# Free AI Compliance Checklist for Accountants · Ops Intel > A free AI compliance checklist for UK accountants. Your obligations under the Data (Use and Access) Act 2025, GDPR and the EU AI Act, in plain English. Source: https://www.opsintel.io/resources/ai-compliance-guide-accountants/ Free Resource · Accountants & Accountancy Firms # AI Compliance for Accountants 2026 Readiness Checklist The Data (Use and Access) Act 2025 is in force. GDPR still applies. The EU AI Act high-risk provisions arrive in December 2027. Use this guide to assess your practice, identify which tools expose you, and copy a ready-made policy statement. Start the Checklist → Get a Free Assessment In this guide: ✓ 10-point compliance checklist ✓ AI tool risk table (8 tools rated) ✓ Copyable policy statement ✓ Penalty reference Why this matters now Most accountancy practices have adopted at least one AI tool — ChatGPT, Copilot, or an AI feature inside their existing software. Under UK GDPR, the Data (Use and Access) Act 2025, and (from December 2027) the EU AI Act's high-risk provisions, using those tools without proper controls is a compliance failure. ICO enforcement action is increasing. The maximum GDPR fine is £17.5 million or 4% of global turnover — whichever is higher. ## 10-Point Compliance Checklist Tick each item your practice has addressed. Your progress updates automatically. Your progress 0 of 10 complete 1. AI Use Policy documented in writing Your practice has a written policy listing approved AI tools, who may use them, and under what conditions. Verbal rules are not sufficient. 2. Staff know which tools are approved — and which are not Staff have received written guidance. "Don't use ChatGPT" is not enough — the policy must name tools and explain why each is or isn't approved. 3. Client personal data is NOT entered into unapproved AI tools Names, addresses, UTRs, NINOs, financial records — none of this enters a consumer-grade AI tool (ChatGPT free tier, etc.) without a compliant Data Processing Agreement. 4. Data Processing Agreements signed with all AI vendors Under UK GDPR Article 28, any third party processing personal data on your behalf requires a DPA. This includes cloud AI providers — even those bundled inside your existing software. 5. AI assistance disclosed to clients where material Where AI meaningfully shaped a report, advice note, or letter, clients have been informed. This is an emerging professional obligation under ICAEW guidance and FRC audit standards. 6. AI outputs reviewed and validated before submission A qualified accountant reviews and takes professional responsibility for any AI-assisted tax advice, accounts preparation, or correspondence before it leaves the firm. 7. ICO registration reviewed since AI tools were adopted Your Data Protection Register entry and ICO registration are up to date. Introducing AI tools that process client data changes your processing activities and may require a DPIA. 8. Subject Access Request process covers AI-processed data If a client makes a SAR, your process can identify and retrieve data that has been processed by or through AI tools, including prompts and outputs stored in those systems. 9. Data breach procedure covers AI system failures Your breach response plan addresses scenarios specific to AI — accidental PII ingestion, model data leakage, and vendor breaches. Breach notification to ICO is required within 72 hours. 10. Annual AI compliance review scheduled A calendar date exists to review AI tool use, update the policy, and re-assess risk. Regulations are evolving quickly — annual review is the minimum. Many firms are moving to quarterly. ## AI Tool Risk Assessment Common tools used in accountancy practices — rated by compliance risk under UK GDPR and the Data (Use and Access) Act 2025. All High Risk Medium Risk Lower Risk | Tool | Risk Level | Key Concern | Minimum Requirement | | --- | --- | --- | --- | | ChatGPT (free/Plus) | HIGH | Data sent to US servers; no DPA for free/Plus tier; OpenAI may use inputs for training by default. | Never input client PII. Use Enterprise tier only if required, with DPA signed. | | Voice-to-text tools (Otter.ai, Whisper) | HIGH | Audio recordings of client meetings contain highly sensitive data. Most consumer transcription tools have no DPA. | Obtain explicit client consent before recording. Only use tools with signed DPAs and EU/UK data residency. | | Microsoft Copilot for M365 | MEDIUM | DPA via M365 agreement — but data residency depends on your tenant configuration. Verify your region settings. | Confirm EU/UK data residency in M365 admin. Update your privacy notice to reference Copilot processing. | | Xero AI features | MEDIUM | Xero holds a DPA (GDPR Article 28 compliant), but AI features process financial data in the cloud. Review Xero's current DPA for AI-specific provisions. | Confirm your Xero DPA covers AI features. Add Xero to your data processing register. | | QuickBooks AI / Intuit Assist | MEDIUM | Intuit DPA available; US-based processing. Under Schrems II / UK IDTA, international transfer mechanism must be in place. | Verify Intuit's UK IDTA or adequacy decision applies. Document the transfer in your data register. | | Google Workspace AI (Gemini) | MEDIUM | DPA via Google Workspace agreement. AI features need to be explicitly configured — review admin settings for data usage options. | Disable AI training on your data in admin console. Confirm EU data residency configuration. | | IRIS Elements / CCH Central | LOWER | Purpose-built for UK accountancy, UK-based data centres, existing DPAs. AI features being rolled out — review each release's data handling notes. | Review DPA when new AI features are enabled. Keep your data register entry current. | | Grammarly | LOWER | Low risk for general drafting. Risk increases if staff use it to draft client-facing communications containing PII. | Staff policy: do not paste client names, financial figures, or reference numbers into Grammarly. Business plan DPA available. | ## Copyable Policy Statement Copy this into your employee handbook or client engagement letters. Customise the bracketed fields. This is a starting point — not legal advice. ``` [Practice Name] AI Use Policy — Effective [Date] [Practice Name] operates an AI Use Policy in accordance with UK GDPR, the Data (Use and Access) Act 2025, and ICAEW professional obligations. APPROVED TOOLS: Only the following AI tools may be used in client-related work: [list approved tools]. Use of any other AI tool for client work requires prior written approval from [Practice Manager / Partner]. DATA RESTRICTIONS: No client personal data — including names, addresses, UTRs, National Insurance numbers, financial records, or correspondence — may be entered into a third-party AI tool that does not have a signed Data Processing Agreement with this practice. DISCLOSURE: Where AI tools have materially assisted in preparing advice, reports, or correspondence for a client, this will be disclosed in writing to that client. VALIDATION: All AI-generated output must be reviewed and approved by a qualified [accountant / ACA / ACCA] before it is shared with a client, submitted to HMRC, or filed with any regulatory body. BREACH: Any suspected breach of this policy, including accidental input of client PII into an unapproved tool, must be reported to [DPO / Practice Manager] within 24 hours. Policy reviewed: [Date] | Next review: [Date + 12 months] ``` Copy ## Penalty Reference UK GDPR / Data (Use and Access) Act 2025 £17.5m Or 4% of global annual turnover — whichever is higher. ICO enforcement is increasing year-on-year. EU AI Act (High Risk — December 2027) €15m Or 3% of global annual turnover. Applies to AI systems serving EU clients, regardless of where your firm is based. ICAEW / Professional Standards Suspension Regulatory sanctions including practice certificate suspension can follow a material breach of professional obligations related to AI use. ## Not sure where your practice stands? Get a free AI compliance assessment. We'll review your tool stack, identify your highest-risk exposures, and tell you exactly what to fix — at no cost. Thanks — we'll be in touch within one business day. No spam. We'll contact you once. Unsubscribe any time. ✕ Assessment requested ## Thanks — that's with us. We'll review your tool stack, pick out where you are most exposed, and come back within one business day. Nothing to pay and nothing to install. Start the free check now → Close