AI tools earn their place in a practice on high volume tasks where the output can be checked quickly: coding bank transactions, extracting data from invoices and receipts, drafting routine letters, summarising meetings and giving a first pass at research. The risk sits where output reaches HMRC, Companies House or a client without a competent review. The controls that make AI safe to use are an approved tool list, rules on what data may go in, a processor contract and impact assessment, testing before reliance, review scaled to risk, and a record of how each tool was used.

Where does AI actually help in an accountancy practice?

The useful question is not whether to use AI but which tasks suit it. A practical way to decide is to list each candidate task with the main risk and the control that deals with it. This page covers that operational side; the professional duties behind it are set out in ethical use of AI tools in practice.

Task What the tool does Main risk Typical control
Bank transaction coding Suggests nominal codes and VAT treatment from history Repeated miscoding, wrong VAT Review of new and changed rules, VAT exception reports
Document extraction Reads purchase invoices, receipts and statements Misread dates, amounts or supplier Reconciliation to bank and supplier statements
Drafting First drafts of client emails, letters and reports Wrong facts or outdated rules Reviewer checks every figure and rule against source
Meeting notes Transcribes and summarises calls Omissions or mistakes in the record Attendee reviews notes before filing
Research Summarises rules and suggests references Invented cases or superseded law Confirm every reference in primary sources
Return preparation software Populates or checks returns Automated submission without review Review step that cannot be switched off

Bookkeeping automation is the most established of these and is covered in bank feeds and bank rules. Generative tools for drafting and research are newer and carry the hallucination risk the PCRT bodies’ guidance highlights, citing Harber v HMRC [2023] UKFTT 1007 (TC) as an example of why case law and legislation in AI output must be checked to confirm they exist.

What should a practice check before adopting a tool?

HMRC published guidance on 28 January 2026 setting out what it expects from commercial tax software that uses generative AI. It is written for developers, but it doubles as a procurement checklist for practices. HMRC expects such software to:

  • be transparent, so users can identify the source data, understand the model’s limitations and be aware of bias and hallucinations;
  • draw on reliable sources such as official HMRC publications, legislation and established case law, with testing, version control and timely updates as rules change;
  • be designed with human oversight, supporting rather than replacing human judgement, flagging complex areas and reminding users that they are responsible for the accuracy of their returns;
  • include strong data security and privacy measures and comply with UK GDPR;
  • be ethical, fair and accountable.

HMRC also says it does not endorse or approve any software product. A supplier that cannot explain how its tool meets these expectations is a poor choice for tax work. Ask in writing where data is processed and stored, how long prompts and documents are retained, whether they are used to train the model, and who at the supplier can see them.

Data protection steps follow. Where the supplier processes client personal data for the firm, Article 28 of UK GDPR requires a written processor contract. The ICO’s guidance on AI says that in the vast majority of cases using AI will involve processing likely to result in a high risk to individuals, triggering the legal requirement for a data protection impact assessment, and that a firm deciding otherwise must document how it reached that view. See data protection for accountancy practices.

What data rules should staff follow?

The PCRT bodies’ topical guidance on AI says that inputting client data into publicly available AI tools is likely to constitute a breach of client confidentiality unless the client has consented, and notes that some firms have set up internal, ring fenced tools with strict controls over client data. A short written policy should translate that into rules staff can apply without judgement calls:

  • a list of approved tools, separating those under a firm contract from public tools;
  • no names, addresses, tax references, bank details or identifying facts in any public tool;
  • client documents only in tools covered by a processor contract and impact assessment;
  • personal accounts on AI services not to be used for firm work;
  • a named person who approves new tools and new uses.

AI tools are also a new route for data to leak, so they belong in the firm’s wider cyber security controls.

How much review does AI output need?

The PCRT guidance says AI output should be regarded as if it were prepared by a less experienced junior colleague and reviewed with appropriate scepticism. Review should be scaled to consequence. Internal working notes need light review. Anything sent to a client needs the same review as a junior’s draft. Anything filed with HMRC or Companies House needs the full normal review and evidenced client approval.

Automation can remove review by accident. The guidance gives the example of tax return software that can be configured to make human review optional, and says the firm should understand which workflows are automated and make sure the data and submission can be reviewed. HMRC’s Standard for Agents separately expects agents to take reasonable steps to make sure third party input, including software, provides accurate results.

How should a tool be tested before the firm relies on it?

Run the tool on completed jobs where the right answer is already known, and measure how often it is wrong and in what way. A coding tool that is right most of the time but consistently misclassifies capital items or VAT exempt supplies may still be useful, if reviewers know where to look. Repeat the test when the supplier releases a new version; the PCRT guidance specifically discusses caution before moving to an updated tool until it has been shown to perform at least as well.

Audit work has its own framework. The FRC published guidance on 30 March 2026 for audit firms using generative and agentic AI tools, stating that regulatory accountability for audit quality is unchanged and that firms should consider how AI use fits within their quality management obligations under ISQM (UK) 1.

What records should the firm keep?

The PCRT guidance suggests that staff tell senior colleagues when they have used AI, that the firm keeps an audit trail of the tools used, and that copies of relevant web pages and screenshots of prompts are retained where appropriate. It also suggests a statement in the engagement letter that AI enabled software may be used. Keeping the policy, the tool register, impact assessments and test results together gives a reviewer or insurer a clear picture of how the firm manages the risk.

How might a firm introduce AI coding?

Illustration only. A practice wants AI coding for 40 bookkeeping clients. It runs the tool on six months of already reconciled transactions for five clients and finds that 3% of suggestions are wrong, mostly on mixed VAT supplies. It approves the tool for those clients with a weekly exception review of new suppliers and any VAT code other than standard rate, signs the supplier’s processor terms, records an impact assessment and adds the tool to its register. Three months later it reruns the test on the new version before switching.

What mistakes do practices make?

  • Allowing staff to choose their own tools, so client data ends up in personal accounts.
  • Assuming a supplier’s AI feature is accurate because the software is recognised by HMRC.
  • Removing a review step because the tool is usually right.
  • Skipping the impact assessment and processor contract.
  • Never retesting after a model or software update.

Solar Protect runs fee protection schemes for accountancy and bookkeeping practices. See how our accountant schemes work or read fee protection schemes for accountants.

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 8 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.