AI and the Code of Professional Conduct: what TPB(GS) 55/2026 means for your firm

The Tax Practitioners Board published TPB(GS) 55/2026, The use of Artificial Intelligence and the Code of Professional Conduct, on 22 July 2026. It replaces the exposure draft TPB(I) D62/2026, issued 24 March 2026, which drew submissions from CA ANZ, CPA Australia and the IPA before consultation closed on 21 April 2026.

If your firm has been waiting for the regulator to say something concrete about AI before committing, the wait is over. Here is what the guidance actually says and what it means for the way your practice runs.

What changed on 22 July 2026, and what did not

Nothing in the Tax Agent Services Act 2009 changed. Nothing in the Tax Agent Services (Code of Professional Conduct) Determination 2024 changed.

What changed is that the TPB has now told you, in writing, how it reads the existing obligations in an AI context. That matters for two reasons. It removes the "the rules do not contemplate this" argument, and it gives the TPB a published position to measure your conduct against.

TPB Chair Peter de Cure AM framed the Board's position as supporting responsible adoption rather than discouraging it. The guidance is explicitly not a technical manual on AI systems, and the TPB has acknowledged it will need updating as the technology moves.

The practical read: the TPB is not telling you to avoid AI. It is telling you that if you use it, the file has to stand up the same way it always did.

Which obligations does the guidance cover?

The guidance walks through the Code obligations most likely to be engaged when AI is in a workflow. In broad terms it groups them under competence and confidentiality, then addresses the remaining responsibilities and the interaction with privacy law.

The Determination obligations at sections 30, 35 and 40 are the ones most firms underweight, because they are newer. They commenced 1 August 2024 and applied from 1 January 2025 for larger firms and 1 July 2025 for smaller ones.

Does using AI change who is responsible for the return?

No. This is the single clearest message in the guidance, and it was equally clear in the March exposure draft.

When you use AI while providing tax agent services, you remain accountable for the accuracy of the information and advice you provide to your client. The tool is not a party to the engagement. It has no obligations under the TASA. It cannot be sanctioned. You can.

Two practical consequences follow.

First, "the software produced that figure" is not a defence. The TPB's framing places responsibility on both the appropriateness of the data you put into the tool and the decisions you make while using it.

Second, you cannot rely on AI output as a substitute for your own analysis of the client's circumstances. You still have to exercise professional judgement, and the standard of reasonable care is unchanged: act as a competent and reasonable person with the knowledge, skills, qualifications and experience of a tax practitioner would act in the circumstances.

Is an AI tool a "third party" for confidentiality purposes?

Yes. This is the point that catches most firms out.

Code item 6 provides that unless you have a legal duty to do so, you must not disclose any information relating to a client's affairs to a third party without your client's permission. For TASA purposes, a third party is any entity other than the client and the tax practitioner.

A commercial AI vendor is not you and is not your client. So putting client information into that tool is a disclosure to a third party, and it needs the client's permission.

The guidance indicates permission can be obtained in the ways it always could: a signed engagement letter, a signed consent, or other appropriate communication with the client. A general authority consenting to disclosure to third parties may also be acceptable.

You are also expected to complete an appropriate review of any commercial AI tool to confirm information will be kept secure and that the requirements of the Privacy Act 1988 are met. Where client information includes tax file numbers, the Privacy (Tax File Number) Rule 2015 adds further obligations.

We cover the practical version of this question, including the difference between consumer and business tiers of the same product, in can Australian tax agents use ChatGPT with client data.

What does the guidance say about documentation?

That your steps should be documented, and that documenting them assists you in meeting your obligations under sections 30 and 40 of the Determination.

This is quiet but consequential. Section 30 requires records that correctly record the tax agent services provided. Section 40 requires a quality management system. If AI is now part of how a service gets produced, your records and your QMS have to reflect that.

In practice this means the file should show what was AI-assisted, what a human reviewed, and what was verified against source. If a TPB reviewer picked up a return prepared in your firm today, they should be able to reconstruct that from the file without asking anyone.

We set out the specific artefacts a file needs in record-keeping when AI is in the workflow.

How does this interact with the Privacy Act and APES 110?

The guidance flags two adjacent frameworks.

The Privacy Act 1988 sets out the Australian Privacy Principles governing the use, storage and disclosure of personal information. Some of these bear directly on the requirement to obtain consent from clients. The TPB's position is that you should consider whether the Privacy Act applies to you, including in relation to AI use, and seek your own advice where appropriate.

APES 110 Code of Ethics for Professional Accountants also provides guidance on expected behaviours when using technology. It applies to registered tax practitioners who are members of CA ANZ, CPA Australia or the IPA, which covers most of the profession.

The guidance also references the Australian Government's National AI Plan 2025, under which organisations using AI are responsible for identifying and responding to AI harms.

What should your firm do in the next 30 days?

Six things, in this order.

1. Inventory what is already in use. Not what you approved. What staff are actually using. In most firms we look at, this list is longer than the partners expect, and the surprises are in the general-purpose chat tools rather than the accounting platforms.
2. Check your engagement letter. If it does not contemplate disclosure to third-party technology providers, it needs to. This is the cheapest fix on the list and the one with the most exposure attached to it.
3. Review each tool against the Privacy Act. Where is data stored. Is it used to train models. Who can access it. What happens on cancellation. Get the answers in writing from the vendor.
4. Write the policy down. Section 40 requires a quality management system, and a QMS that is silent on the technology producing your work product is incomplete. A starting point is available at AI use policy template for Australian accounting firms.
5. Define the review step. For each AI-assisted workflow, name who reviews, against what source, and where that review is evidenced.
6. Train the team on the tool, not just the policy. Code item 8 requires you to maintain knowledge and skills. If your staff cannot explain what a tool does with client data, that obligation is not met.

Most firms can complete all six inside a month. The ones that stall are usually stalling on step one, because nobody wants to be the person who asks.

Where this leaves firms that have been waiting

The most common position we encounter in Australian practices is a partner group that wants the efficiency but has been holding off until the compliance picture settled. That picture has now settled enough to move.

The guidance does not require you to use AI, and it does not stop you. It requires you to be able to show that you understood the tool, protected the client's information, applied your own judgement, and kept a file that proves it. Firms already running proper supervision and quality management will find most of this is process they already have, pointed at a new input.

If you want a view of where automation would actually save time in your practice, and what the compliance wrapper around it needs to look like, our automation audit maps both.