You're offline, showing the last version we saved.
Playbook

How to write an AI policy for your accounting firm

For firms where people already use AI, policy or not. You finish with a tools register, data rules, updated engagement letters and a team that has read it.

At a glance

  • 5 steps
  • 4 min to read
  • 1 week to put in place
  • 1 template included

What you’ll walk away with

  • A register of every AI tool your team uses
  • One page of data rules people will actually read
  • Each obligation that applies to you written into the policy
  • Engagement letters that carry an AI clause
  • A policy signed by everyone, with a review date set

Learning check · before you start

What do you already have in place?

A few quick questions, so you can skip the steps you have already done. Each one has a line explaining what it means. Not sure, or never heard of it? Choose “Not yet / not sure”: that is where most firms start, and the playbook walks you through it.

  1. Do you have a register of every AI tool your team uses, who uses it and on which plan?

    A register is a simple list. "Plan" means whether each account is on consumer terms, such as a free or personal subscription, or business terms the firm controls, which is the line that matters for client data. Include AI features inside software you already pay for.

  2. Is there a one-page list of what client data can and cannot go into each tool?

    For example, public information and client work with names removed may go into a business account, while tax file numbers, bank details and anything under legal privilege never go into any AI tool.

  3. Have the professional rules you work under, such as the TPB Code, each been written into your AI policy?

    For Australian tax agents that means the TPB Code of Professional Conduct, which applies to AI use. US firms have IRC section 7216 and Circular 230; UK firms have UK GDPR and ICAEW guidance. Each becomes a line, such as a named reviewer signing off every return.

  4. Do your engagement letters carry an AI clause, and have existing clients been told?

    An AI clause says you may use AI tools, that you vet the providers, that a qualified person reviews the work and stays responsible for it, and that the client can limit or withdraw consent in writing. Existing clients get a short plain-English explainer before renewal.

  1. Step 1: List every AI tool in use

    Done when: The tools register lists every tool, who uses it and on which plan.

    Your task ask each person, one to one, which AI tools they use, and record each tool, who uses it, whether it is on consumer or business terms, and what client data has gone into it.

    How to do it, and what to read

    Ask each person, one to one, what they actually use: free and paid accounts, browser extensions, meeting recorders, and AI features switched on inside software you already pay for. A private conversation gets a more honest list than a team email. For each tool, record who uses it, whether it is on consumer or business terms, and what kind of client data has gone into it. The line that matters is consumer versus commercial terms, not one vendor against another. Say a partner drafts client emails in a personal account: that goes on the register too.

    Learning check

    What would you do? Pick one; every answer is explained.

    You are writing your firm's first AI policy and need a list of every AI tool people use, including free accounts, browser extensions and AI features inside software you already pay for. How do you get an honest list?
    You are building a register of the AI tools used in your firm. You learn that a partner drafts client emails in a personal AI account. Does it go on the register?
    For each AI tool on your firm's register, you can record many details. Which one matters most for protecting client data?

  1. Step 2: Set the data rules

    Done when: There is a one-page list of what can and cannot go into each tool.

    Your task sort client data into tiers, mark which tiers each AI tool may receive, and fit the rules on one page as a table someone can check mid-task.

    How to do it, and what to read

    Sort client data into tiers: generic or public, client work with the identifiers removed, identifiable client records, and the things that never go into any AI tool, such as tax file numbers, bank details and anything under legal privilege. Then mark which tiers each tool on the register may receive. Client work goes only into business-tier accounts. Connect tools read-only, to the narrowest data that does the job, and widen access one approval at a time. Fit the whole thing on one page, as a table someone can check mid-task.

    Learning check

    What would you do? Pick one; every answer is explained.

    Your firm's AI data rules sort information into tiers, from public information up to things that never go into any AI tool. A staff member wants to paste a client's bank details into the firm's business AI account to speed up a reconciliation. Is that allowed?
    You are connecting a new AI tool to your practice data so it can read client records. How much access do you give it?
    You have drafted your firm's rules on what client data can go into which AI tools, and they run to six pages. What do you do?

