AI for UK accounting practices: ICAEW and ACCA guidance, GDPR, and the practical path

UK accountants keep asking the same question in slightly different forms: is my institute going to let me use this stuff, and will GDPR get me struck off if I do? The guidance already exists, it is more permissive than most partners assume, and the firms getting it wrong are usually the ones who never read it. This article covers what ICAEW and ACCA actually say, what UK GDPR requires when client data meets an AI tool, and the practical order of operations. One caveat up front: this is general information, not legal advice, so run anything consequential past your own advisers.

What ICAEW actually says

ICAEW has published a full generative AI guide aimed at all accountants, whether in business or practice. It covers use cases, prompt engineering, ethics, legal considerations, risks and how to get started, it is free, and it counts as CPD.

Three points from the guide matter most for practices:

• Confidentiality comes first. The legal considerations section, written with input from CMS partner and ICAEW Tech Board member Sam De Silva, is blunt: organisations should not put confidential information or personal data into a generative AI tool. Entering it may breach data protection law or a confidentiality obligation owed to a third party, and you have no oversight of how a public tool will use or secure what you type in. That warning targets public, consumer-grade tools. The guide explicitly suggests considering secure or privately deployed versions where inputs are not shared with the provider, subject to your own security risk assessment.
• Verify everything. Generative AI produces output that looks credible but can be factually wrong, because it predicts likely next words rather than retrieving facts. ICAEW's risks section covers hallucination, bias and inconsistency, and its mitigations are professional scepticism, checking outputs against reliable sources, and asking the same question more than once, since models rarely repeat the same hallucination.
• Write a policy and train people. ICAEW's guidance says firms should create clear policies, provide training on responsible use, and find out which AI tools staff are already using so the policy covers reality rather than theory. A policy that pretends nobody is using ChatGPT is a policy about an imaginary firm. We covered how to write one in an afternoon in the one-page AI policy every accounting firm needs.

On regulation, ICAEW's guide notes the UK's chosen approach: rather than an AI-specific statute like the EU AI Act, the UK government's 2023 white paper asked existing regulators to apply five principles (safety, transparency, fairness, accountability, contestability) within their own sectors. As at July 2026 that remains the broad position, so for accountants the binding rules come from data protection law, your engagement terms and your professional code of ethics, not from a dedicated AI act.

ACCA's position: accountability does not delegate

ACCA's position paper, AI in the finance profession (August 2023), takes a different angle from ICAEW's how-to guide. Its core argument is that accountability sits at the heart of the profession, and AI does not move it. The member who signs the work remains responsible for it, whatever tools produced the first draft. That is the same logic we argued in no AI is ever going to jail for you: the tool has no professional indemnity insurance and no practising certificate. You do.

Two practical consequences follow. First, AI literacy is now a professional competency: ACCA says finance professionals need to understand the capabilities, limitations and applications of AI in their own domain well enough to exercise effective oversight. Second, ACCA expects new work to emerge around controls and assurance over AI systems, which for practices makes reviewing AI-assisted output billable professional judgement. On jobs, ACCA's view is that AI adoption increases rather than diminishes the importance of finance professionals who oversee critical processes.

UK GDPR and client data: what the ICO expects

This is where UK firms have real legal exposure, so it deserves precision. The rules are UK GDPR and the Data Protection Act 2018, regulated by the ICO, which has published dedicated guidance on AI and data protection. The guidance is not a statutory code, but the ICO uses the same framework to audit and investigate organisations, so treating it as optional is unwise.

For an accounting practice, the position breaks down like this:

• You are the controller. Client names, dates of birth, NI numbers, payroll records, director details: all personal data for which your firm decides the purposes and means of processing. Feed that data into an AI tool and you are responsible for what happens to it.
• The AI vendor is usually your processor, and that requires a contract. Using an AI tool on client personal data needs a written agreement covering how the provider processes, secures and deletes it. Enterprise AI products offer data processing agreements and commitments not to train on your inputs. Free consumer tools generally do not, which is the legal substance behind ICAEW's warning about public models. The practical tool-by-tool comparison lives in is AI safe for client data?
• High-risk processing needs a DPIA. The ICO's guidance takes a risk-based approach: assess the risks to individuals, then apply proportionate measures. Where processing is likely to result in high risk, a data protection impact assessment is required before you start, and rolling out an AI tool that touches client personal data is the moment to do one. The ICO publishes an AI and data protection risk toolkit to make this less painful.
• Watch the transfers. Many AI providers process data in the US. That is workable under UK GDPR with the right transfer mechanism in place, but it is a question to ask the vendor in writing, not assume.
• The rules are mid-update. The Data (Use and Access) Act became law in June 2025 and changed parts of the UK regime, notably around automated decision-making. The ICO states its AI guidance is under review as a result, so check for the current version before you finalise anything (as at July 2026 the review is still noted on the ICO's own guidance pages).

