What the guidance is, and what it is not
The TPB released the document as an exposure draft, TPB(I) D62/2026, on 24 March 2026. The final version was published as a guidance statement, TPB(GS) 55/2026, on 22 July 2026. As at October 2026 it has not been amended since.
It creates no new law. The statement says its principles and examples "do not create additional rights or legal obligations beyond those that are contained in the TASA or which may exist at law". What it does is explain how two existing sets of obligations apply when AI is involved:
- The Code of Professional Conduct in section 30-10 of the Tax Agent Services Act 2009 (TASA).
- The Tax Agent Services (Code of Professional Conduct) Determination 2024, the instrument that added eight further obligations, including record keeping (section 30) and quality management (section 40).
Who it applies to
The statement is written for registered tax agents and BAS agents. If you are an accountant who is a registered tax agent, or a bookkeeper who is a registered BAS agent, it is about you. It also reaches the staff and contractors who work under your registration, because the Code covers services "provided on your behalf".
A bookkeeper who is not a registered BAS agent is not bound by the Code. The Privacy Act 1988 and your professional body's rules may still apply.
The Code obligations the TPB points to
| Obligation | What it says | What it means when you use AI |
|---|---|---|
| Code item 6 (confidentiality) | You must not disclose information relating to a client's affairs to a third party without the client's permission, unless you have a legal duty to do so. | Get permission before client information goes into an AI tool run by someone else. |
| Code item 7 (competence) | A tax agent or BAS service you provide, or that is provided on your behalf, must be provided competently. | You answer for the result, however it was drafted. |
| Code item 8 (knowledge and skills) | You must maintain knowledge and skills relevant to the services you provide. | Know what the tool can and cannot do before you rely on it. |
| Code items 9 and 10 (reasonable care) | Take reasonable care in ascertaining the client's state of affairs, and to ensure the taxation laws are applied correctly. | Check the output against the facts and the law. Do not let it stand in for your own analysis. |
| Determination s 30 (client records) | Keep records that correctly record the tax agent services provided to each client, retained for at least 5 years. | Your file should show what was done, what advice went each way, and what was reviewed. |
| Determination s 35 (supervision) | Ensure those providing services on your behalf have the knowledge and skills and are appropriately supervised. | Staff use of AI is your responsibility. Tell them what is allowed. |
| Determination s 40 (quality management) | Establish and maintain a system of quality management, and document and enforce its policies and procedures. | Write your AI rules down and follow them. |
See what a finished file note looks like.
Pick your line of work and we'll send a sample note written from a mocked call. No account, no card, and nothing from your own client files.
One sample note, plus the occasional CallNote update. Unsubscribe any time by replying. We never ask for your call recordings or client files.
Client permission: what the TPB says about confidentiality
This is the part most practices ask about first. The TPB's wording is direct:
In the context of AI in the provision of tax agent services, tax practitioners must obtain permission from each client prior to divulging client information to a third party (which can include entering client information into AI models and tools, depending on how these tools are configured and used).
- A third party is anyone else. For the TASA, the TPB says a third party is "any entity other than the client and the tax practitioner". A software vendor is a third party.
- The information does not have to come from the client. It only has to relate to the client's affairs. Information you gathered from the ATO or a bank about the client is covered.
- Permission can take several forms. The TPB says it "may be by way of a signed letter of engagement, signed consent, or other communication such as a relevant 'fact find' and consent", and that "a general authority consenting to disclosure to third parties may also be acceptable".
The TPB also recommends telling the client what they are agreeing to. When obtaining permission, it is "recommended that the tax practitioner clearly inform the client about the proposed disclosure (including noting to whom and where the disclosure will be made, where data will be stored and whether AI tools may be used)".
The phrase "depending on how these tools are configured and used" matters. The statement leaves you to work out whether a given tool sends client information to another entity. For most cloud tools the practical answer is yes, so the safe course is to cover AI tools in your engagement letter. The definition of AI in the statement is wide and includes "AI features which may be embedded within software or third-party platforms", so count the features inside your ledger and meeting software too.
An example client disclosure paragraph
This wording follows the four things the TPB recommends you tell the client: who receives the information, where it goes, where it is stored, and that AI tools may be used. Adapt it to the tools you really use and have it checked against your own engagement letter and privacy policy. It is an example only. The TPB has not approved any form of words.
