Top 10 AI Agents forAccounting Firms in 2026

On 6 August 2026, a company that a great many accounting firms had signed for contract-to-revenue document AI stopped being that company. Klarity renamed itself Within, moved to a new domain, and repositioned as a process-discovery and agent-enablement layer — leaving accounting document AI behind. Both of its old domains now redirect. That happened seventeen days before this article published, and it is the single cleanest argument we can make for why a ranking in this category has to be re-checked rather than copied.

It is not an isolated event. In February 2026, Botkeeper shut down after eleven years selling specifically to accounting firms. Materia was acquired by Thomson Reuters in October 2024, and its domain now returns a 404 while the www subdomain redirects to an unrelated company. AvidXchange left the public markets on 15 October 2025 into TPG's hands, with Corpay co-investing. Keeper became Double in October 2025 after a trademark suit — a rebrand, not an acquisition, and the two are constantly confused. Yet all four of those names still appear in rankings published this year.

That is not a small population to write for. The Bureau of Labor Statistics' Occupational Employment and Wage Statistics programme put 1,449,500 accountants and auditors in US employment in its May 2025 estimates — a figure that excludes the self-employed — of whom 330,500 work in NAICS 5412, the accounting, tax preparation, bookkeeping and payroll services industry. On the tax side, the IRS Return Preparer Office reported 879,698 individuals holding a current PTIN for 2026, of whom 208,519 are CPAs, with the data current as of 1 August 2026. Those preparers e-filed 75,316,000 individual returns in the 2026 filing season.

The second thing to know before reading any ranking, including this one, is that nothing in this category is more than about eighteen months old. BILL's Form 10-K describes its agents as its first suite, launched in fiscal 2026. Vic.ai has one live agent and two in beta. Karbon's Kai is in limited early access. Suralink's agent library launched on 3 June 2026, Digits' Agentic Close on 8 June 2026, Puzzle's AI Suite on 10 July 2026, and Black Ore's Tax Autopilot reached general availability on 29 April 2026. Any ranking that implies settled, proven tooling is describing a market that does not exist yet. If you want the cross-industry version of that argument, we set it out in our 2026 survey of AI agents across every vertical we cover.

We scored eight attributes, every one of which you can re-check yourself in an afternoon, and we refused to score anything a vendor publishes about its own performance. Everything below was checked on 23 August 2026. Where a vendor did not publish something, the cell says so in plain words rather than being filled with an estimate.

We did not score accuracy, autonomy rate, straight-through processing, hours saved, close days eliminated or ROI. Not because those things do not matter — they matter more than anything else in the table — but because there is no source for them that is not the seller. A ranking that repeats a vendor's 99% and calls it a finding has laundered marketing into fact.

The benchmark question, stated precisely

Accounting is the one field in this cluster where a blanket claim that no independent evaluation exists would be false, so here is the precise version. Independent benchmarks of models exist. There is no independent benchmark of the products in the table below. No third party has tested Basis, Fieldguide, Black Ore, DataSnipper, Digits, Canopy or any comparable product on a common task set with a published methodology.

What does exist is at the model layer, and it hands you a number no vendor will quote. Vals AI's Finance Agent benchmark, version 1.1 most recently updated on 4 June 2026, runs 537 questions covering core financial-analyst tasks — retrieval, market research, projections — pitched at entry-level analyst work. It was built with Stanford researchers, a globally systemically important bank and industry experts, and it evaluated 21 models across eleven labs. The top score was Claude Opus 4.7 at 64.37%, with Claude Sonnet 4.6 next at 63.33%.

