TPB(GS) 55/2026: the TPB’s AI guidance, explained.

In short: on 22 July 2026 the Tax Practitioners Board issued TPB(GS) 55/2026, The use of Artificial Intelligence and the Code of Professional Conduct. It creates no new obligations. It explains how the existing Code applies when a registered tax or BAS agent uses AI: the practitioner stays accountable for accuracy, AI output must be verified and the verification documented, and client information may be entered into an AI tool only with the client’s permission, because an AI provider is a third party.

The guidance statement began as an exposure draft on 24 March 2026, took submissions until 21 April, and was finalised on 22 July. It is short, eleven pages, and it is written for practitioners rather than technologists. This page sets out what it says, paragraph by paragraph where that helps, and what a practice has to be able to show as a result.

General information only. This guide summarises published professional standards, legislation and regulator guidance and is not legal or professional advice. Read the primary sources linked throughout, and take advice on your firm’s specific position.

What the guidance is, and what it is not

The TPB says the statement is “not intended to be a comprehensive guide on the use of AI”. Its purpose is to explain how the statutory obligations in the Tax Agent Services Act 2009, the Code of Professional Conduct in section 30-10 and the Code Determination 2024, apply when AI is used in providing tax agent services. A practitioner who ignores it is risking breach of the Code the statement interprets. The Board also notes that APES 110 provides guidance on expected behaviour when using technology for practitioners who are members of CA ANZ, CPA Australia or the IPA.

The general factors (paragraph 9)

Before the Code obligations, the statement lists what a practitioner may wish to consider about any AI tool. They read like a procurement checklist, and they are close to the factors APES 110 added in its own technology revisions:

  • the nature of the activity the AI will perform;
  • how and where information is stored, and how the AI uses it;
  • the expected use of, and extent of reliance on, the output;
  • the abilities and limitations of the AI, and the purposes it is used for;
  • the processes for reviewing output before it is used in practice;
  • the appropriateness of the AI for the task, the data inputs, and the decisions practitioners make while using it.

Competency (paragraphs 12 to 18)

Paragraph 12 is the sentence the rest hangs on: “tax practitioners remain accountable for the accuracy of information and advice they provide to their clients” when using AI. The statement maps that to Code items 7 to 10 (competent service, maintaining knowledge and skills, reasonable care in ascertaining a client’s affairs, reasonable care in applying the law) and to sections 30, 35 and 40 of the Determination (records, supervision, and a system of quality management).

Three expectations follow. Practitioners must exercise their own professional judgement and should not rely on AI output as a substitute for their own analysis of the client’s circumstances (paragraph 15). Because AI models “may hallucinate or provide inaccurate information”, practitioners should verify and review AI-generated content for accuracy throughout each step of the workflow, establish processes to understand and contest AI outputs, and document each of those steps (paragraph 16). And whether reasonable care was taken will depend on the circumstances, including whether the output was checked before being relied on and whether AI was used for tasks that should have been independently verified, particularly outside the practitioner’s expertise (paragraph 17).

Confidentiality (paragraphs 19 to 27)

This is the section that decides which tools a practice can use with client information. Code item 6 prohibits disclosing information about a client’s affairs to a third party without the client’s permission, unless there is a legal duty. The statement then makes three things explicit:

A third party is any entity other than the client and the practitioner (paragraph 21)

An AI provider is a third party. So is any company whose servers process the information, wherever they are.

Permission is required before client information goes into AI tools (paragraph 23)

Practitioners “must obtain permission from each client prior to divulging client information to a third party”, which the Board says “can include entering client information into AI models and tools, depending on how these tools are configured and used”.

The client should be told what is proposed (paragraph 23)

The Board recommends informing the client of the proposed disclosure, including to whom and where the disclosure will be made, where data will be stored, and whether AI tools may be used.

How permission can be given (paragraph 24)

A signed engagement letter, signed consent, or another communication such as a fact find with consent. A general authority consenting to disclosure to third parties may also be acceptable.

Due diligence on the tools (paragraph 25)

Practitioners are responsible for reviewing commercial and internally developed AI tools to ensure information will be kept secure and the Privacy Act is met.

