AI policy for an accountancy practice

Q: What does this look like in a small firm?

Illustration only. A twelve person practice finds that four staff use a free chatbot to draft client emails. The managing partner approves one business AI tool under a processor contract with UK data storage, runs a DPIA, and adds it to a tools register. The policy bans client names and figures in any other tool, requires a manager to read every AI drafted letter before it goes out, and sets a 30 minute training session for all staff with a signed acknowledgement. Six months later the firm reviews the register, removes one unused tool and updates the privacy notice.

A practice AI policy should list the tools staff may use, set firm rules on what client data can go into them, require a qualified person to review every output, make training compulsory and keep a record of AI use. ICO guidance treats most AI use of personal data as high risk and expects senior people to own it, and the NCSC warns that staff will use unapproved tools if the firm gives them nothing better.

Tax investigation insurance from £108.75 a year (£9.06 a month).Pays up to £100,000 of your accountant's fees if HMRC opens an enquiry. No excess. Buy online in a few minutes.

See my price in 2 questions How the cover works Accountant? Offer cover to your clients or call 01795 841 310

Why does an accountancy practice need an AI policy?

Staff are already using AI. In September 2026 the NCSC described shadow AI as the use of AI technology which is not captured in an organisation’s approved systems and processes, and cited research in which 71% of employees reported using AI tools their employer had not approved. Its point is simple: you cannot manage what you do not know about.

The professional bodies also expect a policy. The PCRT topical guidance on AI, issued in January 2026 by AAT, ACCA, ATT, CIOT, ICAEW, ICAS and STEP, says an AI usage policy can help a firm manage how staff use AI and what is disclosed to clients. ACCA’s practice guidance says a policy should clearly set out how AI can be used within your workplace and the expectations of staff when using it. This page covers the internal rulebook; the ethical principles behind it are on our page on the ethics of AI use in practice.

Which AI tools should staff be allowed to use?

Start with an approved list. An ACCA technical alert giving pointers for a firm’s AI policy (01/2025, February 2025) suggests that only tools and models approved by IT are used, that staff request approval for each tool before use, and that the security of a tool is evaluated before it is used. It also suggests banning the use of personal or third party devices for work purposes.

In a small practice the approver may be a partner, but the principle holds: one named person signs off each tool after checking where data is stored, whether inputs train the supplier’s model, and what the contract says. The NCSC’s guidance for leaders asks whether you understand your data, model and software supply chains, and the ICO says that where clients use a cloud AI service, the clients will be controllers and the provider is likely to be a processor. That means a written processor contract is needed before client personal data goes in.

Run an accountancy or bookkeeping practice? Solar Protect runs fee protection schemes for practices, so the cost of dealing with an HMRC enquiry into a client is covered rather than written off.

See how our accountant schemes work or call 01795 841 310.

What should the policy say about client data?

This is the core of the policy. The NCSC recommends not including sensitive information in queries to public large language models, because the query will be visible to the organisation providing the service and stored queries will almost certainly be used to develop the service at some point. The PCRT guidance says putting client data into publicly available AI tools is likely to breach client confidentiality unless the client has consented, and that anything used in public tools should be anonymised so the client cannot be identified indirectly.

A practical rule set is:

no client data in any tool that is not on the approved list;
approved tools only for the data categories each one is cleared for;
anonymise before using any general purpose tool, and remember that a unique set of figures or a rare business can identify a client on its own;
no uploads of identity documents or anti money laundering evidence unless a tool is specifically approved for that.

More detail is in our pages on AI tools and client data and international transfers of client data, which applies where a supplier hosts data abroad.

Do you need a DPIA before introducing AI?

The ICO’s guidance on AI says that in the vast majority of cases the use of AI will involve a type of processing likely to result in a high risk, which means a data protection impact assessment will usually be required. Where you decide a use is not high risk, the ICO still expects you to record how you reached that conclusion. It also says senior management, including any data protection officer, are accountable for understanding and addressing AI risks and that these issues cannot be delegated to data scientists or engineering teams.

In a practice, that means the policy should name a partner as the owner of AI risk. See data protection impact assessments for how to run one.

How should AI output be reviewed?

