AI Insurance for Accountants: PI, Cyber and AI Tools

Accountants who use AI for bookkeeping, drafting advice or returns, or answering clients stay fully responsible for the work, so an AI error becomes the firm’s professional indemnity claim and an AI data leak becomes the firm’s data breach. The safest position is a PI and cyber programme whose policy wording names the AI work you actually do, alongside the minimum cover your professional body requires.

Building or selling AI?Solar AI Cover brings PI, cyber and liability together. Tell us about your business and a broker will come back to you.

Get an AI Cover quote About Solar AI Cover or call 01795 841 310

Does using AI change an accounting practice’s professional liability?

It changes how errors happen, not who is responsible for them. If an AI tool miscodes a set of bank transactions, drafts a tax computation with a wrong assumption or produces an advice letter that cites a relief the client cannot use, the client will look to the firm that signed off the work.

The common uses we see in practices are:

bookkeeping automation that reads receipts and categorises bank feeds;
generative AI used to draft emails, advice letters, management reports and first drafts of returns;
client facing chatbots on websites or portals that answer routine questions;
AI features built into practice software for tax, payroll, audit sampling and document review.

Each of these speeds up work and each can repeat a mistake across many clients before anyone notices. A single faulty rule in an automated workflow can affect every client file it touches, which is a different risk profile from one person making one error. For the basics of the cover itself, see our guide to professional indemnity insurance for accountants.

What do ICAEW and ACCA say about using AI?

The seven professional bodies that jointly prepare Professional Conduct in Relation to Taxation (PCRT), which include ICAEW and ACCA, have issued topical guidance on applying the PCRT fundamental principles when members use AI tools for tax work. The version published by ACCA is dated 19 January 2026. Its main points are direct:

Members are ultimately responsible for any work they produce, including work an AI tool helped to produce or refine.
AI output should be treated as if it were prepared by a less experienced junior colleague, so it needs reviewing, and any cited case law or legislation should be checked to confirm it exists.
Putting client data into publicly available AI tools is likely to breach client confidentiality.
Firms should consider a statement in the engagement letter that specifies the potential use of AI tools.

Although written for tax work, the same reasoning applies to bookkeeping, payroll and advisory work.

Get your AI work named in your policy

Tell us what your business does with AI, where you are based, your turnover and the limit you want, and we will look at Solar AI Cover for you. Cover is subject to underwriting and policy terms. Call 01795 841 310 or send us your details and we will come back to you.

Ask for a quote

What are your UK GDPR duties when client data goes into an AI tool?

Accountants hold a great deal of personal data: payroll records, bank statements, National Insurance numbers, family circumstances behind tax planning. Using AI does not change the core duties under UK GDPR and the Data Protection Act 2018, but the ICO is clear that it raises the stakes.

Impact assessments. The ICO says that in the vast majority of cases, using AI will involve processing likely to result in a high risk, which triggers the legal requirement for a data protection impact assessment.
Supplier responsibility. The ICO states that procuring an AI system from a third party does not absolve you of responsibility for complying with data protection law, and that you are likely to be the controller.
Processor contracts. Article 28 of UK GDPR says a controller may only use processors that provide sufficient guarantees of appropriate technical and organisational measures, and the processing must be governed by a contract. Check the terms of any AI tool before client data goes into it.
Lawful basis and transparency. You need a lawful basis to process personal data whether AI is involved or not, and your privacy notice should tell clients how their data is used.
Breaches. A notifiable personal data breach must be reported to the ICO without undue delay and not later than 72 hours after becoming aware of it, and every breach must be recorded, even ones you do not report.

How do professional indemnity and cyber policies respond to AI related claims?

The two policies do different jobs, and AI incidents often involve both.

Situation	Policy that usually responds	What to check
Client sues over wrong advice or a wrong return drafted with AI	Professional indemnity	That the professional services definition covers the work as you now deliver it
Client data exposed through an AI tool or a hacked portal	Cyber	Breach response, notification, forensic and regulatory investigation costs
Chatbot on your website gives a client wrong information	Professional indemnity, possibly cyber	Whether advice given by an automated tool falls within the insured services
Practice systems down after a cyber attack on a software supplier	Cyber	Business interruption cover and how dependent system failures are treated

Professional indemnity insurance responds to claims that the firm breached its professional duty. It generally follows the work you are insured to do, rather than the tools you use. The difficulty comes when your AI use starts to look like a different business: building and selling a bookkeeping tool to clients, licensing a chatbot, or providing software rather than advice. That activity may not sit within an accountancy PI wording. Our guide to cyber insurance explains the first party and third party sections of a cyber policy.

Why does naming your AI work in the policy help?

Many older PI and cyber wordings were written before AI tools were common. They neither include nor exclude AI; the market calls this silent AI. When a claim arrives, the insurer reads the business description on your proposal and the definition of professional services in the policy, and asks whether the AI work was disclosed and falls within them.

