Where should a CPA firm start with AI?

A CPA firm should start with AI at the foundations, before anyone buys a tool. That means checking your tech stack, data and data security are ready for AI, mapping every task every person does, costing every solution and checking it against every rule you answer to, then putting them in order on a roadmap. Only then do you implement, one solution at a time, starting with the ones worth the most.

Why doesn't buying an AI tool tell you where to start?

Most firms start with a tool. Someone buys Copilot licenses or signs everyone up for ChatGPT, and the brief is "we want to put AI in." And it's like, what does that mean? Nobody has said which work it's for or which client data it may see, so a few months later nobody can say what it did for the firm.

Financial Cents surveyed 486 accounting and bookkeeping professionals in July and August 2026. Of those not yet using AI, 17% said the biggest thing in their way was not knowing where to start, and only about 20% of the firms already using it could clearly show measurable value (Financial Cents). It's a software vendor's survey, but it matches what we see in firms.

Your firm has almost certainly started already, whether anyone planned it or not. The IRS Office of Professional Responsibility said in June 2026 that "virtually all professional tax firms use some form of AI, whether they are aware of it or not" (IRS OPR), and Karbon found that 98% of firms use AI while only 21% have an AI policy or strategy (Karbon). So starting with AI means putting a proper process around what your team already does, and because each part depends on the one before it, we go through it in order.

If you'd like to see where your own firm stands before reading on, the quiz below works it out in ten questions.

How do you know if your firm is ready for AI?

So the first thing we check is whether the firm is compatible with AI, layer by layer, from the business as a whole down to each department, its data and tools, and the people in it. A firm can be ready at one layer and nowhere near it at another.

We always tell firms the foundations have to be solid before anyone thinks about AI, because otherwise it's just like, yes, AI is working for you, but it could be working on wrong information. About seven times out of ten we end up going back to a firm's tech stack and data first, because it wasn't prepared for AI.

Data security can't wait for the rest. The OPR guidance says client data should only go into secure, enterprise-approved AI, and the IRS says that under the Safeguards Rule, tax and accounting professionals count as financial institutions whatever their size and need a written information security plan (IRS Publication 5708). The fix we make most often is moving client work off free and personal accounts, because you won't believe how many people put client data into them, and it's just a nightmare. We make sure the foundations are solid first, with your tech stack, data quality and data security checked before any AI goes in.

If your team is already putting client returns into ChatGPT or Claude, we've set out when Section 7216 needs the client's signed consent and what that consent has to say.

Why map every task before choosing any solution?

Once we know the foundations, we map the work. We use intakes to collect everything we need from each person, which covers every task they do on a repeat basis, the hours it takes, their hourly rate, the data and tools it touches and how AI is already used on it. The map also covers what AI now lets the firm do for clients that it couldn't do before, like a plain note each month to every bookkeeping client on what changed in their numbers.

It has to be every task, because the roadmap comes from comparing them. If only the tax team gets mapped, nobody sees that the biggest block of hours sits in client accounting.

How do you cost a solution and check it against the rules?

Every solution is fully costed, so before you spend anything you can see the hours it frees up, what it costs to implement and the return in the first year, and the numbers come from the hours your own people gave us instead of a figure from God knows where.

This is an example, and it isn't a client result. Picture a tax senior who bills $175 an hour and spends 5 hours every week chasing clients for missing documents. Over 48 working weeks that's 240 hours, and we count 0.7 to 0.85 of it, because that still leaves time for that person to review and edit what the AI does, which comes to 168 to 204 hours of capacity unlocked, or $29,400 to $35,700 a year of billable time. The process runs that same sum for every task of every person in the firm, and that's what lets the roadmap compare them.

Those hours count most against the budgets your fees come from. Every job is priced on the hours it should take, and when one runs over, that chargeable time is written off, which is what drags down your realization rate (in the UK it's called the recovery rate). A solution that finishes jobs on budget or quicker means the firm bills every hour it works instead of writing time off, so revenue and gross profit both go up, and the hours it gives back let the same staff take on more work.

Each solution is then checked for compliance, governance and data security against every body the firm answers to. The OPR guidance says due diligence under Circular 230 section 10.22 means verifying the facts, citations and calculations AI produces, and that preparer penalties under sections 6713 and 7216 apply to unauthorized use or disclosure of tax return information (IRS OPR). The Safeguards Rule also expects you to choose service providers that can keep client data safe and oversee how they handle it (IRS Publication 5708), so Claude, ChatGPT and Copilot get vetted like any vendor holding client data.

That check also decides where each solution runs, so work touching full returns or Social Security numbers stays on a machine in your office or in your own cloud account, and work that isn't sensitive can just run on Claude or ChatGPT's own server. The OPR guidance also warns that billing for time that wasn't spent may break the section 10.27 rule on fees, depending on the facts, so on tax work the return comes from the same people taking on more clients.

For a rough sense of where your own firm would come out on top once that math is done, the quiz below gives it to you in ten questions.

When the costing is done against each job's budget, it also shows where AI can improve your firm's realization rate, because every overrun it stops is chargeable time the firm no longer writes off.

How do you decide which solution goes first?