Three 2026 preprints point the same direction and are worth reading in full before you buy. AuditFraudBench (submitted 6 June 2026) builds an enforcement-grounded benchmark from original and restated 10-K and 10-Q filings, structured financial statements, MD&A disclosures and SEC Accounting and Auditing Enforcement Releases, and reports that both proprietary and open models still struggle to jointly reason over financial figures, disclosure framing, restatement evidence and enforcement-grounded fraud mechanisms. ReguSim and ReguBench (submitted 20 August 2026) frames financial compliance evaluation as an audit of rule-grounded actions and evidence use, rather than a single compliance score — which is an independent research group arriving at the same conclusion this methodology asserts. Both are preprints, not peer-reviewed papers, and should be described that way.

Every cell below is either a citation you can open or the words “not publicly disclosed”. Ranking runs on the quality and completeness of what the vendor discloses, because that is the only dimension a buyer can independently verify before signing. It is not a ranking of which product is best at your work — nobody can tell you that from the outside, and anyone claiming to is selling.

All attributes checked 23 August 2026 against each vendor's own published pages and against public filings. Vendor-published performance figures are excluded from the table by design.

“Agent” means at least six different things here

Before the entries, a taxonomy, because the word is doing a great deal of unearned work in this market. These six categories came out of reading the vendors' own descriptions rather than their headlines — and in several cases the vendor's own documentation contradicts its homepage.

Each entry below states what the product does, what is verifiable, what is not disclosed, who it fits, who it does not, and who owns it. Where a figure is the vendor's own, it is attributed to the vendor in the sentence that carries it. Where we could not confirm something, the entry says so rather than guessing.

Five products missed the ten for reasons worth stating, because in three cases the reason is more useful than the ranking. A shortlist is built from exclusions as much as inclusions, and these are the exclusions we would want explained to us.

Vendor continuity deserves to be a ranking criterion, and Botkeeper is why. Eleven years, roughly $90M raised, sold specifically to accounting firms, dead with weeks of notice. Read the funding column of any shortlist with that in mind: Double's $6.5M Series A of December 2025 is the second-smallest raise in this market, and Booke AI has no institutional funding we could verify at all. That is not a reason to avoid small vendors. It is a reason to ask, before you migrate a client book onto anything, what happens to your data and your workflow if the vendor gives you six weeks' notice.

Sending client tax data to a third-party AI vendor is a disclosure of tax return information by a tax return preparer, and getting it wrong is a criminal misdemeanour. That sentence is the most important one in this article, and it appears on no vendor website we examined.

IRC §7216(a) provides that a person engaged in the business of preparing returns who knowingly or recklessly discloses any information furnished for, or in connection with, the preparation of any such return — or uses any such information for any purpose other than to prepare or assist in preparing the return — shall be guilty of a misdemeanor, punishable by a fine of not more than $1,000 (or $100,000 where §6713(b) applies), or imprisoned not more than 1 year, or both. Alongside it sits §6713, a civil penalty of $250 per disclosure or use, capped at $10,000 per calendar year. Two things about §6713 are routinely got wrong: those figures are not inflation-adjusted — the statute contains no adjustment provision and there is no revenue procedure updating them, so a writer who modernises them like a §6695 penalty prints a wrong number — and §6713 has no scienter requirement. The knowingly-or-recklessly language in §7216(a) is simply absent from §6713(a). For a firm piping returns through a vendor without consent, the civil penalty is effectively strict liability, per disclosure.

And the agent's output is itself tax return information. §301.7216-1(b)(3) defines the term to include information the preparer derives or generates from tax return information in connection with preparing a taxpayer's return. A summary, memo, workpaper or reconciliation an AI agent generates from a client's return data is covered by the statute in its own right. Feeding that output into a second tool is a second disclosure. This is the point where a modern multi-vendor stack — document intake here, extraction there, a research tool for the position, a review layer at the end — quietly becomes four disclosures rather than one.

