The problem
The FTC Safeguards Rule requires a written information security plan, and the IRS expects every tax practice to have one, yet many small firms still haven't written theirs because it takes a partner a full day. At an assumed $90£68€81A$130C$127 for a partner hour, 8 hours is $720£541€644A$1,039C$1,018 of time that keeps getting pushed back.
What the AI does
IRS Publication 5708 gives a sample plan for small tax practices. The partner writes plain notes on how the firm actually works: who the staff are, which systems hold client data, how files arrive, how laptops are locked and backed up, which vendors hold data, and who is the named coordinator. ChatGPT, Claude or Gemini then turns those notes into a draft that follows the sections of Publication 5708, and lists the gaps it can see, such as no written incident response steps. No client data goes into the assistant. The partner checks every statement against what the firm really does, fills the gaps and signs off.
A worked example
An illustrative example built from typical figures, not a named business.
A four-person CPA firm in Kansas City has used the same software for years but has never written a security plan. The managing partner spends 90 minutes writing notes on systems, staff and vendors, pastes them into an AI assistant with the Publication 5708 section headings, and edits the result.
Before
About 8 hours to write the plan from a blank page, so it never gets done
After
About 90 minutes of notes and 2.5 hours of checking and editing: 4 hours
What it's worth
A compliance document rather than a monthly saving, so no monthly value is set. It's a one-off saving of about 4 hours of partner time (8 less 4), worth about $360£271€322A$520C$509 at an assumed $90£68€81A$130C$127 an hour, plus an hour or two at each annual review. The free plans of ChatGPT, Claude or Gemini can do this; paid plans are about $20£15€18A$29C$28 a month for one person.
How to set it up
- Download IRS Publication 5708 and use its sections as the headings for your draft.
- Write your notes in plain words: staff and roles, systems, how client files arrive and leave, devices, backups, vendors, and the named security coordinator.
- Paste the notes and headings into ChatGPT, Claude or Gemini and ask for a draft plan plus a list of gaps; leave out client names and any client data.
- Check every sentence against what the firm actually does, and fix anything the draft assumed, such as encryption you don't have.
- Have the partner sign the plan, train staff on it and schedule an annual review in the firm's own calendar.
What goes wrong
- An AI draft can describe controls the firm doesn't have. A plan that promises what you don't do is worse than a short honest one.
- The plan is only part of the Safeguards Rule. Multi-factor sign-in, encryption and vendor oversight still have to be put in place, not just written down.
- Don't paste client data, passwords or network details into a free or personal AI plan. Describe systems in general terms.
- Circular 230 and your state board still apply to how client data is handled. The partner, not the assistant, is responsible for the final plan.