[Practice name]: AI acceptable use policy
1. Purpose
AI tools can save our practice time, but our clients trust us with their financial affairs. This policy sets out how everyone at [Practice name] may use AI, so that we protect client confidentiality, meet our professional body’s Code of Ethics and the PCRT guidance, and stay responsible for every piece of work we produce.
2. Who this policy applies to
Partners, staff, contractors and anyone who works on client files for us, including outsourced and subcontracted bookkeepers, whenever they use AI for our work.
3. Approved AI tools
General AI assistants, used only through our business accounts:
- [e.g. Microsoft 365 Copilot, with your work account]
- [e.g. ChatGPT Business, through the practice workspace]
AI features in our practice and client software, and what each may be used for:
- [e.g. Xero JAX: reading source documents and suggesting transactions, for review]
- [e.g. Sage Copilot: pre-submission checks on VAT returns]
- [e.g. IRIS Elements: anomaly checks before filing]
Only [Name or role] may switch on new AI features in any of our software, or connect AI tools to client ledgers, our practice management system or our document store.
4. Client consent
Client information may go into an approved AI tool only for clients whose engagement letter includes our AI clause, or who have otherwise agreed in writing. Clients who opt out are flagged in [our practice management system], and their information never goes into AI tools.
Client information must never go into a publicly available AI tool, such as a free or personal ChatGPT, Claude or Gemini account.
5. Information that never goes into AI tools
- Identity documents and the results of anti-money laundering checks
- Anything relating to money laundering concerns or suspicious activity reports
- Login details, including HMRC and Companies House credentials and authentication codes
- Special category data, such as health information
- [Anything else your practice decides]
6. Review before anything leaves the practice
A qualified member of the team reviews any work produced with the help of AI before it goes to a client, HMRC, Companies House, a lender or anyone else. Check figures, tax rates, rules, dates and references against the source. AI-assisted work is never filed or sent unchecked, and the reviewer is as responsible for it as if they had prepared it themselves.
7. Recording AI use
When AI helped with a piece of work, note on the client file which tool was used, what for, and who reviewed it.
8. AI that talks to clients
AI that chases or replies to clients, such as automated reminders for missing records, uses wording approved by [Name or role]. It must not give tax or accounting advice, make promises about fees or deadlines, or pretend to be a person.
9. Accounts and security
Use your work account for every approved tool, never a personal one, and protect it with multi-factor authentication. Don’t install AI browser extensions, meeting note-takers or add-ons without approval from [Name or role].
10. Mistakes and incidents
If client information goes into the wrong tool, or AI produces something that worries you, tell [Name or role] straight away. We will assess whether it’s a personal data breach, which may need reporting to the Information Commissioner’s Office within 72 hours, and whether to tell the client or our professional indemnity insurer. Reporting it quickly matters more than the mistake.
11. Training and review
Everyone will be shown how to use the approved tools safely before they start. This policy was last reviewed on [date] and will be reviewed at least every [six] months, and whenever our software adds new AI features.
Signed: ______________________ Name: ______________________ Date: __________
