AI use policy for an accountancy or bookkeeping practice

Accountants and bookkeepers use AI tools to categorise transactions, draft advice, summarise legislation, reconcile accounts and answer client queries, in a profession where the practice signs what it produces, owes duties to a professional body, holds clients' financial affairs in confidence and has anti-money laundering obligations that AI tools can both help and compromise. The policy sets which tools the practice uses on which data, how outputs are checked before they carry the practice's name, how the professional and statutory obligations are met, and what clients are told, with engagement terms to match. Drafting for the business, I deliver the AI use policy and its accompanying contract provisions in five working days for a fixed £995.

Who this is for

Accountancy practices, tax advisers, bookkeepers and outsourced finance providers in England and Wales, whether regulated by a professional body or supervised for anti-money laundering purposes by HMRC.

What matters in an accountancy practice's AI use policy

The professional body, the standards and the policy they expect

The accountancy bodies have each issued guidance on the use of AI by members, which expects a firm to have a policy, to understand the tools it uses, to retain responsibility for the work and to be able to explain its use to a client or the body; the policy drafted for the practice is written to the practice's own body's guidance and to the fundamental principles of the code of ethics (integrity, objectivity, professional competence and due care, confidentiality, professional behaviour), so that a member asked by the body what the firm's position is can produce the document rather than describe a practice.

Clients' financial data and the tools it may enter

confidential information, trade secrets and clients' data must not be entered into tools whose terms permit the provider to use inputs for training or to retain them, which the Trade Secrets (Enforcement, etc.) Regulations 2018 and the business's own confidentiality obligations make a question of reasonable steps; a client's accounts, bank transactions, payroll, tax computations and correspondence are confidential under the code of ethics and under the engagement, the practice's cloud accounting platform's own AI features operate under the platform's terms (which the practice should have read for what they permit), and the policy distinguishes the AI features inside the practice's accounting and tax software (approved, under the software's data processing terms) from general-purpose tools (approved on business accounts for stated uses with no client-identifying data, or with it where the tool's terms are adequate) from consumer tools (not for client data at all).

Accuracy, judgement and the advice the practice signs

An AI tool summarising tax legislation, drafting advice or computing a liability produces output the practice signs and is liable for, in negligence and under the engagement, and the tool's confident error (a repealed relief, a threshold from another year) is the practice's error once sent; the policy requires every output used in client work to be checked against the primary source (the legislation, HMRC's manuals and guidance, the standards) by a person competent to check it, requires professional judgement on the client's circumstances to be the practice's and not the tool's, prohibits generated advice going to a client without the reviewer's sign-off, and sets the file note that records the tool used and the check done, which is what the professional indemnity insurer and the body ask for after a claim.

Anti-money laundering, confidentiality and the disclosures the law requires

A practice supervised under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 may use AI tools for client due diligence, transaction monitoring and risk assessment, provided the practice understands the tool's limits and retains the judgement the regulations require, and the policy addresses the point at which a tool's output raises a suspicion (which triggers the reporting obligations under the Proceeds of Crime Act 2002 and the prohibition on tipping off, so that a suspicion must not be entered into a tool whose provider or whose other users could see it); any personal data that goes into an AI tool is being processed under the UK GDPR, which calls for a lawful basis, transparency to the individuals, an Article 28 agreement with the provider and an Article 35 impact assessment where the use bears on people, and the clients' principals, employees and customers whose data appears in the records are the individuals concerned.

Engagement letters, clients and the question they will ask

Clients ask whether the practice uses AI on their affairs, some clients' own policies or regulators restrict it, and the engagement terms should say what the practice does (the tools used as a category, the human review applied, the confidentiality maintained, the client data never entered into consumer tools) so that the client has agreed to it rather than discovered it; the contract provisions drafted with the policy go into the engagement letter and the practice's standard terms, cover the client's own use of AI tools on the practice's advice (which the practice does not warrant once altered), and address the position where a client supplies generated records or computations the practice is asked to rely on, which the practice checks as it would any client-prepared material.

Staff, supervision and the contract provisions that go with the policy

The policy is issued to every member of staff and trainee with training recorded, incorporated into the handbook with breach a disciplinary matter, applied to subcontractors and outsourced providers through their contracts (an offshore processing centre using unapproved tools on client data is the practice's breach), reviewed annually and when the body's guidance changes, and supported by the practice's list of approved tools and the record of their terms; the provisions drafted with the policy also cover the practice's supplier contracts with tool providers (training on inputs excluded, retention limited, the data processing agreement, the location of processing).

What it costs

AI use policy, £995. Internal policy plus the accompanying contract provisions. Five working days.

AI provisions in a contract, £595. Review or draft AI-specific terms in a supply or customer agreement. Five working days.

Email me at geoffrey@caesar.co.uk with what you need and any documents, and I will confirm the scope and the fee in writing, usually the same working day.

What you get

• An internal AI use policy your staff will follow, rather than a document that bans everything and is quietly ignored
• Contract provisions covering output ownership, training data, confidentiality and liability
• A defensible position to give customers who ask what your AI governance looks like
• Review of your AI suppliers' terms, including what they reserve the right to change
• Practical guidance on what to permit, what to restrict and what to prohibit outright
• One round of amendments

What is not included

• Technical AI assurance, model testing or bias auditing
• Sector-specific regulatory approval
• Advice on non-UK regulatory regimes beyond flagging where they apply
• Ongoing regulatory monitoring

Questions I am often asked

Can we use the AI features in our accounting software on client data?

Under the software's data processing terms, which the practice should have read, yes: that is approved use. General-purpose tools need a business account with adequate terms, and consumer tools are not for client data at all. The policy sets the three tiers.

Our tool drafted tax advice. Can a junior send it to the client?

Not without a competent reviewer checking it against the primary source and signing it off. The practice signs the advice and is liable for the tool's error once sent. The file note records the tool and the check.

Should our engagement letter mention AI?

Yes: what the practice does, the human review it applies and the confidentiality it keeps, so that the client has agreed rather than discovered. The contract provisions drafted with the policy go into the letter and the standard terms.

Related guidance and services

• AI contracts and AI use policies, £995, the service this page describes
• Data protection agreements and privacy terms, £795
• Employment contracts and handbooks, £595
• Data processing agreement for a bookkeeper
• AI use policy for a consultancy

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.