One category worth calling out: meeting recordings and transcripts are personal data too, so an AI notetaker sits inside this same framework. Purpose-built tools for accountants such as Vinyl (Vinyl is a commercial partner of The Firm) are built around that reality with consent workflows and firm-level data controls, and the wider field is ranked in the best AI meeting assistants for accounting firms. Whatever tool you pick, the UK GDPR questions above still apply to it.

The HMRC context: why 2026 is the year to sort this

Making Tax Digital for Income Tax became mandatory from 6 April 2026 for sole traders and landlords with qualifying income over 50,000 pounds, with the threshold dropping to 30,000 pounds in April 2027 and 20,000 pounds planned for April 2028. Quarterly digital submissions across a large slab of the client base is a capacity problem, and the strongest business case UK firms have for automating low-judgement work now. A firm that waits until the January 2027 filing season to think about AI governance will be writing its policy mid-crunch.

The practical adoption path for a UK practice

Pulling the guidance together, the sequence for a UK firm looks like this:

1. Find out what staff already use. ICAEW says to base your policy on the tools actually in circulation. Ask, without threatening consequences, or you will get polite fiction.
2. Write the one-page policy. Name approved tools, banned inputs (client personal data into consumer tools tops the list), and the review requirement: a qualified human checks anything client-facing.
3. Pick tools on their data terms, not their demos. Require a data processing agreement, a no-training commitment on your inputs, and clarity on where data is processed. This filters the field fast, and the surviving candidates are compared in Claude vs ChatGPT vs Copilot.
4. Run a DPIA before client data flows. Use the ICO's toolkit. For a small firm this is hours, not weeks, and it converts "we think it is fine" into documented accountability.
5. Pilot on internal work first. Drafting file notes, summarising legislation, preparing meeting agendas in your practice management system, whether that is FYI, XPM or AccountKit. Build judgement on low-stakes work before AI touches anything a client relies on.
6. Train, then revisit quarterly. Both institutes stress training, and the ICO guidance is actively changing post-DUAA, so treat governance as a standing agenda item.

The broader playbook, including tool selection and rollout sequencing, lives in our pillar guide to AI for accounting firms.

The verdict: UK practices are better served by their institutions than they think. ICAEW has told you how, ACCA has told you who remains responsible, and the ICO has told you what the law requires. None of the three says wait. All three say govern it properly, and the firms that do so before the MTD workload bites will be setting prices rather than apologising for delays.

Frequently asked questions

Do ICAEW or ACCA ban members from using generative AI?

No. Both publish guidance encouraging adoption with safeguards: confidentiality, output verification, firm policies and training. The professional obligation is to use AI competently and remain accountable for the output, not to avoid it.

Can I put client data into ChatGPT if I anonymise it first?

Genuinely anonymised data falls outside UK GDPR, but true anonymisation is harder than removing a name. If a client could be re-identified from context (a distinctive business, a small town, a specific transaction), it is still personal data, and pseudonymised data remains in scope. An enterprise tool with a data processing agreement is safer than DIY redaction.

Does my firm need a DPIA for every AI tool?

Not automatically. A DPIA is required where processing is likely to result in high risk to individuals. A tool drafting generic marketing copy is low risk; one processing client tax records or transcribing client meetings is a strong DPIA candidate. When in doubt, doing a short DPIA is cheap insurance and evidences accountability if the ICO ever asks.

Who is liable if AI-generated advice to a client is wrong?

Your firm, under your engagement letter and professional negligence law, exactly as if a junior drafted it and nobody reviewed it. ICAEW's guidance notes that liability chains involving AI vendors are legally untested, so assume the reviewing professional carries the risk and price review time accordingly.

Do I need to tell clients my firm uses AI?

There is no blanket UK statutory duty to disclose AI use, but transparency is a core UK GDPR principle, so your privacy notice should reflect how client personal data is processed, including by AI processors. Many firms now add a short AI clause to engagement letters so clients hear it from the firm first; the clause wording, and when consent is legally required rather than just polite, is in our guide to client consent for AI.