An engagement letter should tell the client, in plain words, that the firm may use AI enabled software, what that software does with their information, and that a qualified person reviews the work and the firm stays responsible for it. The tax professional bodies suggest this disclosure, UK GDPR requires the related privacy information, and any limit on liability for AI assisted work must still pass the reasonableness test.
Tax investigation insurance from £108.75 a year (£9.06 a month).Pays up to £100,000 of your accountant's fees if HMRC opens an enquiry. No excess. Buy online in a few minutes.
Do accountants have to tell clients they use AI?
There is no single rule that says every engagement letter must mention AI. The clearest professional steer comes from topical guidance on Professional Conduct in Relation to Taxation (PCRT) and the ethical use of AI tools, issued on 19 January 2026 by the seven PCRT bodies: AAT, ACCA, ATT, CIOT, ICAEW, ICAS and STEP. It says members may consider including a disclosure in the engagement letter that AI enabled software may be used.
The same guidance links transparency to the duty not to mislead a client knowingly or carelessly by omission. Where AI is fundamental to the deliverable, it says it may be appropriate to tell the client directly before the work starts, rather than relying on a general line in the terms. The wider ethical points are covered in our page on the ethics of AI use in practice; this page deals with the wording that goes into the letter.
What should an AI clause in an engagement letter say?
A workable clause is short and factual. It usually covers:
- that the firm may use AI enabled software in delivering the services, with examples such as drafting correspondence, extracting data from documents or reviewing transactions;
- that client information is only entered into tools the firm has approved and that are covered by suitable contracts and security;
- that a qualified member of staff reviews any output before it is relied on or sent to the client or HMRC;
- that the firm remains responsible for the work, whether or not AI was used;
- how the client can raise concerns or ask the firm not to use AI on their work;
- a cross reference to the firm’s privacy notice and, if it has one, a published AI or data handling policy.
The PCRT guidance suggests firms review how their engagement terms describe the processing of client data and consider pointing clients to a data handling or AI usage policy on the firm’s website. Keeping the detail in a separate policy means the letter does not need reissuing every time a tool changes. Our page on engagement letters for accountants covers the rest of the letter.
Run an accountancy or bookkeeping practice? Solar Protect runs fee protection schemes for practices, so the cost of dealing with an HMRC enquiry into a client is covered rather than written off.
What does UK GDPR require you to tell clients?
Where an AI tool processes personal data, the ICO says you need to be transparent about how you process personal data in an AI system. Its AI guidance says privacy information should cover your purposes for processing, your retention periods and who you will share the data with. Where you collect data directly from people, you must give that information at the time you collect it; where you obtain it from elsewhere, within a reasonable period and no later than one month.
The ICO’s checklist of privacy information also includes the recipients or categories of recipients, which covers anyone processing data on your behalf, international transfers and the safeguards relied on, and whether you make decisions based solely on automated processing. If an AI supplier hosts data outside the UK, the privacy notice should say so.
The tax practitioners’ engagement letter guidance, updated on 3 March 2026 by a working party of CIOT, ATT, ACCA and AAT, says a practitioner must send their privacy notice to clients along with the engagement letter. The AI clause and the privacy notice therefore need to tell the same story.
Can you put client data into public AI tools?
The PCRT guidance is direct on this: the input of client data into publicly available AI tools is likely to constitute a breach of client confidentiality unless the client has consented. Where public tools are used, it says data should be anonymised and generic, with care taken that the client cannot be identified indirectly.
That is why the clause should promise use of approved tools only, and why the firm’s internal rules need to back that promise up. Our pages on AI tools and client data and confidentiality for accountants go into the detail, and an AI policy for an accountancy practice explains how to set the internal rules.
Does the AI supplier need a contract with the firm?
Usually, yes. Where an AI supplier processes client personal data on the firm’s behalf it is likely to be a processor, and the ICO lists minimum terms a controller and processor contract must contain under Article 28(3) of the UK GDPR. These include processing only on the controller’s documented instructions, a commitment of confidentiality from anyone allowed to process the data, the security measures Article 32 requires, no use of sub processors without the controller’s written authorisation, deletion or return of the data at the end of the contract, and support for audits.
Check the supplier’s terms against that list before telling clients their data is protected. See data processing agreements for how to review them.
Can you limit liability for AI errors in the engagement letter?
