AI and client consent: what TPB(GS) 55/2026 actually requires in your engagement letter

TPB Guidance Statement TPB(GS) 55/2026, 'The use of Artificial Intelligence and the Code of Professional Conduct', was issued on 22 July 2026. It is a final instrument, not a draft.

The exposure draft was TPB(I) D62/2026, issued in March 2026 with submissions closing on 21 April 2026. The change in reference — from an Information Sheet to a Guidance Statement — reflects the TPB renaming its Practice Note series to Guidance Statements on 30 April 2026. It is a naming convention shift, not a downgrade in status. Content still citing the draft is out of date.

Paragraph 23 is the operative provision, and its wording repays close reading. Practitioners must obtain permission from each client prior to divulging client information to a third party — which, the TPB says, can include entering client information into AI models and tools, depending on how these tools are configured and used.

When obtaining that permission, the TPB says it is recommended that the practitioner clearly inform the client about the proposed disclosure, including to whom and where the disclosure will be made, where data will be stored, and whether AI tools may be used.

So the honest answer to 'must I tell clients I used AI?' is: not as a standalone obligation. The mandatory duty is obtaining permission for third-party disclosure. Telling the client that AI is involved is recommended practice, and it is the sensible course — but conflating the two overstates the rule.

The qualifier 'depending on how these tools are configured and used' is doing a great deal of work in that paragraph, and the TPB does not resolve it.

It implies that not every use of an AI tool amounts to disclosure to a third party. A tool that processes data without retaining it, or one operating within infrastructure the firm already controls, may sit differently from pasting client details into a public chatbot. But the guidance does not draw that line, so practitioners are left to assess each tool on its configuration.

The practical response is to document the assessment: what the tool does with client data, where it is processed, whether it is retained, and on what basis you concluded that consent was or was not required.

The guidance maps AI use onto existing obligations rather than creating new ones:

Paragraph 16 addresses accuracy directly: AI models may hallucinate or provide inaccurate information and cannot be relied on as a replacement for tax knowledge, experience or expertise. The TPB says practitioners should verify and review AI-generated content for accuracy throughout each step of the workflow, and should establish processes to understand and contest AI outputs.

Paragraph 25 puts the due diligence obligation on the practitioner, and extends it to internally developed or modified tools as well as commercial ones — a point firms building their own automations often miss.

The TPB's framing throughout is that AI is a tool that may assist tax practitioners, but it does not replace professional judgement or transfer responsibility.

One significant gap is worth knowing. The final guidance contains no paragraph dealing with cross-border disclosure or overseas storage of client data.

That does not mean offshore processing is unregulated — it means the obligation sits elsewhere, in Australian Privacy Principle 8 under the Privacy Act, rather than in the TPB guidance. Any claim that the TPB regulates offshore AI processing is incorrect. Given that many widely used AI tools process data overseas, this is a question a firm should answer separately from its TPB analysis.

For a firm updating its engagement documentation:

The TPB has not restricted AI use. It has confirmed that existing obligations apply unchanged, and identified consent and verification as the two places where AI use most directly engages the Code. A firm that gets the permission right, verifies output before relying on it, and keeps evidence of both is doing what the guidance asks.

This article is general information for registered practitioners and reflects the guidance as issued. Read TPB(GS) 55/2026 itself before setting firm policy.