Bookkeepers and accountants: what an AI agent can and can't do with your software

• Last verified October 28, 2026
• Updated Oct 28, 2026Published Oct 28, 2026

Bookkeeping, accounting and tax firms keep two sets of systems: the ledgers that belong to their clients, and the practice tools that run the firm itself, from engagement letters and job boards to client portals, document storage and payroll. This page checks whether Meta's Muse, or another AI assistant that uses connectors, can reach those systems today, which pieces of routine work it might take over, and which decisions belong to a credentialed person. It's written for solo bookkeepers, small CPA and enrolled agent practices and seasonal tax offices. We leave out audit and attest engagements, enterprise firm platforms and investment advice.

We tag every claim below to show what stands behind it:

How we built it: we read vendor help articles, developer documentation, statutes, regulations and IRS publications, and each source below carries the date we checked it. We did not connect Muse or any other assistant to a real ledger, client portal or tax program, did not file or sign anything, and did not test whether these features behave as described. Documentation shows what a company says a product does; it doesn't show that the product fits your firm.

Short version

• Two of the connectors named in Meta's Muse launch post matter most to a books practice: Intuit QuickBooks and Stripe. Meta says its full connector catalog is shown inside Muse's settings; we didn't review. (Confirmed by vendor 1 4) Intuit says payroll, closing the books and filing taxes stay inside QuickBooks itself rather than the Muse connector. (Confirmed by vendor 4)
• Several firm tools now publish their own MCP servers that an assistant can be pointed at: Xero, TaxDome (in beta), Ignition and Gusto. (Confirmed by vendor 7 9 21 19) None of them is on Meta's launch list, so reaching them from Muse would mean a custom connector, which Meta doesn't review.
• Two of those servers warn about writes in plain terms: TaxDome says its API and MCP have no test mode, and Xero says its first-version tools don't ask the user to confirm before changing data. (Confirmed by vendor 9 7) Start read-only.
• Federal law makes it a misdemeanor for anyone in the business of preparing returns to knowingly or recklessly disclose return information, or use it for an unrelated purpose. (Confirmed by Congress 26) IRS rules require the taxpayer's written consent before return information goes anywhere the rules don't specifically allow. (Confirmed by the IRS 29) Work out whether an AI tool counts before you paste return data into it.
• The FTC's Safeguards Rule treats an accountant or tax preparation service as a financial institution, which means a written security program and multi-factor authentication. (Confirmed by the FTC 30) The IRS says this applies to tax and accounting professionals of every size. (Confirmed by the IRS 33)

Stack map

Swipe the table sideways to see every column →

If you want a custom connector

Anything not on Meta's list would need a bridge that you or a developer sets up, whether that's Zapier's MCP server, a vendor's own MCP server, or a connector a developer writes against a published API. According to Meta's help pages, a custom connector's credentials are held in Muse's Secure Credentials Store, Meta doesn't review those connectors or how they handle your data, many connectors can be restricted to retrieving data, and disconnecting a tool doesn't necessarily wipe details Muse already saved to memory from it. (Confirmed by vendor 2) Meta's connector guidelines say actions such as a purchase or sending an email always need approval and can't be switched to Always allow, and that Meta accepts read access to financial data but isn't currently approving new tools that move money between accounts. (Confirmed by vendor 3) For a firm, that points to one connection per client file, read-only to begin with, using a staff login whose access matches the job.

Jobs you could hand off today

Swipe the table sideways to see every column →

We haven't run any of these. Each depends on the client's plan and your firm's settings, so try them on a test client and have a person check the output before relying on it.

Keep these out

• Signing returns and handling e-file credentials. When an ERO enters a taxpayer's PIN, Form 8879 has to be signed by the taxpayer before the return is submitted and kept for three years. Remote e-signatures rely on knowledge-based identity checks, a handwritten signature is required after three failed attempts, and signed records must be tamper-proof. (Confirmed by the IRS 34) The IRS tells e-file providers to protect their EFINs and ETINs and never share them. (Confirmed by the IRS 35) An agent shouldn't sign, collect signatures for or transmit a return.
• Tax advice. Circular 230 requires written tax advice to rest on reasonable assumptions, weigh the relevant facts, apply the law to them and ignore the odds of an audit, and lets a practitioner rely on someone else's advice only when that reliance is reasonable and in good faith. (Confirmed by the Treasury Department 31) An agent can find a code section; a credentialed person decides what it means for the client.
• Moving money. Stripe's MCP includes send-money tools in public preview and requires a person to confirm refunds and outbound payments; it also says that from December it will turn away secret keys with full access, along with restricted keys not tagged for agents. (Confirmed by vendor 25) Gusto's server can prepare and run payroll, and Gusto advises using it on its own, without other MCP servers in the same session, and never turning on automatic tool execution. (Confirmed by vendor 19)
• Deletes in a client's books. Intuit's local QuickBooks server includes delete tools, such as for customers, unless the delete flag is set. (Confirmed by vendor 6) Xero adds that each tool call works on a single organisation and that only API calls, not the prompts behind them, are logged. (Confirmed by vendor 7)
• Live client workflows in TaxDome. TaxDome says moving a job runs that stage's automations, which can email or text clients, send a real invoice payable by card or send an engagement letter to signers, and that a key acts with the access of whoever made it. (Confirmed by vendor 9)
• Employee records with Social Security numbers. ADP's sample worker record lists name, birth date, SSN and address fields. (Confirmed by vendor 20) Keep that kind of data out of chat.