The three tests a vendor must pass to be used without taxpayer consent

1. 1.Located in the United States. 26 CFR §301.7216-2(d)(1) permits disclosure to another tax return preparer located in the United States for the purpose of preparing or assisting in preparing a return, or obtaining or providing auxiliary services. Any processing outside the US — inference, storage, support, human review — falls outside the exception and requires consent. There is no workaround.
2. 2.Auxiliary services only, meaning not substantive determinations or advice affecting the tax liability reported by taxpayers. An agent doing OCR, data entry or organiser intake is on the right side of that line. An agent that proposes positions, elections or treatments is on the wrong side and requires written consent under §301.7216-3.
3. 3.Or, in the software and equipment lane, §301.7216-2(d)(2): disclosure is permitted for programming, maintenance, repair, testing or procurement of equipment or software used for tax return preparation, only to the extent necessary, and only if the preparer ensures that everyone receiving the information receives a written notice informing them of the applicability of §§6713 and 7216 and describing the requirements and penalties. Almost no firm does this.

Offshore is the constraint that catches most SaaS AI stacks. Consent is mandatory for any disclosure to a preparer located outside the United States. Beyond that, a US preparer may not obtain consent to disclose the taxpayer's Social Security number to a preparer located outside the United States — the SSN must be redacted or masked unless both ends maintain an adequate data protection safeguard. The governing consent rules are Rev. Proc. 2013-14, as modified by Rev. Proc. 2013-19, which only extended the effective date of the mandatory language. There is no successor; a newer revenue procedure number is invented.

The consent itself has to be written, knowing and voluntary, and opt-out consents are prohibited. Rev. Proc. 2013-14 §5.04(2) states that a consent requiring the taxpayer to remove or deselect disclosures or uses the taxpayer does not wish to be made — an opt-out consent — is not permitted. A pre-ticked checkbox buried in an engagement letter is void. Where the disclosure is offshore, §5.04(1)(e)(i) prescribes the language: “This consent to disclose may result in your tax return information being disclosed to a tax return preparer located outside the United States.”

Now the finding. Across roughly twenty-five vendors examined for this article on 23 August 2026, exactly one — Liscio — names IRS Pub 4557 and the FTC Safeguards Rule on its own site, and not one mentions §7216. Not the products preparing 1040s. Not the ones holding taxpayer document custody. Not the ones running 1099 and W-9 workflows. Not the ones producing partnership returns. That absence is not evidence of bad faith; it is evidence that this market has been built by software companies for software buyers, and that the compliance analysis is yours to do. A vendor's SOC 2 Type II report supports your written information security program. It does not discharge your obligations, and no contractual indemnity turns a criminal statute into someone else's problem.

There is no AI-specific accounting standard in force anywhere in US audit or tax practice as of 23 August 2026 — not at the AICPA, not at the PCAOB, not in Circular 230. Every binding constraint is a pre-existing, technology-neutral rule that AI happens to trip: audit-evidence reliability, due care and supervision of anything you outsource, confidentiality of client information, the Safeguards Rule's service-provider oversight duty, and the criminal statute above. All of them applied to your vendor on the day you signed, and none of them needed an AI rule to bind an AI agent.

Circular 230 was never amended. This is the fact most likely to be printed wrong.

Checked against the Federal Register on 23 August 2026, every document affecting 31 CFR Part 10 published since 1 January 2024 returns exactly one result: a proposed rule, REG-116610-20, published 26 December 2024 at 89 FR 104915. The IRS's own printed Circular 230 remains Revision 6-2014, and §§10.22(b), 10.35 and 10.36 each carry an applicability date of 12 June 2014. Anyone writing that the rules were updated in 2025 or 2026 is working from memory rather than the register.

What the existing text actually says matters more. §10.22 requires due diligence in preparing, approving and filing returns, and §10.22(b) is the AI paragraph: a practitioner is presumed diligent where they rely on the work product of another person and used reasonable care in engaging, supervising, training, and evaluating that person. There is no analogue for reliance on a model, and no IRS guidance extending it to one. That is an unresolved gap, not a safe harbour, and it is the paragraph most likely to be misquoted in your favour. §10.34 bars signing a return the practitioner knows or reasonably should know contains an unreasonable position, and §10.34(d) permits good-faith reliance on client-furnished information while forbidding the practitioner to ignore the implications or skip reasonable inquiries where the information appears incorrect. §10.35 requires competence. §10.37(b) provides that reliance on another's representations or findings is not reasonable where the practitioner knows or should know that person lacks the necessary competence or qualifications.

