Compliance
What TPB(GS) 55/2026 means for using AI in your practice
TPB(GS) 55/2026 does not ban AI. It says three things: get the client’s permission before their information goes into an AI tool, keep a person responsible for the output, and document that review at each step of the workflow. It applies to AI embedded in software you already use, not only to chatbots.
What the guidance actually is
On 22 July 2026 the Tax Practitioners Board issued TPB(GS) 55/2026, setting out how the Code of Professional Conduct applies when a registered tax or BAS agent uses artificial intelligence. It was consulted on as exposure draft TPB(I) D62/2026 in March 2026, and notably it was finalised as a Guidance Statement rather than an Information Sheet — the document type changed between draft and final.
It does not create new obligations. It explains how obligations you already carry apply to a tool you may already be using.
The three things it asks of you
1. Ask the client first
Entering client information into an AI tool can amount to divulging that information to a third party. Where it does, you need the client’s permission before it happens — and that permission should cover who the disclosure is to, whether AI is involved, and where the data will be stored. A general line buried in an engagement letter is unlikely to carry that weight.
2. A person stays responsible for the output
The guidance is direct about this: you must exercise your own professional judgement, and AI output is not a substitute for your own analysis. It notes that these tools can produce confident, well-formatted answers that are simply wrong.
3. Document the review at each step
This is the obligation most practices are least ready for. Verifying AI output is expected throughout each step of the workflow, and each of those steps should be documented. That documentation is how you meet your record-keeping and quality-management obligations, not a separate exercise.
What counts as AI here
The guidance adopts the OECD definition, which is broader than the thing most people picture. The last item is what everybody assumes it means. The first four are what catches practices out.
Broader than most people assume. The guidance adopts the OECD definition and covers AI embedded in third-party platforms you already use, not only chatbots you deliberately open. It also reaches agentic functionality — tools that act on your behalf rather than just answering.
In practice that means the AI features appearing inside your ledger, your practice manager and your document system are in scope, whether or not anyone in the firm decided to “adopt AI”.
Where it sits in the Code
The guidance hangs on obligations in the Tax Agent Services (Code of Professional Conduct) Determination 2024 — confidentiality, competence, and the requirement to maintain a system of quality management. Those additional obligations applied from 1 January 2025 for practices with more than 100 employees and from 1 July 2025 for everyone else, so for most practices they have been live for over a year.
What to do about it
- Write down which tools in your stack use AI, including the ones that came with software you already had.
- Check what your engagement letters actually say about disclosure to third parties and where data is stored.
- Decide which tasks a person must review before anything leaves the practice, and make that the default rather than a habit.
- Keep a record of who reviewed what. If you cannot show the review happened, you cannot evidence it.
The last two are the ones that turn into work. Anything that produces the record as a by-product of doing the job — rather than as a separate log someone has to remember to fill in — is doing you a favour.
Keeping the record is the hard part.
DeskMate writes who ran a skill, what it touched and who approved it, every time — as a by-product of the work rather than a log someone has to remember.