Existing clients signed an older letter, so decide how you will get their permission: a reissued letter or a short signed consent. Then keep the permission on the file. TPB(GS) 52/2024 lists "client permissions (including consent to disclose client information)" among the records a practitioner must keep.
Competence and human review
The TPB is plain about the limits of the technology. It says AI models "may hallucinate or provide inaccurate information and as such cannot be relied on as a replacement for tax knowledge, experience or expertise". It says practitioners "must exercise their own professional judgement when advising clients and should not rely on AI output as a substitute for their own analysis of a client's circumstances".
On review, the statement asks for more than a glance at the end. Practitioners "should verify and review AI generated content for accuracy throughout each step of the workflow and should establish processes to understand and contest AI decisions/outputs".
There is no fixed test for reasonable care. The TPB says it depends on all the circumstances, including:
- the nature and scope of the tax agent services being provided
- whether the tax practitioner checks or reviews the output of the AI tool before purporting to rely on it
- whether AI tools have been used for tasks which should be independently verified, particularly when outside the tax practitioner's expertise.
Records: show the permission and show the review
After describing the review steps, the TPB adds: "Each of these steps should be documented. This will assist tax practitioners to meet their obligations under sections 30 and 40 of the Determination."
Section 30 is the record-keeping obligation. It requires records that correctly record the tax agent services provided to each client, including former clients. Under section 30(2) the records must:
- be in English, or readily accessible and easily convertible into English
- be retained for at least 5 years after the service has been provided
- show the nature, scope and outcome of the tax agent service provided
- reference information reasonably considered in the provision of the service
- include all advice received from the client
- include all advice provided to the client and, for more complex matters, the relevant facts, assumptions and reasoning underpinning the advice.
The TPB's companion statement, TPB(GS) 52/2024 Obligation to keep proper client records of tax agent services provided, says records include advice given "in writing and orally", and that a practitioner may need to make a record where none exists, "for example, a file note about advice provided verbally".
Section 40 is the quality management obligation. Your system has to be documented and enforced, and the note to the section says it includes policies on proper keeping of records and protecting confidentiality. An AI policy belongs there. We have a starting point in our AI note taking policy template.
What a file note of the permission can look like
The client and practice below are fictional.
- Why we called
Annual engagement review. Our updated engagement letter adds a section on software and artificial intelligence tools, and Priya asked what it meant before signing.
- What we explained
- We use a tool that turns the transcript of our meetings with her into a draft file note. The provider receives the transcript. No audio is kept by that tool.
- The provider stores the data in Australia and does not use it to train AI models. We confirmed this from the provider's terms on 2 September 2026.
- A registered tax agent reads every draft note against the conversation before it goes on her file.
- Client response
Priya is comfortable with this. She asked that her children's details not be discussed in recorded or transcribed meetings unless relevant to the family trust. Agreed.
- Permission
Priya gave permission by phone and will sign the updated engagement letter. Letter sent by email at 11:20 am the same day for signature.
- Next steps
- Daniel to file the signed letter when it comes back and note the date.
- Daniel to add the instruction about her children to the client record.
A plain checklist for your practice
- List every AI tool in use, including AI features inside software you already pay for and anything staff use on their own accounts.
- For each tool, find out where client information goes: who the provider is, where the data is stored, how long it is kept, and whether it is used to train models. Keep a dated note of what you found.
- Decide what may be entered. Many practices bar tax file numbers and identity documents from general AI tools altogether.
- Update your engagement letter with a disclosure that names the recipients, the storage location and the use of AI.
- Get permission from existing clients and file it. Record who agreed, when and how.
- Set the review rule: who checks AI output, at what points, and against what.
- Record the review on the file. A line such as "draft prepared with [tool], reviewed against the meeting by [name] on [date]" is enough for routine work.
- Write it into your quality management system so the policy is documented and enforced, as section 40 requires.
- Train your staff and contractors. Section 35 makes their knowledge and supervision your obligation.
- Check your retention. Records must be kept for at least 5 years after the service is provided, and must stay readily accessible if you change tools.
