What the TPB's AI guidance asks of your practice
TPB(GS) 55/2026 requires less than its headlines suggest, and asks for one thing most firms have not noticed. What is required, what is recommended, and what to do.
The email from the Tax Practitioners Board arrived on 22 July. Subject line about artificial intelligence, a link, a PDF. It went into the folder where regulator emails go to wait for a quiet week, and there has not been a quiet week since.
In the meantime it has reached you second-hand, and the second-hand versions tend to land in one of three places: that you now need an AI consent from every client, that some tools are "TPB compliant", or that the Board has banned ChatGPT. None of those is quite what the document says.
So here is what TPB(GS) 55/2026 asks, read the way a practice principal would want it read: what you must do, what the Board would like you to do, and what it doesn't say at all.
First, what kind of document it is
It bans no tool and endorses none. It names no product. A vendor telling you their software is "approved" or "compliant" with it is claiming something the guidance does not do for anyone.
What you must do
Get the client's permission before their information goes to a third party. This is Code item 6, confidentiality, and the guidance applies it directly. Anyone who is not you or your client is a third party. Entering client information into an AI tool can be a disclosure to one, "depending on how these tools are configured and used" (paragraph 23). So you need to know whether yours is, and that is a question about its settings and its terms.
Stay responsible for the work. You remain accountable for the accuracy of what you lodge, you apply your own professional judgement, and AI output is not a substitute for your own analysis. Anyone who has signed a return already believes this. The guidance simply closes off "the software did it" as a position.
What you almost certainly don't need
Many engagement letters already carry an authority like that. If yours does, you may well have the permission you need for a tool you have chosen deliberately, without sending anybody a new form. Check the wording against your professional body's template and your PI insurer's view, but start from the letter you already have rather than from a new consent process.
What the Board recommends
The guidance recommends telling clients four things: to whom their information is disclosed, where, where it is stored, and whether AI is used. Recommended, not required. But it is the easiest part of the document to satisfy, and the hardest to satisfy honestly if you do not know the answers yourself.
That is the practical test for any tool you use on client work. If the vendor cannot tell you, in a sentence, which providers process your clients' documents and in which countries, you cannot tell your client either.
The part most firms have missed
It says you should verify and review AI-generated content for accuracy throughout each step of the workflow, have a process to understand and contest what the AI decided, and that each of those steps should be documented, to support the Code's requirements on record-keeping and on having a documented system of quality management.
Having checked the AI's work is not enough; the guidance expects the checking to be evidenced: what the tool produced, what you looked at, what you changed, and who signed it off.
This is where most current practice falls short, even where everyone is careful. The checking happens: in someone's head, in a pencilled tick on a printout, in a chat window that gets closed at the end of the day. Almost none of it leaves a record anybody could produce eighteen months later. A chat transcript shows the question and the answer; it doesn't show the review.
What it doesn't cover
Tax file numbers, except to point elsewhere. Paragraph 26 notes that where client information includes TFNs, the separate obligations under the Privacy (Tax File Number) Rule apply as well. The guidance does not restate them. It just reminds you they come along for the ride, which, given how many client documents have a TFN somewhere in them, is most of them.
Four things to do before next season
We wrote separately about the specific case of using ChatGPT on client files, which is where most firms meet these questions first.
Where we sit in this
The two parts of the guidance we could do something about, we built around. Every provider that processes a client's documents is named, with its country, in our privacy policy, so the recommended disclosure is a sentence you can copy. And the record paragraph 16 asks for is kept as the work happens rather than assembled afterwards: every point the AI raised, what you did with each one, who changed what and when, and every version of the workpaper.
The permission is still yours to get, and the review is still yours to do. The guidance is right about both.