The PCRT guidance says AI output should be treated with professional scepticism, as if a less experienced junior colleague had produced it. It warns that tools can produce content that does not exist, so any case law or legislation cited should be checked, and outputs should be reviewed before they go to clients or HMRC. The ACCA alert says human judgement must be applied to AI output and that there should always be a human in the loop for critical decisions.

The NCSC adds security reasons for review. Its guidance for leaders explains prompt injection, where an attacker creates an input designed to make a model behave in an unintended way, and data poisoning, where training data is tampered with. A client document could carry hidden instructions, so reviewers check for manipulation as well as mistakes. Errors that get through review are a professional indemnity question, which our page on AI insurance for accountants covers.

What training should staff get?

The ACCA alert says firms must provide staff training on responsible AI use and that every staff member should be required to sign up to the policy. ACCA’s practice guidance suggests running training once the policy is rolled out and building it into onboarding for new starters. The ICO’s accountability framework, which sets out good practice rather than law, suggests induction training for all staff before they access personal information and within one month of their start date, refresher training at set intervals, and records of who completed which training.

What records should the practice keep?

Keep three kinds of record:

a register of approved tools, showing who approved each one, the data it may receive and the date of the last review;
an update to the firm’s record of processing, which the ICO says covers purposes, categories of data and individuals, recipients, transfers, retention and a general description of security measures;
job level notes of AI use, since the PCRT guidance suggests an audit trail recording the tools used, prompts and the assumptions made.

Policy section	What it should cover	Guidance it draws on
Scope and ownership	Who the policy applies to and the partner who owns it	ICO AI guidance on senior management accountability
Approved tools	List, approval process, security check, no personal devices	ACCA Technical Alert 01/2025
Client data	No sensitive data in public tools, anonymisation, processor contracts	NCSC, PCRT AI guidance, ICO
Risk assessment	DPIA before new AI processing of personal data	ICO guidance on AI and data protection
Review of output	Qualified human review before use, check citations	PCRT AI guidance, ACCA alert
Training	On roll out, at induction and at intervals, with records	ACCA, ICO accountability framework
Records and review	Tool register, record of processing, job notes, policy updates	ICO, PCRT AI guidance, ACCA
Incidents	How to report misuse or a data leak, and who decides next steps	ACCA alert, NCSC

How often should the policy be reviewed?

ACCA suggests making one function responsible for reviewing and updating the policy and updating it when there are significant changes in how AI is used, such as a new tool. The ACCA alert also says use should be monitored with regular audits and that there should be a way to report incidents. Read the AI policy alongside the firm’s data protection and cyber security policies so they do not contradict each other, and make sure the client facing wording in your engagement letter AI clause matches what the policy allows.

What does this look like in a small firm?

Illustration only. A twelve person practice finds that four staff use a free chatbot to draft client emails. The managing partner approves one business AI tool under a processor contract with UK data storage, runs a DPIA, and adds it to a tools register. The policy bans client names and figures in any other tool, requires a manager to read every AI drafted letter before it goes out, and sets a 30 minute training session for all staff with a signed acknowledgement. Six months later the firm reviews the register, removes one unused tool and updates the privacy notice.

Frequently asked questions

Can a sole practitioner skip a written AI policy?

No law requires a document with that title, but a one page written policy is the easiest way to show the ICO, a professional body or an insurer that AI use was thought through.

Should the policy ban AI outright?

The NCSC is clear that it is not recommending people stop using AI and that organisations should provide secure alternatives, because bans tend to push staff towards unapproved tools.

Who should own the policy?

A partner or director. The ICO says senior management are accountable for AI risk and that it cannot be left to technical staff.

Does the policy need to be shared with clients?

Not in full, but the PCRT guidance suggests firms may point clients to a data handling or AI usage policy on their website, so a short public summary is worth publishing. Our page on data protection for accountancy practices covers the privacy notice that should sit alongside it.

Using AI in your practice? Solar AI Cover brings professional indemnity, cyber and liability cover together for firms that use or build AI, and Solar Protect runs fee protection schemes for accountancy practices. See AI insurance for accountants or ask about a practice scheme.

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 6 November 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.