Why your firm now needs an AI policy (even if you don't use AI)

Every firm has staff. Some of those staff use AI tools. Some of them use AI tools that touch client information. In many firms, leadership has no formal position on any of this, because leadership assumes the firm does not use AI, so it does not need to think about AI.

On 22 July 2026, the Tax Practitioners Board published TPB(GS) 55/2026: The use of Artificial Intelligence and the Code of Professional Conduct. The guidance explains how existing obligations under the Tax Agent Services Act apply when AI is used in the provision of tax agent services. It does not create new rules. It clarifies how the rules already in place apply to something firms have been doing (or not doing, or not knowing whether they are doing) for the last two years.

Reading it carefully, one thing becomes clear. The guidance is not only for firms that use AI. It is equally relevant to firms that do not, because the risk it addresses lives in the gap between what a firm officially permits and what its staff actually do.

Three obligations, one problem

The TPB's core position is direct. Tax practitioners are ultimately responsible for the tax agent services they provide, whether or not AI is involved. AI outputs must be assessed and supplemented by professional judgement before being relied on. AI models can hallucinate or provide inaccurate information, and cannot replace tax knowledge, experience or expertise.

Three obligations under the Code of Professional Conduct sit at the heart of what firms need to work through.

Competency comes first. Under Code items 7 to 10 of the TASA, tax practitioners must provide services competently, maintain relevant knowledge and skills, and take reasonable care in how they handle a client's affairs and apply taxation laws. The TPB is explicit that AI output must be verified and reviewed for accuracy throughout each step of a workflow, and that each of those steps should be documented.

Confidentiality is the one that catches firms flat. Under Code item 6, a tax practitioner must not disclose information relating to a client's affairs to a third party without the client's permission, unless there is a legal duty to do so. The TPB has been unambiguous about what this means in an AI context: entering client information into AI models and tools can constitute disclosure to a third party, depending on how those tools are configured and used. Client permission is required before that happens, not after.

Documentation is the third. Under section 40 of the Tax Agent Services (Code of Professional Conduct) Determination 2024, tax practitioners must establish and maintain a documented system of quality management designed to provide reasonable confidence the Code is being complied with. The system must be enforced, not just written down.

Read together, these obligations do not ask whether a firm uses AI. They ask whether a firm has thought about it, made a decision, documented that decision, and can show that the decision is being followed.

Why "we don't use AI" is the wrong answer

The instinct, when a firm has not adopted AI tools, is to conclude that AI guidance does not apply. That is the answer the TPB guidance quietly closes off.

A partner may believe the firm does not use AI. A senior accountant may be pasting sections of a client's file into a chatbot to draft a letter. A junior may be running client bank statements through a summarisation tool to prep a meeting. Each of those is a potential disclosure of client information to a third party, and under Code item 6, each requires client permission that almost certainly does not exist.

A firm without an AI policy is not a firm without AI use. It is a firm without visibility over AI use. The two are not the same, and the TPB guidance draws the line squarely at the second.

The documentation obligation compounds this. A firm that has not made a decision cannot document a decision. A firm that has not documented a decision cannot enforce it. Under section 40 of the Determination, the absence of a documented position is itself a gap in the system of quality management the Code requires.

The competency obligation is the third pressure point. If a staff member relies on an AI output that is wrong, and no process exists in the firm to catch that, the practitioner remains responsible for the error. The TPB has made clear that reasonable care includes reviewing AI output before relying on it, and that professional judgement cannot be delegated to an AI model.

What a policy actually needs to cover

Working from the guidance, a firm's AI policy needs to answer a specific set of questions.

Which AI tools, if any, are permitted for use in the firm, and which are prohibited. The process for approving new tools before staff begin using them.

Whether client information can be entered into approved AI tools, and if so, under what conditions. What the client permission process looks like, and whether the engagement letter needs updating to cover it.

How AI output is reviewed before being used, who does the review, and what documentation of the review is kept. How the firm handles AI errors when they occur.

Which staff have been trained on the policy, how compliance is monitored, and what happens when a breach is identified.

None of these questions are unique to firms that use AI heavily. They are equally relevant to firms that prohibit AI use, because prohibition without documentation and enforcement is not prohibition. It is an assumption.

The wider regulatory context

The TPB guidance does not exist in isolation. The Treasury Laws Amendment (Strengthening Accountability for Tax Adviser Misconduct and Other Measures) Bill 2026 passed the Senate on 10 September 2026, materially expanding the TPB's regulatory powers. Breaches of the Code of Professional Conduct now carry civil penalty exposure in addition to existing administrative sanctions. The TPB has gained new suspension powers, including a 90-day interim suspension that can be imposed without an investigation where there is a significant risk of material loss to clients, Commonwealth revenue, or the integrity of the tax system.

Read alongside TPB(GS) 55/2026, the direction is clear. The TPB has published guidance on how Code obligations apply to AI, and it has been given expanded powers to enforce those obligations. Firms operating without an AI policy are exposed on both sides: the substantive obligation and the enforcement capacity behind it.

What firms should do this month

Establish whether AI is being used in the firm, formally or informally. This is a conversation with every team member, not an assumption based on what the firm has purchased.

Draft or review the firm's AI policy. Cover permitted tools, client permission processes, review procedures and staff training.

Update engagement letters if the client permission process needs it. General authorities may cover disclosure to third parties, but the TPB has recommended that clients be clearly informed about who information is being disclosed to, where data is stored and whether AI tools may be used.

Document the policy under the firm's system of quality management, in line with section 40 of the Determination. Ensure it is enforced.

For firms starting from scratch or reviewing an existing policy, Vinyl and Strategic Group have built a free AI Policy Generator for accounting firms. It uses a People, Process, Data, Technology framework aligned to agentic AI standards and cyber-insurance compliance requirements, and can produce a board-ready policy in under five minutes. Firms with an existing policy can upload it for gap analysis instead.

The full guidance is available on the Tax Practitioners Board website.