Risks to keep a person on

Return information and client consent

Section 7216 sets a fine of up to $1,000, or $100,000 where section 6713(b) applies, up to a year in prison, or both. (Confirmed by Congress 26) The related civil penalty is $250 for each prohibited disclosure or use, capped at $10,000 a year, and the regulation counts software developers and other auxiliary service providers as tax return preparers. (Confirmed by the IRS 27)

Without consent, a preparer may give return information to a contractor who programs, maintains, repairs, tests or procures tax software or equipment, but only as much as the work needs and only after each recipient gets written notice of sections 6713 and 7216. The rule's examples say a disclosure to a preparer or contractor outside the United States needs the taxpayer's consent first. (Confirmed by the IRS 28) Consent must be written and obtained in advance, lasts one year if it doesn't say otherwise, and for Form 1040 filers a U.S. preparer generally can't get consent to send the SSN abroad, so it has to be masked unless a narrow exception for IRS-approved safeguards is met. (Confirmed by the IRS 29)

We found no IRS guidance on whether an AI model provider, or an assistant processing data on servers abroad, counts as a contractor or a disclosure under these rules. (Unverified) Intuit's Muse post says that, with customer permission, it lets partners use select data to improve answers and choose the right connector. (Confirmed by vendor 4) Xero's developer terms bar using API data to train AI or machine-learning models. (Confirmed by vendor 7) Get advice on consent wording before return data goes to any assistant.

The FTC Safeguards Rule

The rule also requires picking service providers able to protect the data, writing safeguards into their contracts and reassessing them over time. If a notification event touches at least 500 consumers, the FTC must be told within 30 days of discovery. Firms holding data on fewer than 5,000 consumers are excused from a few parts, among them the written risk assessment, the incident response plan and the annual report to the board. (Confirmed by the FTC 30) An AI vendor holding client data is a service provider to vet like any other.

A written information security plan

IRS Publication 5708 says tax and accounting professionals are financial institutions under the Gramm-Leach-Bliley Act and the Safeguards Rule "regardless of size," that implementing and maintaining a WISP is a Safeguards Rule requirement, and that "Your WISP must be written and accessible." It describes the plan as something "the law requires you to have." (Confirmed by the IRS 33) Publication 4557 says tax return preparers must create and enact security plans under the FTC Safeguards Rule, warns that not doing so "may result in an FTC investigation," and tells preparers to report data theft or loss to the IRS. (Confirmed by the IRS 32) Add each AI tool and connector to the WISP's list of systems that touch client data.

Supervising work an agent produces

Circular 230 presumes due diligence when a practitioner relies on another person's work only if they took reasonable care in engaging, supervising, training and evaluating that person, and it holds those with principal authority over a firm's practice responsible for having adequate procedures in place. (Confirmed by the Treasury Department 31) We found no Treasury or IRS guidance applying these duties to AI tools specifically. (Unverified) Review agent output as you would a new hire's.

Client reminder texts

Engagement letter nudges, document requests and payment reminders often go out by text. The FCC's rule requires the recipient's prior express consent before an autodialed text reaches a cell phone. (Confirmed by the FCC 36) Starting Nov 25, 2026, a sender may pick a single opt-out route as long as each message discloses it clearly: an automated voice or keypad option, a reply using a listed word like "quit," "end" or "revoke," or a designated website or phone number. Senders that don't choose one still have to accept any reasonable request. Requests must be processed within ten business days, and a stop sent in reply to a non-marketing reminder may be applied only to that kind of reminder. (Confirmed by the FCC 37) Don't let an agent change texting settings or add marketing to a document reminder.

State boards and other duties

Treat this page as a summary of published sources, not as legal, tax, accounting or data security advice. Your state board and your engagement terms may ask more of you.

FAQ

Can Muse keep my clients' books in QuickBooks?

Partly. Intuit's connector covers reports, invoices and overdue-invoice reminders, while payroll, closing the books and tax filing remain in QuickBooks. (Confirmed by vendor 4) Reconciliations and closes still need a bookkeeper.

Can an agent use my firm's tax software?

Does pasting a return into a chatbot need the client's consent?

The rules don't address AI tools by name and we found no IRS guidance on it. (Unverified) Consent must be written and given before any disclosure the rules don't otherwise allow. (Confirmed by the IRS 29) Ask a professional before you do it.

What does Zapier cost here?

Is Xero's MCP server safe to point at a live client file?

Xero says its current tools change data without asking for confirmation, so it tells you to have the agent check with you before any write. (Confirmed by vendor 7) Start with read-only prompts.

Changes to this page

Swipe the table sideways to see every column →

Found a mistake or a newer source? Send it through Corrections, with a link to the source, and we'll recheck the claim and record the change here.