The Safeguards Rule makes your AI vendor a service provider

16 CFR §314.2(h) states that an accountant or other tax preparation service in the business of completing income tax returns is a financial institution, because tax preparation services is a financial activity. The FTC's own compliance guide lists tax preparation firms among its examples, and IRS Pub 4557 puts it flatly: tax and accounting professionals are considered financial institutions regardless of size. The same section defines a service provider as any person or entity that receives, maintains, processes, or otherwise is permitted access to customer information through its provision of services directly to a financial institution — which an AI vendor plainly is, by the plain terms of the definition.

That triggers §314.4(f) in full: take reasonable steps to select and retain service providers capable of maintaining appropriate safeguards; require them by contract to implement and maintain those safeguards; and periodically assess them based on the risk they present and the continued adequacy of their safeguards. Periodically assess is the clause with teeth here, because it makes vendor diligence a recurring obligation rather than a procurement event — and this category re-releases products every few weeks. The rest of §314.4 still applies too: a designated Qualified Individual, a written risk assessment, encryption of all customer information in transit and at rest, MFA for anyone accessing any information system, monitoring and testing, training, a written incident response plan, and an annual written report to the board or a senior officer. The small-entity relief for institutions holding information on fewer than 5,000 consumers is real but narrow — and it does not exempt §314.4(f).

Get the breach-notification date right, because most published content does not. The amendment was published 13 November 2023 at 88 FR 77499, and its DATES section states that the amendments are effective May 13, 2024. The widely-circulated 27 October 2023 date is the FTC press release, not the rule. Substantively, §314.4(j) requires notifying the FTC as soon as possible and no later than 30 days after discovering a notification event — unauthorised acquisition of unencrypted customer information of 500 or more consumers, with unauthorised access treated as acquisition unless reliable evidence shows otherwise — and the report may be made public. Note also that Pub 4557 (Rev. 6-2024) and Pub 5708 (Rev. 8-2024) are both 2024 documents and neither mentions artificial intelligence; do not attribute AI guidance to either.

The AICPA Code: the client has a veto

The provision that most directly governs plugging an AI vendor into an engagement is ET 1.300.040, Use of a Third-Party Service Provider: before using one, the member should ensure it has the required professional qualifications, technical skills and other resources, and the member must adequately plan and supervise its professional services so that they are performed with competence and due professional care. Sitting above it is the General Standards Rule at ET 1.300.001 — professional competence, due professional care, planning and supervision, and obtaining sufficient relevant data to afford a reasonable basis for conclusions. Note the common citation error: ET 1.300.010 is the Competence interpretation under the rule, not the rule itself. Note also that due professional care is not an AU-C 200 requirement paragraph; in the AICPA framework it is a Code duty, and in the PCAOB framework it is AS 1000 ¶.09.

Before disclosing confidential client information to a third-party service provider, the member should inform the client, preferably in writing, that the member may use a third-party service provider. If the client objects to the member's use of a third-party service provider, the member either should not use the third-party service provider to perform the professional services or should decline to perform the engagement.

— AICPA Code of Professional Conduct, ET 1.150.040 ¶.02

The client gets a veto, and almost nobody knows it. There is a trap alongside it. ET 1.700.001 provides that a member in public practice shall not disclose any confidential client information without the specific consent of the client, and ET 1.700.040 ¶.02 permits either a contractual agreement with the provider to maintain confidentiality and provide reasonable assurance of appropriate procedures, or specific client consent. Read alone, that says a good master services agreement is enough. Read together with ET 1.150.040, a confidentiality clause in the vendor MSA does not obviously discharge the separate notice duty. The Journal of Accountancy's September 2024 treatment of outsourcing and professional liability is the useful AICPA-published cross-reference: the Code permits either route, and risk management recommends both.