You get a clear roadmap of which solutions to implement, in what order and how, starting with the ones worth the most to your firm. The costing sets most of that order, but a solution can't go first if its data isn't ready, and the order also depends on what the freed hours will turn into. If we unlock capacity and it means nothing for the business, there's no point unlocking it.

The AICPA's 2026 Top Issues Survey of 629 practitioners put managing change due to technology and AI first for the next five years at every firm size, and firms with 11 to 30 professionals ranked hiring experienced staff as their top issue right now (AICPA). If you can't hire fast enough, the solutions that free up your most stretched people belong near the top.

The whole roadmap sits under the firm's own AI policy. The IRS expects a firm's procedures to cover staff training, secure data handling, accuracy monitoring and vetting of outside AI tools, with "all steps and processes documented" (IRS OPR).

How do you see where AI is working across the firm?

Before the first solution goes in, the process sets up an operating model that shows where AI is working, for whom, and the hours of capacity each team has unlocked against what the costing said. We've always said there needs to be an ownership of each solution and its outputs, because you need to have accountability, so every solution has a named owner who still checks the output the way they check it today. The OPR guidance tells practitioners to "treat the written text that AI generates as drafts," and the owner makes sure that happens.

Once solutions are live, we've set out how to measure the time AI actually saves your firm, with the owner's review time counted in.

What does implementing one solution at a time look like?

Only now does anything get implemented, one solution at a time, in the order the roadmap sets. Each one comes with an enablement pack for every person who uses it, and the team hears the message before it arrives: "This is coming to support you and make you more efficient and allow us to take on more work."

The way that we work is the company owns the intelligence, and any agent could then plug in and read that particular file of how to do a task, so that you're not tied to Claude, or you're not tied to ChatGPT or Copilot. We test across the five big large language models, and whenever a model update makes a solution's output slip, or one of the rules changes, we update every solution it affects.

How much work is it to do this properly?

It's a lot, and we'd rather say so. Someone has to talk to every person in the firm about every task they do, the hours, their rate and how they use AI on it. Each department's data and tools need going through and fixing wherever they aren't clean, complete, and queryable, and the policy has to cover every rule the firm answers to, from Circular 230 and section 7216 to the Safeguards Rule, your state board and any state AI law that reaches you.

Then every solution has to be costed, checked and ranked against all the others, and the operating model set up before the first one goes in. Each implementation needs its enablement pack, its testing and its owner, and every solution needs keeping up to date for as long as the firm runs it.

Firms stall here because the partners who would run it are the ones billing the most hours. When we do it, each person gives us a short intake on their work and we do the rest.

If you want us to do it for you, book a free call and we'll find you at least $50,000 a year in new business that AI can unlock. It's compliant, data-secure and has governance built in.

If you're weighing whether to do all of that in-house or bring someone in, we've set out what an AI consultant should do for a CPA firm and what one costs.

What can your firm do on Monday?

• Ask every person which AI tools they use on client work, including free and personal logins, and move client data off any account the firm doesn't control.
• Check that your written information security plan is current and covers the AI tools your people use.
• Ask each department head where their team's client data sits.
• Ask the partners what freed-up hours should turn into, whether that's more clients, more advisory work or fewer late nights in March.

If you'd like a picture of your own firm to take into that Monday conversation, the quiz below gives you one in ten questions.

Common questions

Can we run a small pilot first?

We'd advise against it. A pilot run before the work is mapped tends to land on whatever someone was keen on, so even if it goes well you won't know whether it was the solution worth the most. Once the process is done, the first solution on the roadmap is your first implementation, and it goes in costed, checked and with an owner.

Should we wait until AI settles down?

Waiting usually means your team keeps using AI with no policy around it, since the IRS says virtually all tax firms already do. The models will keep changing, which is why keeping every solution up to date is part of the process.

Who in the firm should own this?

A partner with real authority should own it, because the OPR guidance reads Circular 230 section 10.36 as putting the duty to have adequate procedures on whoever has principal authority for the firm's tax practice. Under that partner, each solution has its own named owner.

This is general information and isn't legal or tax advice, so check with your own attorney before you change your policies or how you handle client data.

Work with us to get a costed AI roadmap for your firm

At Golden Sky AI, we help companies in regulated industries implement AI that frees up their team's capacity, so they can take on more business without having to hire. Every solution is checked for compliance, governance and data security before we implement it, and you own the intelligence, meaning any AI agent could plug into the solutions we implement, as they're robust and still deliver the same quality of work. That means you're never held hostage by one AI provider.

We'll find you $50,000 a year in new business AI can unlock in 72 hours, or you don't pay.

Sources

• IRS OPR, Issue 2026-19, guidelines for responsible AI use in federal tax practice (June 24, 2026)
• IRS Publication 5708, Creating a Written Information Security Plan (Rev. 8-2024)
• FTC, Safeguards Rule: What Your Business Needs to Know
• 16 CFR 314.4, Safeguards Rule elements (Cornell LII)
• AICPA, 2026 Top Issues Survey release (June 23, 2026)
• Journal of Accountancy, AICPA Top Issues Survey (June 23, 2026)
• Karbon, State of AI in Accounting 2026 (Jan. 20, 2026)
• Financial Cents, State of AI in Accounting and Bookkeeping 2026 (Sept. 10, 2026)