Naming the AI work removes that argument before it starts. A policy that describes the practice as providing accountancy, bookkeeping and tax services, including the use of named AI tools for drafting and data processing, leaves far less room for dispute than one that says only “accountants”. Our page on whether business insurance covers AI sets out the questions to ask about your current policies.

What do the professional body PII rules require?

Firms regulated by a professional body must hold PII that meets that body’s rules, whatever tools they use. Under the ICAEW Professional Indemnity Insurance Regulations:

the minimum limit of indemnity is at least £2 million for any single claim and in the aggregate;
where gross fee income is less than £800,000, the minimum limit is two and a half times gross fee income, with a minimum of £250,000;
the cover must be qualifying insurance, underwritten by participating insurers on the minimum wording approved by ICAEW;
when a practice ceases, appropriate cover must be in place for at least two years after cessation.

The regulations do not require firms to carry more than £2 million. These are minimums. When choosing a limit, think about the largest client engagement you have, how many clients an automated process touches, and whether one systemic AI error could produce many claims in the same policy year. Other bodies set their own rules; our accountants insurance page covers the detail by body.

What could an AI related claim against a practice look like?

Example. A practice with two partners and eight staff uses an AI assistant to produce first drafts of advice letters and an automated tool to categorise bank feeds for its bookkeeping clients. A junior asks the assistant whether a client’s home office costs can be claimed through the company. The draft cites a relief that does not apply to the client’s circumstances, the review is rushed in January, and the letter goes out. Two years later HMRC opens an enquiry and the client pays tax, interest and penalties, then claims against the practice for the cost of following the advice.

The PI policy is the one that responds to the client’s claim, subject to its terms. If the business description named AI assisted drafting, there is no debate about whether the work was disclosed. In the same month, a member of staff uploads a client’s payroll export to a free online tool to reformat it. The practice has to decide within 72 hours whether to report to the ICO, notify the affected employees and pay for advice on what happened. That is cyber cover territory, not PI.

Where do accountants commonly leave gaps?

Out of date business descriptions. The proposal still describes the practice as it was five years ago, with no mention of AI, client portals or chatbots.
No cyber policy. Some firms assume PI covers data breaches. PI deals with negligence claims; breach response costs and regulatory investigations usually need cyber cover.
Unreviewed engagement letters. The terms do not mention AI tools, even though professional body guidance suggests they should.
Shadow AI. Staff use free tools the partners do not know about, so no one has checked the supplier contract or done an impact assessment.
Selling technology. A practice builds a tool and offers it to clients or other firms, which is a software business sitting under an accountancy policy.
US clients and data. Work for clients with US operations, or tools hosted in the US, raises jurisdiction questions that standard UK wordings may not answer.

How does Solar AI Cover fit an accountancy practice?

Solar AI Cover is a scheme Solar Protect arranges with an insurer. The policy names the business’s specific AI work as insured activity, rather than leaving AI unmentioned. Cover options include professional indemnity, cyber, product and public liability, and IP infringement, and several of these exposures can sit in one policy. Cover for US exposure is available, subject to underwriting and the policy terms.

For most practices, the professional body compliant PI policy remains the base. Solar AI Cover is most relevant where the firm’s AI use goes beyond ordinary drafting, such as practices that build tools, run client facing chatbots or offer automated services to other businesses. We will look at both and look for cover that fits. To quote we need what the practice does, including the AI work, its address, turnover and the limit required. All cover is subject to the insurer’s underwriting and the policy terms. For a wider view of AI and PI, read our guide to AI professional indemnity insurance, or contact us to talk it through.

Frequently asked questions

Is an accountant liable for a mistake made by AI software?

Yes, in practice. Professional body guidance says members are ultimately responsible for any work they produce, and the client’s contract is with the firm. The firm may have rights against the software supplier, but the client’s claim comes to you.

Do I need to tell clients I use AI?

PCRT topical guidance suggests firms consider a statement in the engagement letter about the potential use of AI tools. Data protection law also requires you to be open with people about how their personal data is used.

Will my existing accountants PI policy cover AI assisted work?

It often responds to errors in your normal services, whatever tools you used, but it depends on the wording and on what you disclosed. Check that the business description reflects how you work now, and tell your broker about any AI tools or services you offer to clients.

Does PI cover a data breach caused by an AI tool?

PI responds to claims of professional negligence. Breach response costs, notification and regulatory investigations are usually the job of a cyber policy, so most practices need both.

Is a data protection impact assessment needed before using AI?

The ICO says that in the vast majority of cases AI use involves processing likely to result in a high risk, which triggers the legal requirement for an impact assessment. Do it before client data goes into the tool.

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 31 October 2026. Solar Protect is the trading name of Solar Insurance Services (Medway) Limited, authorised and regulated by the Financial Conduct Authority. This page is general information, not advice on your own cover.

AI Insurance for Accountants: PI, Cyber and Data Risks