You can try, but the limit must be reasonable. Under section 2(2) of the Unfair Contract Terms Act 1977, liability for negligence causing loss other than death or personal injury can only be excluded or restricted so far as the term satisfies the requirement of reasonableness. Section 11(1) tests whether the term was fair and reasonable given the circumstances known or contemplated when the contract was made. Where liability is capped at a fixed sum, section 11(4) says regard is had to the resources available to meet the liability and how far it was open to the firm to cover itself by insurance.
For consumer clients, section 2(4) of the 1977 Act points instead to sections 62 and 65 of the Consumer Rights Act 2015. The CIOT and ATT engagement letter guidance says a practitioner must be able to demonstrate that a liability limit is fair and reasonable and strongly recommends independent legal advice. A clause that tries to exclude all liability because a tool made the mistake is unlikely to survive that test, and it would sit badly with the professional bodies’ position that the member stays accountable. Our page on limiting liability in engagement letters covers caps and proportionate liability in more depth. Errors that do reach a claim fall to the firm’s professional indemnity cover, and specialist AI insurance for accountants looks at how policies treat AI assisted work.
What if a client says no to AI?
The PCRT guidance says the member should acknowledge the client’s request and may need to seek specialist advice. In practice the firm should decide whether it can deliver the service without the tool, whether that changes the fee or timetable, and record the agreed position in the letter or a variation to it.
| Clause element | What it says | Where the expectation comes from |
|---|---|---|
| Disclosure of AI use | The firm may use AI enabled software | PCRT AI topical guidance, January 2026 |
| Direct notice | Tell the client before work starts where AI is fundamental to the deliverable | PCRT AI topical guidance |
| Privacy information | Purposes, retention, recipients, transfers, automated decisions | ICO guidance on the right to be informed and on AI |
| Timing | Privacy notice sent with the engagement letter | CIOT, ATT, ACCA and AAT engagement letter guidance, March 2026 |
| Supplier terms | Approved tools under a processor contract | UK GDPR Article 28(3), ICO guidance |
| Liability cap | Must be fair and reasonable | Unfair Contract Terms Act 1977, sections 2 and 11 |
How does this work in practice?
Illustration only. A three partner firm starts using a subscription tool that reads bank statements and suggests bookkeeping codes. It adds a paragraph to its standard terms saying it may use AI enabled software for data extraction and drafting, that only approved tools under contract are used, and that a qualified member of staff reviews all output. Its privacy notice is updated to name the supplier as a recipient and to say data is stored in the UK. One client, a dental practice, asks that its patient related records are not processed by AI. The firm records that request in a short variation letter and agrees a slightly higher fee for manual processing.
Frequently asked questions
Do existing clients need a new engagement letter?
Not always. Many firms send a short notice of changes to terms with the updated privacy notice. If AI use changes the substance of the service or the fee, a fresh letter or signed variation gives clearer evidence of agreement.
Should the clause name the AI tools?
Naming every tool makes the letter go out of date quickly. Describe the types of use in the letter and keep the current list in a policy or privacy notice that you can update.
Does the clause reduce the firm’s responsibility for errors?
No. The PCRT guidance says members remain accountable for all work produced, whether or not AI was involved, and must apply professional judgement to AI outputs.
Should the firm keep records of AI use on a job?
The PCRT guidance suggests keeping an audit trail of the AI tools used, such as copies of prompts and the assumptions made, so the firm can answer later queries from the client or HMRC.
Using AI in your practice? Solar AI Cover brings professional indemnity, cyber and liability cover together for firms that use or build AI, and Solar Protect runs fee protection schemes for accountancy practices. See AI insurance for accountants or ask about a practice scheme.
Related cover: Professional indemnity insurance for accountants. Ask for a quote or call 01795 841 310.
Sources
- CIOT: Professional bodies issue ai advice to members
- www.att.org.uk: PCRT%20&%20ethical%20use%20of%20artificial%20intelligence%20tools%20%E
- ico.org.uk: How do we ensure transparency in ai
- ico.org.uk: What privacy information should we provide
- www.att.org.uk: 260223%20Engagement%20Letter%20Guidance%20FINAL%20CIOT.ATT .v2
- ico.org.uk: What needs to be included in the contract
- legislation.gov.uk: Act 1977 c. 50, section 2
- legislation.gov.uk: Act 1977 c. 50, section 11
Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 6 November 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.