One genuinely open question deserves to be left open. ET 1.150.040 ¶.03 carves out administrative support requiring no client notice, naming record storage, software application hosting and authorised e-file tax transmittal services. Whether an autonomous agent that performs professional services falls inside that carve-out is unsettled, and there is no AICPA interpretation resolving it. Anyone who tells you the answer — in either direction — is guessing. A source note in fairness: the live AICPA Code viewer requires a login and the download page 404s, so these citations come from the AICPA's own published Code PDF via the Internet Archive. Treat the text as reliable and the currency as unconfirmed.

Audit evidence, and the PCAOB position that is constantly misreported

SAS No. 142, Audit Evidence — which supersedes the prior AU-C 500 and is the current AU-C 500, effective for audits of financial statements for periods ending on or after 15 December 2022 — names the technology explicitly. Paragraph A4 lists artificial intelligence, machine learning, remote observation tools and robotic process automation as examples of other automated tools and techniques. Paragraph A27 then holds the line: the reliability attributes of accuracy, completeness, authenticity and susceptibility to management bias are also relevant when automated tools and techniques are used to obtain audit evidence. Paragraph 6 defines audit evidence as information to which audit procedures have been applied. Paragraphs 7 and 8 require the auditor to evaluate relevance and reliability including source, and to obtain evidence about accuracy and completeness as necessary. Paragraph 10 requires the auditor to resolve doubts about reliability — which is exactly the state a non-deterministic model leaves you in.

On the PCAOB side, three corrections. First, AS 1105 ¶.10A was adopted 12 June 2024, SEC-approved 20 August 2024, and is effective for audits of financial statements for fiscal years beginning on or after 15 December 2025 — calendar-year 2026 audits are the first ones covered. Second, the PCAOB did not defer or delay it. Release No. 2025-004, dated 18 September 2025, is a Board policy statement: where the auditor concludes there is no more than a remote possibility that information used as audit evidence has been modified in a way that would render it unreliable, the PCAOB will not treat the absence of the separate testing specified in ¶.10A(b) as noncompliance through its inspection or enforcement processes — with footnote 4 preserving the AS 1000 due-care and AS 1215 documentation duties. The effective date never moved, despite a July 2025 request from the Center for Audit Quality to defer parts of it. Third, there is no 2025 or 2026 PCAOB AI Spotlight. The only one is the July 2024 staff publication, which is expressly non-authoritative — it states on its cover that it represents the views of PCAOB staff and not necessarily those of the Board, and is not a rule, policy or statement of the Board — and which reported that GenAI use in issuer audits was concentrated in administrative and research activities rather than audit execution. A writer citing a 2026 Spotlight is inventing a document.

This is an illustrative scenario, not a client outcome. We are not going to tell you a firm saw a 40% reduction in anything, because we would be inventing it — and an article that refuses unsourceable industry statistics and then asserts an unverifiable client result has destroyed its own standing. What follows is arithmetic built entirely from prices the vendors publish, which you can re-check on their pricing pages today.

Consider a twelve-seat CPA firm: three tax partners, nine staff, roughly 300 individual returns, a 60-client bookkeeping and CAS book, and one small assurance practice. The partners want the AI layer costed properly before a committee meeting.

What that arithmetic does not capture is the build cost of the thing no vendor sells you: the connective tissue between these products and the systems your firm already runs on. That is the work we do. Our own ScoreBiz 360 merchant credit-scoring platform case study is the closest analogue we can point at honestly: a custom fintech web application built on React, TypeScript and Supabase, delivered in three months for under $30,000, serving more than 5,000 small businesses, and reported in that case study at 99.96% platform uptime with a 185ms average response time. It is not an accounting agent, and we are not going to pretend it is. It is evidence of what a regulated-adjacent financial build costs and how long it takes when the scope is drawn tightly — which is the same discipline this article is arguing for. If the underlying financial-platform engineering is what you are weighing, our guide to fintech app development in Los Angeles covers that ground in more depth.

