← Accounting & Bookkeeping

How to Write an AI Policy for Your Accounting Firm (Step by Step)

Updated 2026-10-15 · Some links may be affiliate links. Disclosure

Why first: In Financial Cents’ 2026 survey, 87% of firms actively using AI had no formal written AI policy, and 23% had no plans to create one (Financial Cents). That means client data is going into AI tools with no documented rules.

This is a practical guide, not legal advice. Have counsel review your final policy. The AICPA itself recommends this (AICPA).

Step 1: Start from the AICPA template

The AICPA publishes a free Small Firm Generative AI Policy Template (April 2026) for the ethical use of public large language models such as Copilot (AICPA & CIMA). Download it rather than starting from scratch.

Step 2: List the tools people actually use

Survey staff anonymously. Intapp found 76% of professionals use unauthorized AI at work (Intapp 2026). For each tool, note who uses it, for what, and what data goes in.

Step 3: Vet each tool’s terms

The AICPA warns that entering data into a generative AI tool shares it with the tool’s owner, and that vendors may try to disclaim liability for breaches (AICPA). For each tool, check:

  • Does the vendor train on your inputs? Example: OpenAI says it doesn’t train on ChatGPT Business data by default (OpenAI).
  • How long is data retained, and who can access it?
  • Are SSO and MFA available?
  • What happens if there’s a breach?

Step 4: Write the data-input rules

Following the AICPA, prohibit putting confidential client or firm information into tools that haven’t been approved, and treat anything you type into an unapproved tool as if you were posting it publicly (AICPA). Name the approved tools explicitly.

Step 5: Require human review

Every AI output that reaches a client or a return gets reviewed by a qualified person. Document what was checked.

Step 6: Decide on client disclosure

No single professional standard controls this. The AICPA points to the ABA’s opinion that consent should be informed, and that boilerplate engagement-letter language is not enough (AICPA). Tax preparers should also consider the Confidential Client Information Rule and SSTS 1.3 on data protection (same source).

Step 7: Tie it to your WISP

Under the FTC Safeguards Rule, professional tax preparers must have a written information security plan, and multi-factor authentication is required (IRS Pub 4557). The IRS provides a template in Publication 5708 (IRS). Add your approved AI vendors to the service-provider section of your WISP.

Step 8: Train, monitor, revisit

Train everyone on the policy and monitor use regularly (AICPA). Put a quarterly review on the calendar, because tools change fast.

One-page checklist

  • AICPA template downloaded
  • Tool inventory done
  • Each tool’s terms reviewed (training, retention, SSO/MFA, breach)
  • Approved tool list published
  • Data-input rules written
  • Human-review rule written
  • Client disclosure decision made, with counsel
  • WISP updated
  • Staff trained; quarterly review scheduled

Tools in this guide

  • ChatGPT Business: A firm-approved general assistant to replace staff using personal accounts.