The accounting firm AI policy: what it needs to cover.
Nothing in APES 110 or the TPB Code of Professional Conduct says “write an AI policy”. Both make one the practical answer. APES 110 requires reasonable steps to ensure staff respect the firm’s duty of confidentiality and have appropriate training and supervision, and R320.11 requires a decision about whether relying on technology output is appropriate. The TPB expects supervision and a quality management system. A written policy is how a firm shows it has done all of that, to a client, to the Board or to its own partners.
General information only. This guide summarises published professional standards and legislation and is not legal or professional advice. Read the primary sources linked throughout, and take advice on your firm’s specific position.
What the policy needs to cover
Which AI tools staff may use, for which work, and on whose authority. Anything missing from the list is unapproved, including free versions of approved products.
A data classification staff can apply at speed: what may never enter any external tool (TFNs, identity documents, client financials), and what may enter which approved tool.
Who checks AI-assisted work, against what, and how the check is recorded. Tie this to R320.11 and the firm’s existing review hierarchy.
How managers oversee AI use by the people working under them, consistent with R113.2 and the TPB’s supervision expectations.
When clients are told AI is used on their work, and when their authorisation is sought, with standard wording for engagement letters.
What every staff member learns before using an approved tool, including automation bias and the TFN rules.
What staff do if client information goes into an unapproved tool: who to tell, how quickly, and how the firm assesses whether it is a notifiable breach.
When the policy is revisited: at least yearly, and whenever tools, standards or guidance change.
Start from what the firm already has
Most firms already have a privacy policy, an IT acceptable-use policy and a review hierarchy. An AI policy works best as an extension of those: the same data categories, the same reviewers, the same breach process. A separate document that contradicts the privacy policy creates the confusion it was meant to remove. Where the firm performs assurance work, the AI tools used on engagements also belong inside its system of quality management.
Keeping the policy real
A policy fails when the approved path is slower than the forbidden one. Staff at deadline will paste a file into whatever tool answers fastest, and the policy then records a rule nobody follows. Two things keep it real: an approved tool good enough that staff prefer it, and a policy short enough to read in ten minutes, with the never-do items at the top. The conceptual framework guide covers the safeguards the policy should name.
Where deployment posture fits
An approved internal AI makes the policy simpler to write and easier to follow. When processing happens on a unit inside the firm, the data classification section shrinks, because client information does not leave the practice through that tool, and the rules about public tools stop competing with convenience. The review, supervision and training sections still need writing. Our AI for accounting practices page shows how Ermos sets up a unit around a firm’s permissions.
Common questions
Do accounting firms need an AI policy?
Should clients be told the firm uses AI?
Can staff use free AI tools for work with no client information?
See Dominion answering from your own documents.
A demonstration takes 30 minutes, uses no client data, and comes with no obligation.
Book a demo