The characteristic failure of an accounting agent is not a crash. It is plausible, well-formatted, confidently wrong work that looks exactly like correct work. That is the failure a firm without a sampling process will not catch, and there is now independent research documenting the mechanism.

The FinIndices preprint, submitted 22 July 2026, benchmarks data-processing fidelity over uncropped financial statements of up to 32,000 tokens and documents two failure modes. The first is a knowledge bottleneck: despite memorising formulas during pre-training, models demonstrate fragile pattern matching, and removing explicit formula hints causes performance to collapse — the authors report one frontier model dropping from 70.70% to 38.22% on table tasks. The second is a structural bottleneck: the cognitive load of generating multi-metric, multi-period tables actively drains reasoning capacity, and under structural pressure models that flawlessly execute isolated derivations regress to shallow heuristics such as fetching incorrect adjacent columns or substituting deep accounting adjustments with lazy literal arithmetic. Read that last clause again. It fetched the wrong column and did the easy sum. It did not tell you.

• Silent regression under load. The agent that was reliable on a four-page statement degrades on a thirty-page one, and degrades toward plausible shortcuts rather than obvious errors. Detection: a fixed known-answer sample re-run weekly, scored automatically, with the score trended. Not spot-checks by whoever is free.
• Prompt injection through client-supplied documents. Every agent here reads untrusted input — invoices, emailed bank statements, PBC uploads, brokerage PDFs, portal messages. Any of them can carry instructions aimed at the model. This is unsolved. Treat it as blast-radius reduction: no write credential live in a session reading untrusted content, least-privilege scopes, reversible writes, per-action logging.
• Chart-of-accounts drift. A learned coding model trained on last year's behaviour quietly mis-codes after a client restructures its accounts. Detection: monitor the rate of human overrides per client per month, and alert when it moves — that number is a leading indicator and almost nobody tracks it.
• Vendor version drift. This category ships every few weeks. A model swap or prompt change behind the same product name changes your output distribution with no notice. Detection: your own regression set, run against production output on a schedule, plus a subscription to every vendor changelog with a named owner.
• A vendor that disappears. Botkeeper gave weeks of notice after eleven years. Detection is contractual, not technical: an exportability clause, a data-format commitment, and a written answer to what happens to our client data on termination, obtained before signing.
• The review that stops being a review. The real failure mode in every regulated field is rubber-stamping — the queue gets long, the outputs look right, approval becomes a click. Detection: instrument review time per item and alert when the median falls below the time it physically takes to check the work.

Underneath all of it sits the integration question, which decides how much autonomy is even available to you. An agent can only be as autonomous as its write path allows, and in accounting the write paths into tax packages and ledgers are narrow, vendor-discretionary and frequently undocumented — Black Ore's tax-package list is a dropdown, Fieldguide publishes no named partners, Basis publishes none at all. We work through that constraint properly in our guide to integrating AI agents with legacy and closed systems of record, and it is the piece of diligence most firms skip.

Rollback should be a credential action, not a code change. The kill switch that works is one that revokes the agent's access token and leaves the humans with the queue. If your rollback plan requires a deployment, you do not have a rollback plan.

Every line in this table comes from a rule that already existed, not from our judgement. That is what makes it defensible where competing versions are not — and it is the reason no AI-specific standard was needed to answer the question of what an agent may do alone.

Boundary derived from SAS 142, AU-C 200, Circular 230 §§10.34 and 10.37, the AICPA Code and 26 CFR §301.7216-2. Checked 23 August 2026.

