AI policy for accounting firms: what to decide, test and record

01What should an accounting firm's AI policy cover?

A useful AI policy is a set of decisions, not a statement of values. For each use, it records which tool and account are approved, what the tool may do, which client data may go in, who reviews the output and who answers when something looks wrong. If a colleague cannot apply it to a real file on an ordinary afternoon, it is not finished.

Firms are already writing these rules. ICAEW research published on 22 May 2026 surveyed leaders of 35 UK mid-tier firms in February and March 2026. Of those firms, 86% had a technology strategy that includes AI adoption, but only 17% felt confident assessing AI's effect on their workforce. That is one UK sample, not a picture of every firm. It does show the gap a policy has to close: adoption is planned, while the effect on people's work is still uncertain.

The templates we reviewed stop at a list of banned data and a promise of review. The table below works as a one-page template and adds the parts that make a policy usable: the permitted action, the stopping point, the escalation route and the person who can switch a tool off. Copy the first two columns, then write the third for each task you approve.

02Does the EU AI Act require an AI policy or AI training?

It does not prescribe a policy document, but it does require action on AI literacy. Article 4 of the EU AI Act, Regulation (EU) 2024/1689, has applied since 2 February 2025. It covers providers and deployers of AI systems. A deployer is any person or organisation using an AI system under its authority, other than for personal, non-professional activity. A firm whose staff use AI tools on client work is therefore a deployer. As an EU regulation, the Act applies directly in Malta, as in the rest of the EU. In Malta, the Malta Digital Innovation Authority is designated as a market surveillance authority and as the single point of contact for the AI Act (L.N. 226 of 2025, regulation 3).

Article 4 has since been replaced. Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. The current text requires providers and deployers to 'take measures to support the development of AI literacy' of their staff and of others using AI on their behalf. Those measures should reflect people's knowledge, experience and training and the context in which the tools are used. The new text adds that a firm need not guarantee any specific level of AI literacy for any individual.

Several pages that rank for this topic still quote the original wording, which asked for 'a sufficient level of AI literacy'. That wording no longer applies; the duty to take measures remains. The Commission's AI literacy Q&A, last updated on 27 July 2026, says no certificate is needed, that organisations can keep an internal record of training and other guidance, and that no particular governance structure, such as an AI officer, is mandated. That is Commission guidance, not the legal text.

Two more EU rules shape the policy. The Act's stricter high-risk rules cover only the uses it lists, such as AI used to hire or evaluate staff, or to assess an individual's creditworthiness. They do not apply yet: Regulation (EU) 2026/1744 moved their start for those listed uses to 2 December 2027. Routine drafting and summarising is not itself a listed use, but check each use against the list now, so the policy is ready before those rules start. And where an AI supplier processes client personal data on the firm's behalf, the GDPR requires a binding contract that sets out the processing and the supplier's duties (Article 28).

03Which tasks should AI do first, and where must it stop?

Start with a task that is frequent, bounded and easy to check against a source. Drafting a document request from an approved template is a good first case. Summarising a long contract for an audit file is harder, because a missing clause is less visible than a wrong one. 'Use AI to improve productivity' is not a task. 'Draft the request, then ask the engagement manager to check the period and scope before anything is sent' is.

Give every task a permitted action and a stopping point. A drafting tool does not need permission to send emails, post journals or approve work, so do not give it any. List the uses that need a separate decision before anyone tries them, such as anything that files with an authority or messages a client directly. If staff cannot tell whether a proposed use falls inside the policy, name one person to ask and answer quickly.

04What client data may go into which AI tool?

The approved-tool list needs enough detail to tell the firm's configured service from a personal account with a similar name. Record the account, the permitted data categories and who approved the supplier arrangement. Then ask the supplier for written answers and keep them. Fill gaps with evidence, not assumptions.

Where the supplier processes personal data on the firm's behalf, the GDPR requires a binding contract. Among other things, it must require the supplier to act only on the firm's documented instructions, to keep the data confidential and to secure it. Ethics guidance points the same way. IESBA's June 2026 snapshot explains that, under the international Code as revised for technology, confidentiality covers the whole data lifecycle, from collection and use through transfer and storage to lawful destruction.

Plan for the tool people use anyway. An NCSC blog post of 7 September 2026 describes shadow AI as AI use outside an organisation's approved systems and processes. It warns that sending sensitive information to consumer AI services is likely to reduce an organisation's visibility and control over that information. Its advice is to understand why staff turn to unapproved tools, to offer secure approved alternatives and to keep a positive security culture with open communication. Make reporting a mistake easy, so a pasted client record is found the same day rather than at year end.

