Accountants can use AI tools with client data, but only within the same rules that already govern every other system in the practice: UK GDPR and the professional duty of confidentiality. In practice that means using business plans with proper contractual protections, sharing the minimum data needed, assessing the risks before you start, and being open with clients about how their information is used. A short written policy makes all of this far easier to follow.
Why AI needs a policy in an accounting practice
AI assistants are now built into email, office suites and many accounting tools, and staff are using them to draft letters, summarise documents and explain tax points. The risk is rarely the technology itself. It is client information being pasted into a consumer tool with no contract, no clarity on where the data goes and no record that it happened.
Accounting firms hold exactly the kind of data that needs care: names, addresses, National Insurance numbers, bank details, income and sometimes health or family information. A clear policy protects clients and protects the firm.
What the law and guidance say
UK GDPR and the ICO
The Information Commissioner’s Office has published guidance on AI and data protection, covering accountability, transparency, lawfulness, accuracy, fairness, security and data minimisation. The ICO notes that this guidance is under review following the Data (Use and Access) Act 2025, so check for updates, but the underlying UK GDPR principles have not gone away.
Some points matter most for a practice:
- Data minimisation. Personal data must be “adequate, relevant and limited to what is necessary” for the purpose, as the ICO’s guide to data minimisation explains. If a task can be done without names or identifiers, remove them.
- Contracts with processors. When an AI provider processes personal data on your behalf, UK GDPR requires a written contract with set terms, including acting only on your documented instructions, security measures, rules on sub-processors and deletion at the end of the contract. The ICO sets these out in its guidance on controller and processor contracts.
- Data protection impact assessments. The ICO lists artificial intelligence as an example of innovative technology which, combined with other factors such as sensitive data, can mean a DPIA is required. Even where it is not strictly required, a short assessment is good practice.
- International transfers. If the provider stores or processes data outside the UK, the transfer rules apply and you need to know what safeguards are in place.
Professional body codes
Confidentiality is one of the fundamental principles in the ethics codes of ICAEW and ACCA, both of which are based on the international code issued by IESBA. Members must respect the confidentiality of information acquired through professional relationships and must not disclose it without proper authority or a legal or professional right or duty to do so. Putting client data into a tool that may retain it or use it for training, without the client’s knowledge, sits uneasily with that duty.
Consumer plans versus business plans
Many AI products come in free or personal versions and business or enterprise versions. The difference matters. Before any client data goes near a tool, check the terms for the plan you are actually using.
| Question to ask | What you want to see |
|---|---|
| Is there a data processing agreement? | Yes, covering the UK GDPR Article 28 terms |
| Are inputs used to train the provider’s models? | No, by default and in writing |
| Where is data stored and processed? | Clearly stated, with transfer safeguards if outside the UK |
| How long are inputs and outputs kept? | A defined period, with the option to delete |
| Who controls user accounts? | The firm, with admin controls and the ability to remove access |
| What security standards apply? | Encryption, access controls and published security information |
If a tool cannot give clear answers, treat it as unsuitable for client data. Staff can still use it for general tasks that involve no personal or confidential information.
Being transparent with clients
Clients should not be surprised to learn how their data is handled. Review your privacy notice and engagement letter terms so they describe, in plain language, the types of tools you use and the safeguards in place. Where you plan a use that clients might not reasonably expect, consider asking them first. Consent is not always the right lawful basis under UK GDPR, but openness is always expected.
A practical AI policy checklist
A one or two page policy is enough for most practices. It should cover:
- Approved tools. A named list of tools and plans staff may use, and a ban on everything else for client work.
- What can go in. Clear rules on client data: none in unapproved tools, and only the minimum needed in approved ones.
- Anonymise first. Remove names, reference numbers and bank details where the task allows.
- Human review. Every AI output used for client work is checked by a qualified person before it is relied on or sent.
- Records. A note of which tools are used for which tasks, plus any DPIA you have completed.
- Contracts. A data processing agreement on file for each approved tool.
- Client communication. Privacy notice and engagement letter wording updated.
- Training. Everyone, including partners, knows the policy and who to ask.
- Incidents. What to do if client data is entered into the wrong tool, including when to consider reporting a breach.
- Review date. Revisit the policy at least once a year, and when ICO guidance changes.
Frequently asked questions
Can I paste a client’s tax return into a free AI chatbot?
You should not. Free and personal plans often lack a data processing agreement and may use inputs to improve the service. Use only approved business tools with the right contractual protections, and remove identifying details where possible.
Do I need client consent to use AI?
Not always, as consent is only one lawful basis under UK GDPR. You do need to be transparent, so your privacy notice and engagement terms should explain how client data is processed.
Do I need a DPIA before using AI?
The ICO lists AI as innovative technology that, combined with other risk factors, can make a DPIA a requirement. For client data, completing one is a sensible step either way.
Is the ICO’s AI guidance still current?
The ICO has said it is under review following the Data (Use and Access) Act 2025. Keep an eye on the ICO website for updated guidance.
How Engager helps
Good AI governance depends on knowing where client data lives. Engager is UK-hosted, GDPR compliant and Cyber Essentials certified, giving you one secure place for client records, documents and communications rather than scattered files and inboxes.
You can update your letters of engagement with revised data and technology wording, send them for e-signature, and share documents through the branded client portal instead of email attachments.
Not using Engager yet? Start a free 28-day trial, with no card details required, or book a demo.