Buy first where a product genuinely fits, and build only the connective tissue no vendor sells. Most firms in this market need less custom software than they think and more diligence than they expect. Where a build is the right answer — usually because the workflow crosses three systems that will not talk to each other, or because §7216 makes a hosted multi-vendor pipeline untenable — these are our bands. They do not vary by industry.

Senior-led delivery at $150–$225 per hour, ongoing retainers at $2,500–$9,500 per month, a 30-day post-launch warranty, and a fixed-price phased proposal within 5 business days of the discovery call. Full source-code and IP ownership transfers to you at the end — which matters more in this category than most, given how many vendors in it changed shape in the last eighteen months. We are a senior-led, Black-owned agency in Los Angeles, and you can reach us on +1 (424) 272-5601, book directly at calendly.com/frenchydigital/discovery-call, or read more about our AI agent creation service.

The sequencing that works. Start with the disclosure map, not the tool selection: list every workflow that touches return information, name every vendor in the path, and record where each one processes and stores data. That artefact is what §314.4(f) diligence and any §7216 analysis both need, and it usually shortens the vendor shortlist by itself. Then run one workflow read-only against live data with the outputs reviewed against a labelled sample. Then put one reversible write behind a human commit. Then, and only then, consider narrow autonomy on a bounded class of low-consequence actions with a measured error rate and an automatic reversion rule. Firms that skip to step four are the ones who discover the structural bottleneck in a client deliverable.

Every red flag below was observed in this research, on a live vendor page, in August 2026. None is hypothetical, and we have deliberately described the pattern rather than naming every vendor, because the pattern is what you need to recognise on the next call.

• A published accuracy figure with no methodology, no denominator and no named comparator. One vendor in this roster claims 99.9 to 100% extraction accuracy. Document extraction does not reach 100%, and a vendor willing to print that will print anything.
• An undefined denominator. One vendor claims its AI performs on average 87% of finance work across 2,700+ unique fields. Finance work is not a measurable quantity, so the percentage cannot be checked in either direction.
• Hours-saved claims from a product that is not generally available. One vendor advertises saving firms an average of 19.9 hours a week per employee — nearly half a working week — for a product its own site describes as being in limited early access with capabilities growing each week, and publishes no methodology.
• SOC 2 language that belongs to somebody else. Read for the difference between we hold a SOC 2 Type II report, our hosting provider is SOC 2 certified, we are SOC 2 compliant, and here is what SOC 2 is. All four appear in this market and only the first is a claim about the vendor.
• A security page that does not exist. Several vendors handling taxpayer documents have no reachable security or trust page at all. That is not a neutral absence for a product inside Pub 4557 scope.
• Marketing that argues against copilots and then describes one. One homepage says not a copilot, not a chatbot; the product page says the AI always operates under human oversight, does the work and surfaces it for the right person to review. The second sentence is the operative one.
• An investor quoted as an evaluator. Efficiency ranges attributed to a venture investor who led the vendor's most recent round are not independent assessments, and should be attributed to the person who said them.
• A customer testimonial converted into a metric. When a vendor release quotes a named customer saying a process is ready for review in minutes, that is an opinion. Paraphrasing it as a measured time saving is how vendor marketing becomes industry fact.
• Integration lists that are actually dropdowns. One vendor lists nine major tax packages in an intake form with no indication of which are live. Trade coverage of the same product names none of them. Ask for a docs URL, not a logo wall.
• Stale directories on both sides. One PBC vendor still lists Materia as an integration; Materia was acquired in October 2024 and its domain returns a 404. If a vendor's own integration directory is stale, assume its roadmap page is too.
• Any answer to who owns you now that is not a public record. Ownership changed for several vendors in this category during 2025 and 2026, and in two cases an aggregator database had it wrong. Ask for the filing, the press release or the registry entry.
• Silence on §7216. No vendor in this research mentions it. That silence is not disqualifying on its own, but a vendor whose product prepares returns and who cannot discuss the statute in a sales call has not thought about your exposure.

