Why Accountants Need an AI Policy Before January

One of your senior accountants is up against a deadline on a Thursday afternoon. A client has sent a messy set of management accounts with a question buried in the email. She pastes the whole thing into ChatGPT and asks it to summarise the position for a quick email back.

Nobody told her not to. Nobody told her it was fine either. She made a judgement call in about four seconds, and that judgement call now involves a client's bank balances, supplier names and probably a National Insurance number sitting on a server she has never heard of.

This is the gap most accountancy practices are sitting in right now. Staff are already using AI tools, often on personal accounts, often with real client data, because nobody has said otherwise. An AI policy for client data closes that gap before January turns it into a bigger problem.

The QuickBooks test

Here is a simple way to think about it, and it is the one we use when we talk to practices about this. Would you put this information into QuickBooks, or into your practice management software, without a second thought?

If yes, it is probably fine to put into a business AI account with the right settings. If you’d hesitate, that hesitation is your answer. The test works because your team already has good instincts about client data. They just have not been asked to apply those instincts to AI.

The point is not that AI is unsafe. ChatGPT, Claude and Gemini all offer business tiers where your prompts are not used to train the underlying model, which is a different proposition entirely from the free consumer versions. The point is that most staff do not know which version they are using, or what the setting actually does, and a policy is what tells them.

What January makes worse

Busy season is exactly when people cut corners, because busy season is when everyone is trying to save time. That is also exactly when AI tools are most useful, for drafting client emails, summarising long document trails, or getting a first pass at commentary on a set of accounts. We have written before about where AI genuinely pays off for accountants, and the time saved is real.

But the same pressure that makes AI tempting in January is the pressure that makes people paste first and think later. A policy written in October, when nobody is under deadline, is far more likely to be sensible than one drafted after something has already gone wrong in the middle of tax season.

An AI policy for client data does not need to be long. It needs to say which tools are approved, which account type staff should be logged into, what categories of data are never to be typed into a chat box (client bank details, National Insurance numbers, anything under an NDA), and who to ask if someone is not sure. Four decisions, written down, saves four seconds of guesswork multiplied by every member of staff, every week.

Writing the policy without overthinking it

You do not need a lawyer to draft this, and you do not need to ban AI to be safe. Most of the risk in client data handling is the same risk you already manage with email and file sharing: it is about who has access, not about the existence of the tool.

Start with three categories. Data that can go into any AI tool freely (general research, public information, template drafting with no client names attached). Data that can go into an approved business account only, with training data settings turned off (anonymised figures, draft commentary with names removed). Data that never goes into AI at all (anything a client would reasonably expect to stay inside your systems, full stop).

This sits alongside your wider obligations under UK data protection law, and if you have not looked at how AI use interacts with GDPR specifically, our guide to staying GDPR compliant when using AI covers the detail on consent, data processing agreements and what counts as a reasonable safeguard.

Make it something the team actually uses

A policy that lives in a folder nobody opens is not a policy, it is a document. The practices that get this right put the policy somewhere staff see it, run it past the team in a short meeting rather than an email, and revisit it every few months as the tools change.

It is also worth being honest that writing a policy is the easy part. The harder part is building the habit of checking before pasting, and that habit comes from training, not from a PDF. This is one reason we built it into the modules we teach for accountancy teams specifically, because a policy without practice does not change behaviour under deadline pressure.

If you want a starting point rather than a blank page, we put together a free AI policy template that covers the categories above and is built around how UK accountancy practices actually work. It takes less time to adapt than it will take to draft one from scratch in the middle of January.

The real cost of not having a policy is not a dramatic data breach, most of the time. It is the slow erosion of client trust when they find out, as some eventually will, that their figures went through a free AI tool nobody checked. For a profession built on confidentiality, that is a conversation worth avoiding.

If you want to see where the risk actually sits in your practice, book a call and we will talk it through before the busy season starts.