AI Compliance for Accountants
2026 Readiness Checklist

1. AI Use Policy documented in writing Your practice has a written policy listing approved AI tools, who may use them, and under what conditions. Verbal rules are not sufficient.

2. Staff know which tools are approved — and which are not Staff have received written guidance. "Don't use ChatGPT" is not enough — the policy must name tools and explain why each is or isn't approved.

3. Client personal data is NOT entered into unapproved AI tools Names, addresses, UTRs, NINOs, financial records — none of this enters a consumer-grade AI tool (ChatGPT free tier, etc.) without a compliant Data Processing Agreement.

4. Data Processing Agreements signed with all AI vendors Under UK GDPR Article 28, any third party processing personal data on your behalf requires a DPA. This includes cloud AI providers — even those bundled inside your existing software.

5. AI assistance disclosed to clients where material Where AI meaningfully shaped a report, advice note, or letter, clients have been informed. This is an emerging professional obligation under ICAEW guidance and FRC audit standards.

6. AI outputs reviewed and validated before submission A qualified accountant reviews and takes professional responsibility for any AI-assisted tax advice, accounts preparation, or correspondence before it leaves the firm.

7. ICO registration reviewed since AI tools were adopted Your Data Protection Register entry and ICO registration are up to date. Introducing AI tools that process client data changes your processing activities and may require a DPIA.

8. Subject Access Request process covers AI-processed data If a client makes a SAR, your process can identify and retrieve data that has been processed by or through AI tools, including prompts and outputs stored in those systems.

9. Data breach procedure covers AI system failures Your breach response plan addresses scenarios specific to AI — accidental PII ingestion, model data leakage, and vendor breaches. Breach notification to ICO is required within 72 hours.

10. Annual AI compliance review scheduled A calendar date exists to review AI tool use, update the policy, and re-assess risk. Regulations are evolving quickly — annual review is the minimum. Many firms are moving to quarterly.

All High Risk Medium Risk Lower Risk

Tool	Risk Level	Key Concern	Minimum Requirement
ChatGPT (free/Plus)	HIGH	Data sent to US servers; no DPA for free/Plus tier; OpenAI may use inputs for training by default.	Never input client PII. Use Enterprise tier only if required, with DPA signed.
Voice-to-text tools (Otter.ai, Whisper)	HIGH	Audio recordings of client meetings contain highly sensitive data. Most consumer transcription tools have no DPA.	Obtain explicit client consent before recording. Only use tools with signed DPAs and EU/UK data residency.
Microsoft Copilot for M365	MEDIUM	DPA via M365 agreement — but data residency depends on your tenant configuration. Verify your region settings.	Confirm EU/UK data residency in M365 admin. Update your privacy notice to reference Copilot processing.
Xero AI features	MEDIUM	Xero holds a DPA (GDPR Article 28 compliant), but AI features process financial data in the cloud. Review Xero's current DPA for AI-specific provisions.	Confirm your Xero DPA covers AI features. Add Xero to your data processing register.
QuickBooks AI / Intuit Assist	MEDIUM	Intuit DPA available; US-based processing. Under Schrems II / UK IDTA, international transfer mechanism must be in place.	Verify Intuit's UK IDTA or adequacy decision applies. Document the transfer in your data register.
Google Workspace AI (Gemini)	MEDIUM	DPA via Google Workspace agreement. AI features need to be explicitly configured — review admin settings for data usage options.	Disable AI training on your data in admin console. Confirm EU data residency configuration.
IRIS Elements / CCH Central	LOWER	Purpose-built for UK accountancy, UK-based data centres, existing DPAs. AI features being rolled out — review each release's data handling notes.	Review DPA when new AI features are enabled. Keep your data register entry current.
Grammarly	LOWER	Low risk for general drafting. Risk increases if staff use it to draft client-facing communications containing PII.	Staff policy: do not paste client names, financial figures, or reference numbers into Grammarly. Business plan DPA available.

[Practice Name] AI Use Policy — Effective [Date]

[Practice Name] operates an AI Use Policy in accordance with UK GDPR, the Data (Use and Access) Act 2026, and ICAEW professional obligations.

APPROVED TOOLS: Only the following AI tools may be used in client-related work: [list approved tools]. Use of any other AI tool for client work requires prior written approval from [Practice Manager / Partner].

DATA RESTRICTIONS: No client personal data — including names, addresses, UTRs, National Insurance numbers, financial records, or correspondence — may be entered into a third-party AI tool that does not have a signed Data Processing Agreement with this practice.

DISCLOSURE: Where AI tools have materially assisted in preparing advice, reports, or correspondence for a client, this will be disclosed in writing to that client.

VALIDATION: All AI-generated output must be reviewed and approved by a qualified [accountant / ACA / ACCA] before it is shared with a client, submitted to HMRC, or filed with any regulatory body.

BREACH: Any suspected breach of this policy, including accidental input of client PII into an unapproved tool, must be reported to [DPO / Practice Manager] within 24 hours.

Policy reviewed: [Date] | Next review: [Date + 12 months]

Copy

Not sure where your practice stands?

Get a free AI compliance assessment. We'll review your tool stack, identify your highest-risk exposures, and tell you exactly what to fix — at no cost.

Claim Your Free Assessment →

Thanks — we'll be in touch within one business day.

No spam. We'll contact you once. Unsubscribe any time.