Selling accounting and bookkeeping firm data for AI

Accounting work is a near-perfect example of what AI labs want to learn: multi-step processes, judgment calls, exceptions, review cycles and deadlines, repeated across hundreds of clients. A CPA or bookkeeping firm with years of history has a detailed record of how that work actually gets done.

It also holds some of the most sensitive financial information its clients have. This guide explains which firm data is a realistic candidate for licensing, which rules apply, and how to approach it without putting your license or your clients at risk.

This guide is general information, not legal or professional advice. Talk to your counsel, and consider your state board's rules and your professional liability carrier, before licensing any firm data.

The rules that matter most

Three sets of obligations shape what an accounting firm can do.

Tax return information (IRC Section 7216)

If your firm prepares tax returns, federal law generally prohibits tax return preparers from using or disclosing tax return information for purposes other than preparing the return without the taxpayer's consent, with specific exceptions. Penalties can be both civil and criminal. "Tax return information" is defined broadly and covers far more than the return itself. Treat anything gathered in connection with return preparation as off-limits unless counsel concludes otherwise.

GLBA privacy and safeguards

The FTC treats many tax preparers and other financial service providers as financial institutions under the Gramm-Leach-Bliley Act. That brings privacy notice requirements and the FTC Safeguards Rule's security program requirements. Licensing data can interact with both, so your privacy notice and information security program should be part of the review.

Professional confidentiality

The AICPA Code of Professional Conduct includes a confidential client information rule for members in public practice, and state boards of accountancy have their own confidentiality rules. Engagement letters may add contractual obligations too.

What is a realistic starting point

The strongest opportunities for most firms sit in process data, not client financials:

• Engagement workflows: how a monthly close, a year-end package, a payroll cycle or an advisory engagement moves from kickoff to sign-off
• Checklists and procedures: close checklists, reconciliation procedures, review notes standards, tickmark legends, workpaper conventions
• Practice management history: task and due-date workflows in tools like Karbon, Canopy, TaxDome or similar, with client identities removed
• Internal training material: onboarding guides, technical update memos written for staff, "how we handle X" documents
• Internal communication in Slack or Teams about process questions, reviewed and scoped to exclude client-specific discussion
• Firm-built templates for engagement letters, organizers and client requests, without client data

The review loop is especially interesting: preparer submits, reviewer leaves notes, preparer resolves them, partner signs off. That sequence shows how professional judgment gets applied and checked.

What to exclude by default

• Tax returns, organizers, source documents and anything else that is tax return information under Section 7216
• Client general ledgers, bank statements, payroll registers and financial statements
• Client portals and document exchange archives
• Client email and messages
• Personal identifiers such as SSNs, EINs tied to clients, account numbers and dates of birth
• Engagements covered by heightened confidentiality terms (for example, litigation support or forensic work)
• Firm HR and partner compensation material

Could client financial data ever be in scope?

Possibly, but rarely, and never casually. It would generally require at minimum a clear legal basis (which, for tax return information, typically means valid taxpayer consent in the form the regulations require), compliance with your privacy notice and GLBA obligations, de-identification that holds up to scrutiny, and strong contract terms. Small-business financial data can be surprisingly identifying: a distinctive revenue pattern, an unusual vendor list or a single-location business in a small town can point to a specific client. Most firms will find that process data alone is the better risk-reward trade.

De-identifying firm process data

Even "internal" accounting material leaks client identities in predictable places:

1. File and folder names, which often use client names or codes
2. Review notes and comments that mention a client, vendor or dollar amount
3. Practice management tasks titled with client names
4. Screenshots and examples pasted into training material
5. Spreadsheet metadata, hidden tabs and linked file paths

Replace client names with consistent codes ("Client 041"), generalize amounts where they aren't essential, and have a senior staff member review a sample. Our de-identification guide covers techniques in more depth.

Who is a good fit

• Firms with mature, documented procedures and a practice management system in consistent use for several years
• Bookkeeping and client accounting services practices with high-volume, repeatable monthly workflows
• Outsourced accounting, payroll and fractional CFO firms with well-structured process data, subject to their own client contracts
• Firms willing to start with procedures and workflow history and keep client financials out

What affects the value

• Years of consistent process history in a practice management system
• Breadth of services: tax, audit, advisory, bookkeeping and payroll each add different workflows
• Quality of documentation: detailed checklists and review standards add context to the rest
• Connected systems: workflow history plus internal discussion plus procedures shows the whole picture
• Exclusions: process-only scoping narrows the dataset, which is a trade-off worth making in this industry

Offers vary with all of these, and the only reliable way to price a dataset is competing interest from several buyers. See how much is my company's data worth?

Questions to settle before you start

• Which of our records are tax return information or client confidential information, and which are purely firm operations?
• What does our GLBA privacy notice say, and does our information security program cover this kind of project?
• Do engagement letters say anything about use of client information?
• Should we talk to our professional liability carrier?
• Who signs off: managing partner, the partner group, or both?

Getting started

To get an offer, a rough description is enough: services you provide, which practice management, document and communication tools you use, roughly how many years of workflow history, headcount and years in business. No files change hands at this stage.

DataOffer reviews accounting-sector data case by case and helps you scope around client and tax information from the beginning, so your counsel has a clear picture. There's no upfront cost, and nothing is shared until you approve the buyer, price and terms.

This guide is general information, not legal, tax or financial advice. Figures and ranges are illustrative; talk to qualified advisors about your situation.