The five questions to send in writing before you sign. Where does inference run, and where is data at rest? Does any human, at your company or a subprocessor, ever access our client data outside the United States? Which SOC report do you hold, of which type, covering which systems, for which period, and audited by whom — and may we read it under NDA? Is our data used to train or improve any model, yours or a subprocessor's, and is that commitment contractual? And what happens to our data, in what format, on termination or wind-down? A vendor that will not answer those five in an email with a name attached has told you something useful.

Refusing a statistic is more useful than repeating one, so here is what we chased and why we would not print it. Each of these appears constantly in accounting-AI content, and each fails on inspection.

Everything below is a gap in this article, stated plainly, because a ranking that refuses vendor claims and then hides its own uncertainty has learned nothing. All of it was checked on 23 August 2026 and some of it will have changed by the time you read this.

• There is no independent evaluation of any product ranked here. We ranked disclosure quality, not performance, and disclosure quality is a proxy for institutional seriousness — not for whether the software will do your work well.
• Several compliance postures could not be read at all. Double operates a Vanta-hosted trust centre that returns HTTP 200 but renders no certification in the page source. Numeric's security, trust and compliance URLs all fail. Stampli's security page returns 404 and its privacy policy is JavaScript-rendered. Soraban has no security or trust page we could find. Trullion has no security, trust or compliance page anywhere on its site. We printed nothing about any of them rather than inferring.
• Ramp's FedRAMP status is deliberately omitted. Its trust centre lists FedRAMP Moderate, GovRAMP, TX-RAMP and Cyber Essentials Plus, but In Process and Authorized could not be distinguished, and the FedRAMP Marketplace is a JavaScript application whose data endpoints we could not reach.
• Corporate status for several vendors rests on absence of evidence rather than a cleared search. Ramp, Karbon, Canopy, Trullion, MindBridge, Suralink, Stampli, FloQast, Rillet and Campfire were checked for acquisition or rename announcements and none was found; that is weaker than a positive confirmation.
• Some funding figures were deliberately dropped. Truewind's Series A was search-summarised rather than directly fetched. Trullion's and Puzzle's totals come from aggregators. Booke AI's revenue and headcount come from a third-party listing. Vic.ai's Series C details come from private-market trackers, which are not primary and are frequently stale. Numeric's own blog and the PR Newswire dateline for the same funding round disagree by a year.
• AICPA Code citations come from the AICPA's own published Code PDF via the Internet Archive, because the live Code viewer requires a login and the download page returns a 404. The text is reliable; its currency is not confirmed, and we make no claim that no later amendment exists.
• Whether ET 1.150.040's software-application-hosting carve-out covers autonomous agents is unresolved. No AICPA interpretation answers it, and we did not pretend to.
• We could not confirm a named 2026 AI product from Wolters Kluwer or Intuit from primary source — wolterskluwer.com returns HTTP 403 to automated requests — so neither is named here, despite both being significant incumbents in this market.
• Legal entity names are unpublished for many vendors, including Fieldguide, DataSnipper, MindBridge, Karbon, Suralink, Ramp, Basis and Vic.ai. Where an entity could not be confirmed from a primary source, we did not print one.
• Adoption and scale figures throughout — customer counts, top-firm penetration, transaction volumes — are vendor-published without exception, and are attributed in text wherever they appear.

And the honest closing position. The products in this article are eighteen months old at most, in a market that has already lost a well-funded eleven-year-old incumbent, seen one vendor acquired and absorbed, and watched another rename itself and leave the field seventeen days before we published. The regulatory constraints, by contrast, are between twelve and forty years old and are not moving. Buy against the constraints, not against the roadmaps. Ask where the data goes, what your client was told, who signs, and what happens on termination — and treat every performance number in this category as marketing until a third party publishes a methodology, which nobody has yet done.