Tax file numbers (paragraph 26)

Where client information involves TFNs, the Privacy (Tax File Number) Rule 2015 applies in addition, including in relation to AI.

The statement points to two earlier TPB products for the detail: TPB(GS) 26/2014 on confidentiality and TPB(GS) 31/2018 on outsourcing and offshoring. The second is worth reading alongside this one, because a frontier model provider processing client information offshore is, in substance, an offshored service.

Records, supervision and quality management

Section 30 of the Determination requires records that correctly record the services provided, section 35 requires supervision of everyone providing services on the practitioner’s behalf, and section 40 requires a documented system of quality management. The statement ties AI to all three: the verification steps in paragraph 16 are to be documented, which is how AI use becomes evidence rather than a gap in the file. Our guide to the accounting firm AI policy sets out how to write that down.

Privacy Act (paragraphs 30 and 31)

The Board reminds practitioners that the Australian Privacy Principles govern use, storage and disclosure of personal information, that some of them bear directly on client consent, and that practitioners should consider whether the Privacy Act applies to them, including in relation to AI. Our Privacy Act guide and APP 8 guide cover the principles that matter most for AI tools.

What a practice has to be able to show

Which tools, for which work

A list of approved AI tools and the tasks they are used for, with the paragraph 9 factors considered for each.

Where client information goes

For each tool: where data is stored, who processes it, whether it is retained or used for training, and whether the provider is a third party under paragraph 21.

Client permission

Engagement letter wording, or another form of consent, that tells the client AI tools may be used and where data will be stored.

Verification

A documented process for checking AI output at each step before it is relied on, and the records to prove it was followed.

Supervision and quality management

AI use covered by the system of quality management and the supervision arrangements, as sections 35 and 40 require.

Where deployment posture fits

Most of the statement is about practitioner behaviour, and no tool satisfies it for you: the judgement, the verification and the records remain the practice’s. Paragraph 23 is different. It turns on whether client information is divulged to a third party, “depending on how these tools are configured and used”. An AI unit inside the practice processes client information on the practice’s own hardware, so no third party receives it and the permission question in paragraph 23 does not arise for that tool. On Ermos Edge, documents stay on the practice’s own instance in Australia and only permitted excerpts go, per question, to a named Australian provider under contract, which is the configuration the client is told about under paragraph 23. Either way, the verification and record-keeping expectations are unchanged, and every Ermos answer carries the excerpts it drew on so that the checking is quick.

Common questions

Is TPB(GS) 55/2026 binding?
It is a guidance statement, which explains how the Board will apply the law. The obligations it explains are binding: the Code of Professional Conduct in section 30-10 of the Tax Agent Services Act 2009 and the Code Determination 2024. A practitioner who departs from the guidance is exposed on the underlying obligation rather than on the guidance itself.
Can a tax agent put client information into ChatGPT or Claude?
Paragraph 23 says practitioners must obtain the client's permission before divulging client information to a third party, which can include entering it into AI models and tools depending on how they are configured and used, and paragraph 21 says a third party is any entity other than the client and the practitioner. Without the client's permission, obtained after telling them where data will be stored and that AI may be used, the answer is no. With AI that runs inside the practice, no third party receives the information.
Does the guidance say we have to verify everything AI produces?
Paragraph 16 says practitioners should verify and review AI-generated content for accuracy throughout each step of the workflow, establish processes to understand and contest AI outputs, and document those steps. Paragraph 17 adds that using AI for tasks that should be independently verified, particularly outside the practitioner's expertise, bears on whether reasonable care was taken.
What should the engagement letter say?
Paragraph 24 lists a signed engagement letter as one way of obtaining permission, and paragraph 23 recommends the client be told to whom and where disclosure will be made, where data will be stored, and whether AI tools may be used. A sentence covering those three points, which is simplest to write when processing happens inside the practice, is the practical answer.

See Dominion answering from your own documents.

A demonstration takes 30 minutes, uses no client data, and comes with no obligation.

Book a demo
Keep reading
APES 110 and AI All guides AI for accountants The Dominion AI unit