size, and must implement and maintain a written information security plan.
Can we use client return data to market other services?
Be careful. The IRS states that the client lists preparers may keep under section 301.7216-2(n) may not be used to solicit non-tax-return-preparation services. Do not let any tool, AI or not, pick recipients for other offers from return data without the consent the rules require.
What do we have to report if there is a breach?
Under the Safeguards Rule, financial institutions must notify the FTC as soon as possible, and no later than 30 days after discovery, of a breach involving the unauthorized acquisition of at least 500 consumers’ unencrypted information. State laws may add their own notices; check with counsel.
What rules apply to a Canadian accounting firm?
PIPEDA, or the substantially similar private-sector laws of Alberta, British Columbia and Quebec. In Quebec, a privacy impact assessment is required before acquiring or developing an information system involving personal information and before communicating it outside Quebec. Texts and emails fall under CASL.
Should the AI tell clients it is not a person?
Yes. California requires disclosure when a bot communicates online to incentivize a sale, and clients of a firm expect to know who they are talking to. ZeniTech’s agents introduce themselves as an assistant and hand off to a person when needed.
How much does an AI agent for an accounting firm cost?
With ZeniTech, Leo is billed as a one-time setup, then a monthly plan with reasonable usage included; the full price list is on zenitech.dev/en/pricing. It goes live in 1 to 2 weeks, or 3 to 4 weeks when connected to your CRM, calendar and follow-ups.
Related
Free consultation
Get a fixed price for your project in 30 minutes.
We look at what the project has to achieve, tell you what it costs, and tell you when you do not need it.
Book a call →+1 581-748-7017Sources
- IRS: Section 7216 information center (last reviewed September 7, 2026)
- IRS Publication 5708: Creating a Written Information Security Plan for your Tax & Accounting Practice (Rev. 8-2024)
- FTC: Safeguards Rule, what your business needs to know
- Office of the Privacy Commissioner of Canada: PIPEDA in brief
- LégisQuébec: Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1), s. 3.3, 5 and 17 (French version)
- Justice Canada: Canada’s Anti-Spam Legislation (S.C. 2010, c. 23), s. 6 and 10
- CRA: Important dates for individuals (modified September 17, 2026)
- FCC: AI-generated voices in robocalls (February 8, 2024)
- California Business and Professions Code s. 17941
- ZeniTech: Leo, AI agent for accounting and tax firms
- ZeniTech: pricing (CAD)