What Publication 5708 says you must have
- The publication (Rev. 8-2024) says the law requires a WISP, and that the FTC Safeguards Rule treats tax and accounting professionals as financial institutions regardless of size.
- It lists what the FTC requires: a designated qualified individual; a risk assessment; a safeguards program that is monitored and tested; service providers chosen and contractually required to keep safeguards; and a program that is evaluated and adjusted as the firm changes.
- It also lists multi-factor authentication for anyone accessing an information system (unless the qualified individual approves an equivalent in writing), and reporting a security event affecting 500 or more people to the FTC within 30 days of discovery.
- It describes a plan scaled to the firm: a sole practitioner can use a shorter plan than a 10-partner firm.
Where an AI tool shows up in the plan
| WISP element (Pub 5708) | What the publication asks for | What to write down for an AI tool |
|---|---|---|
| Inventory hardware | Every device that touches taxpayer data, with its location and the types of information it stores or processes | The computer the AI runs on, or the cloud service it uses, and the client data it can reach |
| Authorized users | A list of employees and vendors, such as your IT professional, who may handle client PII, with access levels and dates | Who may use the AI, and who has remote access to the machine |
| Service providers | Evaluate third-party providers and require them to maintain appropriate security measures | Each AI vendor or support provider, and what your contract requires of it |
| Data disclosure | Policies for cloud hosting providers and other services connected to stored PII, including 2-factor requirements | Whether client data leaves the office, and to whom |
| Connected devices | How new devices or software are added; new software approved by the security coordinator or IT | A written approval before any AI tool is adopted |
| Training and review | Annual training and at-least-annual review of the plan | Add AI handling rules to training and to the yearly review |
What the FTC rule adds that matters for AI
- Encryption.16 CFR 314.4(c)(3) requires customer information to be encrypted in transit over external networks and at rest, or protected by compensating controls your qualified individual approves.
- Access limits and logging.314.4(c)(1) and (c)(8) call for limiting users to the information they need and monitoring and logging authorized users’ activity.
- Change management.314.4(c)(7) requires procedures for change management, which covers adding or updating an AI tool.
- Service providers.The rule’s service-provider element is why the vendor review above matters. Your obligations stay yours when a vendor is involved.
Where AdminOnsite fits
AdminOnsite runs AI on a Mac mini in your office, so for the inventory entry the device is a single machine at a known address, and client files the AI works on are not sent to an AI provider. That does not write the plan for you. Disk encryption, access controls, updates and backups still have to be set up, and AdminOnsite staff with remote access are a service provider to list. We make no compliance or certification claims; whether your plan meets the Safeguards Rule is for you and your advisors. Related: IRS §7216 and AI and AI for accounting firms.
Questions
Do tax preparers need a written information security plan?
Publication 5708 says yes: it states that the FTC Safeguards Rule requires one and that tax and accounting professionals are considered financial institutions regardless of size.
Does the IRS require a WISP for a sole preparer?
Publication 5708 says the requirement applies regardless of size, and that a sole practitioner can use a more abbreviated plan than a 10-partner firm.
Where does an AI tool go in a WISP?
In the hardware and software inventory, the authorized-user list, the service-provider review and the connected-devices policy, with written approval before it is adopted.
Does the FTC Safeguards Rule require encryption?
16 CFR 314.4(c)(3) requires encryption of customer information in transit over external networks and at rest, or alternative compensating controls approved in writing by the qualified individual.
Does AdminOnsite make my firm WISP-compliant?
No. We make no compliance claims. The box is one device to inventory; the plan and its controls remain your firm’s.
Sources, checked November 14, 2026
- IRS Publication 5708 (Rev. 8-2024): Creating a Written Information Security Plan (WISP) for your Tax & Accounting Practice
- eCFR: 16 CFR 314.4, FTC Safeguards Rule elements (current through Nov. 12, 2026)
- IRS Office of Professional Responsibility, Issue 2026-19: Introductory Guidelines for Responsible AI Use in Federal Tax Practice (June 24, 2026)