Key takeaways
- An AI policy tells staff which AI tools they may use, what data they may put into them and who checks the output; ICAEW lists a defined and communicated AI policy as one of its 10 AI governance questions (3 July 2026).
- ICAEW warned on 12 February 2024 that putting client data into public tools such as ChatGPT will very likely breach client confidentiality.
- The firm stays responsible for advice it issues, so the policy should require a named human reviewer for every piece of AI-assisted client work.
- The ICO's guidance on AI and data protection was last updated on 15 March 2023 and is under review after the Data (Use and Access) Act 2025.
- A data protection impact assessment (DPIA) is the ICO's main tool for checking a new AI system that processes personal data.
- Review the policy at least once a year, and whenever you add a new AI tool or the guidance changes.
An AI policy is a short document that tells everyone in your firm which AI tools they may use, what client data can go into them, and who must check the output before it reaches a client. Below is a template you can copy and adapt, with each clause tied to guidance from ICAEW, the ICO and the National Cyber Security Centre (NCSC). It is a starting point, not legal advice, so have your data protection lead check the final version.
Why does an accounting firm need an AI policy?
Your firm needs an AI policy because staff are probably already using AI tools, and the firm carries the risk. ICAEW’s article of 12 February 2024, Don’t let AI tools land you in hot water, says that entering client data into a public tool such as ChatGPT will very likely breach client confidentiality. It also warns that AI tools can “hallucinate” and invent facts and references.
ICAEW’s AI governance: 10 essential questions, published 3 July 2026, asks directly whether you have “defined and communicated an AI policy, with procedures”. A written policy is how you show you have.
What should an AI policy cover?
A workable policy for a small or mid-sized practice covers eight areas.
| Section | What it settles | Main source |
|---|---|---|
| Scope and ownership | Who it applies to, who owns it | ICAEW 10 questions |
| Approved tools | Which tools staff may use | ICAEW, NCSC |
| Client data | What can and cannot be entered | ICAEW, ICO |
| Human review | Who checks AI output | ICAEW |
| Transparency | When to tell clients | ICAEW, ICO |
| Security | Accounts, access, incidents | NCSC |
| Training | What staff must learn | ICAEW |
| Review | How often the policy is updated | ICAEW |
The template
Copy these clauses and replace the text in square brackets.
1. Purpose and scope
This policy applies to all partners, staff, contractors and trainees of [firm name] who use artificial intelligence tools for firm or client work, on any device. It covers standalone tools (such as chatbots) and AI features built into software we already use.
2. Ownership
[Name, role] owns this policy and is accountable for AI risk at the firm. Questions and requests for new tools go to them.
3. Approved tools
Staff may only use the tools on the approved list in Appendix A, through firm accounts. Personal or free accounts must not be used for firm work. To add a tool, the owner checks where data is stored, whether it is used to train the supplier’s model, and the supplier’s security terms.
4. Client and personal data
- Do not enter client names, UTRs, National Insurance numbers, bank details or financial records into any tool that is not on the approved list.
- For approved tools, enter only the minimum data needed for the task.
- Any new use of AI that processes personal data needs a data protection impact assessment (DPIA) before it starts.
5. Human review
Every AI-assisted output that goes to a client, HMRC or Companies House must be reviewed by a named, qualified person. Treat AI output as you would a trainee’s first draft: check figures, references and law against the primary source. The firm remains responsible for the advice, whatever tool helped produce it.
6. Transparency with clients
Our engagement letters will state that we may use approved AI tools to support our work, and that a qualified person reviews all work before it is issued. If a client asks us not to use AI on their work, we will record and follow that request.
7. Security and incidents
Use multi-factor authentication on every AI account. Report any suspected data leak, wrong output sent to a client, or unusual tool behaviour to [name] on the same day. Incidents follow our data breach procedure.
8. Training and review
All staff complete AI training on joining and once a year. This policy is reviewed every 12 months, and sooner if we add a tool or regulator guidance changes. Last reviewed: [date].
How to roll the policy out
Rolling the policy out takes five steps.
- Find out what is in use. Ask staff which AI tools and features they use now, including in your practice software.
- Build the approved list. Check each tool’s data storage and training terms before adding it to Appendix A.
- Update engagement letters. Add the transparency wording from clause 6.
- Train everyone. Run a short session on clauses 4 and 5, which carry the most risk. Our guide to AI training for accounting staff has ideas.
- Set a review date. Put the 12-month review in the diary now.
What the regulators say right now
The ICO’s guidance on AI and data protection was last updated on 15 March 2023. The ICO says it is under review because of changes made by the Data (Use and Access) Act 2025, so check it again before your annual review. We have not seen a confirmed date for the revised version.
The NCSC’s AI and cyber security: what you need to know tells leaders to plan for AI-specific risks, such as hallucinations, prompt injection and data poisoning, alongside normal cyber threats. For a wider view, see our guides to AI data privacy for accountants and AI risk management in practice.
Which version suits your firm?
The right policy depends on how your firm uses AI.
- If staff only use AI for drafting emails and research, the template above is enough.
- If you use AI features inside practice or bookkeeping software, add each feature to Appendix A and record the supplier’s data terms.
- If you are trialling AI agents that act on client records, add a DPIA and a log of human sign-offs. Read AI agents in accounting first.
Frequently asked questions
Is an AI policy a legal requirement for accountants?
No law requires a document called an AI policy. You must, however, protect client confidentiality under your professional body’s code of ethics and process personal data lawfully under UK GDPR, and a policy is the usual way to show how you do that.
Can staff use ChatGPT for client work?
Only within your policy. ICAEW says entering client data into public tools will very likely breach confidentiality, so most firms ban client data in free tools and allow only approved, firm-managed accounts.
Do we need to tell clients we use AI?
There is no single rule, but telling clients in your engagement letter is good practice and supports transparency under UK GDPR. Say that a qualified person reviews all work.
How often should an AI policy be reviewed?
Review it at least once a year. Review it sooner if you add a new tool, have an incident, or the ICO or your professional body updates its guidance.
Who should own the AI policy in a small practice?
One named partner or director. ICAEW’s governance questions stress clear ownership and accountability.
Sources
Rates, thresholds and rules in this guide were checked against HMRC and GOV.UK guidance on 6 November 2026. Tax rules change, so check the current position on GOV.UK or with a qualified adviser before acting. This guide is general information, not personal advice.