• Where are inputs and outputs stored, and for how long?
• Are inputs or outputs used to train or improve models, and can that be switched off for the firm's account?
• Which other companies process the data, and how will you tell us about changes?
• Who at the supplier can see our data, and is that access logged?
• Can we export or delete everything if we leave?

05What does human review of AI output actually involve?

A review instruction should say what the reviewer compares, what they resolve and what they record. Rereading a fluent draft is not the same as checking its facts against the source. For the document request, the reviewer confirms the company, period, records and deadline against the engagement plan, removes anything outside scope, approves the final text and keeps a note of the changes.

The FRC's March 2026 guidance on generative and agentic AI offers a useful structure, though it is non-binding UK guidance aimed at audit firms' central technical teams. It groups the risks to audit quality into three: the output is deficient; a sound output is misused; or the firm's methodology permits a use that does not meet auditing standards. It defines a human in the loop as someone who directs, authorises or reviews the system's actions or outputs while it runs. The FRC's announcement is plain on accountability: 'the human auditor is always accountable'.

International ethics standards point the same way. The IESBA Code's technology revisions took effect internationally on 15 December 2024. IESBA's 11 June 2026 snapshot explains that the Code now names automation bias, the tendency to favour a system's output even when contradictory information questions it, as a bias that can impair objectivity. It also states: 'Professional responsibility cannot be delegated to a machine.' In Malta, the Accountancy Board's 2016 Code of Ethics for Warrant Holders (Directive 2) is mandatory for warrant holders. It predates these revisions and does not mention automation bias. Treat automation bias as good practice for your policy, and train for it directly: ask reviewers to explain why they accepted an output, including any conflicting information they set aside.

06How do you control AI agents that can act, not just draft?

Some tools now take steps on their own: reading a mailbox, posting entries, sending requests. Test that authority separately from the quality of the writing. A correct draft does not prove that it should be sent automatically.

Joint guidance published on 1 May 2026 by the NCSC and cyber security agencies in Australia, the US, Canada and New Zealand, 'Careful adoption of agentic AI services', recommends a phased roll-out that starts with clearly defined, low-risk tasks. It advises limiting an agent's access to the resources, operations and time each task needs, and monitoring for unusual behaviour. It also advises using agentic AI only for low-risk, non-sensitive tasks, and never giving it broad or unrestricted access to sensitive data.

An NCSC blog post of 15 May 2026, which summarises that guidance, asks firms to settle ownership before deployment: who owns the system, who approves its access, who monitors it, who reviews incidents and who can stop it. In the NCSC's view, an agent whose actions you cannot understand, monitor or contain is not ready to deploy.

Write those answers into the policy. Name who can pause the workflow, withdraw access and restore an earlier version of a record. Check that each action leaves a log a reviewer can follow, and that the agent cannot widen its own permissions. Client files hold sensitive data, so start an agent on approved sample material or low-risk work, and keep client files in the firm's approved systems.

07How should a firm test and roll out the policy?

Roll out in stages and finish each stage before starting the next. The gates tool below uses six: know what is in use, write the rules, get supplier evidence, define review and escalation, pilot one workflow, then brief staff and set the review date. A gate passes only when every criterion in it is ticked.

In the pilot, rehearse awkward cases on purpose: a missing input, an outdated template and a request containing contradictory facts. Watch whether the preparer notices the problem and sends it to the right person. Record each failure as a change to the workflow or the training, then repeat the case. Keep the pilot small enough that the reviewer can explain every decision.

Give the policy one owner and each approved workflow its own owner. Keep a short decision record: tool and account, task, data boundary, reviewer, open questions and the date checked. The same record can hold your note of the AI literacy measures you have taken. Re-check it when the supplier changes a feature, the task widens or an incident shows a gap.

If you are assessing Vacei, its published pages describe VEE, the AI inside the platform, preparing the routine work while the firm's people review, decide and sign. They describe preparer, reviewer and partner sign-off on every file and a record of every step VEE takes. They also describe connecting Claude or ChatGPT, on subscriptions separate from Vacei, and AI training for the firm's team. Vacei's firm demo is shown on sample data, so you can watch those paths against one workflow from your policy. A demonstration is an input to your policy, not a substitute for it.