The Privacy Act and tax file numbers
The Code is one layer. The TPB reminds practitioners that the Privacy Act 1988 and the Australian Privacy Principles govern the use, storage and disclosure of personal information, and that practitioners are "ultimately responsible for exercising due diligence when using AI tools", including reviewing commercial and in-house tools so information is kept secure.
Tax file numbers carry extra rules. The statement notes that where client information involves TFNs, "additional obligations under the Privacy (Tax File Number) Rule 2015 will apply", and tells practitioners to seek their own advice on how that Rule applies to their use of AI.
If your practice is caught by the Tranche 2 anti-money laundering reforms, those bring their own record rules, which we cover in Tranche 2 AML records for accountants.
What the professional bodies add
The TPB points to the Accounting Professional and Ethical Standards Board (APESB). Its standards apply to members of CPA Australia, Chartered Accountants Australia and New Zealand and the Institute of Public Accountants.
On 31 October 2025 the APESB issued a Technical Alert, The ethical use of artificial intelligence by professional accountants. It notes that technology provisions in APES 110 Code of Ethics for Professional Accountants took effect on 1 January 2025. It says members "remain responsible for the analysis, the underlying professional judgements, and the outcomes" and "should disclose when AI tools are used and supervise and review their use". If you are a member, check your own body's current material as well.
Where an AI note tool fits
Writing up client meetings and calls is a common first use of AI in a practice, because the person who was in the room can check the draft in a few minutes. The Code still applies in full. The tool is a third party, so permission is needed, and the draft has to be reviewed.
CallNote is our product, so weigh this accordingly. It turns a call or meeting transcript that already exists into a structured file note. It never records calls, never joins a meeting as a bot and never stores call audio. Data is hosted in Sydney, encrypted, and not used to train AI. After review you publish the note, which seals it with a checksum and locks it, with later amendments added as dated entries and a full audit log.
The limits: CallNote has no template built for accounting practices. It works from a general template or one built from your own past note. It has no native integration with Xero Practice Manager, MYOB or Karbon. More detail is in AI meeting notes for accountants, and the wider field is compared in the best AI note takers in Australia and AI note takers that do not record.
Common questions
Can accountants use AI in Australia?
Yes. The Tax Practitioners Board's guidance statement TPB(GS) 55/2026, issued on 22 July 2026, says AI tools used appropriately offer a significant opportunity to increase productivity. Registered tax agents and BAS agents stay responsible for the services they provide. They must have client permission before disclosing client information to a third-party AI tool, must review AI output with their own professional judgement, and should document those steps.
What is TPB(GS) 55/2026?
It is the Tax Practitioners Board guidance statement titled The use of Artificial Intelligence and the Code of Professional Conduct. It was released as exposure draft TPB(I) D62/2026 on 24 March 2026 and published in final form on 22 July 2026. It explains how the Code of Professional Conduct in section 30-10 of the Tax Agent Services Act 2009 and the Tax Agent Services (Code of Professional Conduct) Determination 2024 apply when AI is used. It does not create new legal obligations.
Do tax agents need client consent to use AI tools?
Where client information is disclosed to a third party, yes. The TPB says tax practitioners must obtain permission from each client before divulging client information to a third party, which can include entering it into AI models and tools, depending on how the tools are configured and used. Permission can be given in a signed engagement letter, a signed consent or another communication, and a general authority to disclose to third parties may also be acceptable.
Does the TPB guidance apply to bookkeepers?
It applies to bookkeepers who are registered BAS agents, and to staff working under a registered agent, because the Code covers services provided on the agent's behalf. A bookkeeper who is not registered with the TPB is not bound by the Code, though the Privacy Act 1988 and any professional body rules may still apply.
What records should a tax practitioner keep about AI use?
Keep the client's permission, and keep evidence that AI output was reviewed. The TPB says the steps taken to verify and review AI-generated content should be documented, which helps meet section 30 (client records) and section 40 (quality management) of the Determination. Section 30 records must be kept for at least 5 years after the service is provided and must show the nature, scope and outcome of the service and the advice given and received.
Is an AI note taker a third party under the TPB Code?
The TPB defines a third party as any entity other than the client and the tax practitioner, so a software provider that receives client information is one. If your note taker sends a meeting transcript or recording to the vendor for processing, treat it as a disclosure that needs the client's permission under Code item 6, and tell the client who receives the information and where it is stored.