  2. Step 3: Check your professional obligations

    Done when: Each obligation that applies to you has a line in the policy.

    Your task read the professional obligations that apply where you practise, and write each one into the policy as a line with the action that meets it.

    How to do it, and what to read

    Read what applies where you practise. For Australian tax practitioners, TPB(GS) 55/2026 says the Code of Professional Conduct covers AI use: understand the tool, review its output, document how it is used and keep client information confidential. US firms work under IRC section 7216 and Circular 230; UK firms under UK GDPR and ICAEW guidance. Write each obligation as a line in the policy, with the step that meets it, for example “a named reviewer signs off every AI-assisted return before lodgement”.

    Learning check

    What would you do? Pick one; every answer is explained.

    Your draft AI policy says only 'staff should use AI responsibly'. What would make it more useful?
    The Tax Practitioners Board (TPB), which registers Australian tax and BAS agents, has issued guidance on AI called TPB(GS) 55/2026. What does it say the TPB's Code of Professional Conduct covers?
    You practise only in Australia. While researching your AI policy, you find guidance for US and UK accountants as well as Australian rules. Which obligations go into your policy?

  3. Step 4: Update engagement letters and tell clients

    Done when: New letters carry the clause and existing clients have been told.

    Your task add an AI clause to new engagement letters, send existing clients a short plain-English explainer before their next renewal, and note on each client file when it went out.

    How to do it, and what to read

    Add an AI clause to new engagement letters. It should say that you may use AI tools, that you vet the providers, that a qualified person reviews the work and stays responsible for it, and that the client can withdraw or limit consent in writing. For existing clients, send a short plain-English explainer before their next renewal rather than waiting for it. Note on each client file when the notice went out, and flag any client who asks you not to use AI on their work.

    Learning check

    What would you do? Pick one; every answer is explained.

    You are adding a clause about AI to your engagement letter, the agreement that sets out the work your firm does for a client. What should the clause say?
    Your engagement letters now say you may use AI tools. A client asks you not to use AI on their work. What do you do?
    You have added an AI clause to new engagement letters. An existing client's engagement does not renew for eight months. When do they hear about your AI use?

  4. Step 5: Walk the team through it

    Done when: Everyone has read and signed it, and the review date is set.

    Your task book an hour with the whole team to walk through the tools register, the data rules and the review rule using real work, then have everyone sign and set a review date.

    How to do it, and what to read

    Book an hour with the whole team. Go through the register, the data page and the review rule using real examples from your own work, and take every question. Agree who approves a new tool before anyone starts using it, and what someone does if they slip, such as pasting client data into the wrong account: they tell you the same day, and nobody is punished for saying so. Ask each person to sign. Set a review date at least once a year, and sooner whenever you add a tool.

    Learning check

    What would you do? Pick one; every answer is explained.

    You are walking your team through the firm's new AI policy. Someone asks what happens if they accidentally paste client data into the wrong AI account. What is the answer?
    Your firm's AI policy includes a register of approved tools. A team member finds a new AI tool they want to try. What happens?
    Your firm has a new AI policy, signed by everyone. When should it be reviewed?

Free to join

Join The Firm free to read the rest

Members get every playbook in full, plus free templates, downloads and tools across the site. Join more than 35,000 accounting professionals. All it takes is your email.

Already a member or subscriber? Enter the same email and the playbook opens. Privacy policy.

Your one-page summary

Your answers, choices and decisions, on one page

Copy this

AI policy template

Tools register, data rules and sign-off. Editable .docx.

Get the template

Frequently asked questions

Does a small firm need a written AI policy?

Yes, if anyone in the firm uses AI with client information, and that includes AI features switched on inside software you already use. One page is enough to start.

What goes into an AI policy?

The tools you approve, what client data may go into each one, how AI output is reviewed, what clients are told, and who signs off. The template has a section for each.

How often should we review the policy?

Whenever you add a tool or a regulator issues new guidance, and on a fixed date at least once a year.

More for: Use AI safely