What's happening on the US side regarding IRS/regulatory guidance on AI use in tax practice, and how should firms handle data security in the meantime?

One participant noted that the IRS is supposedly going to give guidance on AI use at some point, but that could be up to 10 years out, and there's concern that the IRS might instead just penalize people for doing something wrong without first supplying any guidance. In the absence of clear rules, firms are treating this under existing fiduciary obligations: being smart about what you expose clients to and considering the reputational risk of appearing in the news. The general guideline mentioned is that using certified, cloud-based solutions is considered a better way to store and use data than keeping it on a local system, even though introducing AI does mean introducing more cloud exposure. It was also suggested that this might be a good time to add a cybersecurity insurance policy given the added risk, since firms are essentially trying to stay ahead of a regulatory environment that hasn't caught up yet.