Most accountancy practices already have AI in the work: someone writing a summary of a client's correspondence, a first draft of a management accounts commentary, a spreadsheet formula explained at eleven at night in the busy season. The profession's bodies have said what they expect, and a practice's AI policy is where it writes down how it meets those expectations.
What the profession has said
ICAEW's 2025 Code of Ethics brought in the international technology revisions to the profession's code, and its guide to generative AI applies the fundamental principles to it directly. Under that guide, confidentiality applies to whatever a member puts into a tool, members should understand a tool's risks and limitations, and professional scepticism applies to its output as much as to anyone else's. Other institutes that follow the same international code have made similar changes.
For audit, the Financial Reporting Council published guidance on AI in audit in June 2025, followed in March 2026 by guidance on generative and agentic tools. It sets out proportionate documentation and the risks to audit quality, although it adds no new requirements. In the United States, check the AICPA and your state board, and elsewhere your own institute. Your institute's code and your compliance principal decide the position for your practice, and nothing here is professional or regulatory advice.
Five parts that carry more weight
The structure is the same as any AI policy, which what an AI policy should contain sets out and the AI policy outline gives you section by section. These five parts are where a practice's version differs.
Client financial data
The data list starts with clients' financial records, and the default for them is no, on any tool and any account, unless a condition is met. That covers bank statements, ledgers, tax computations and correspondence with the tax authority.
Because it is personal data about your clients' people, who never chose your tools, payroll needs its own line. Results for a client whose shares are traded can be inside information before they are announced, and that needs a line of its own as well.
Figures are checked against the source
Even when it sums up a ledger fluently, a tool can get a total wrong. A line that works reads something like this:
That is professional scepticism written as a rule, and it is the line the rest of the policy depends on.
Audit engagements
If the practice audits, AI used on an engagement needs its own rule: which tools are approved for audit work, how their use is documented on the file and who reviews it. The FRC's guidance is the starting point for what proportionate documentation looks like.
Engagement terms
Decide what, if anything, your engagement letters say about AI. Some clients now ask, and some larger ones set their own terms for advisers. Before AI is used on a client's work, the policy should send people to that client's terms, and the register should note any client that has said no.
AI arriving inside practice software
Cloud accounting and practice management platforms are adding AI features of their own, and those features read the client data already held there. Treat each one as a new tool: review it, decide whether it is switched on and put it on the register before a release note tells you it is already live.
The rules have to survive the deadline season
The test of a practice's policy is the week before a filing deadline, when everyone is behind and a shortcut looks reasonable. So that the rules hold up that week, keep the acceptable use page to one page, make the approved tool the fastest option and put the review rule where people will see it when they are tired.
Where this fits
For a practice, the policy is written in a half-day with the partners and whoever leads on compliance, as the first output of Govern. The readiness snapshot shows which tools are already in use and what they can reach, including AI features already live in practice software. How the whole route works for accountancy and law firms is on the professional services page, and the law firm version covers the other half of that sector.