Generative AI can raise output in accounting firms, but unmanaged use also raises compliance, quality, and reputation risk. The workable policy is neither unrestricted access nor blanket prohibition. Firms need an AI-first operating model in which staff use AI for defined tasks, review stays with qualified professionals, and every prompt, draft, and approval step fits the existing control environment.
That claim rests on a simple fact: accounting work carries legal and financial consequences. Recent regulatory developments underline the point. The IRS continues to expand digital business tax account functions, including notice access, payment features, and EIN verification documents online. At the same time, state and local tax rules keep shifting, as shown by current disputes over residency-related tax administration in New York City. When rules move, firms need faster research and drafting, but they also need defensible review records.
Where does generative AI help an accounting firm without creating AI slop?
The strongest use cases sit around routine language work and structured internal analysis. Generative AI can draft client email summaries after a payroll tax notice arrives, create first-pass memos on updated paid family and medical leave credit guidance, or turn meeting notes into task lists for a month-end close. These tasks consume time, but they follow repeatable patterns.
The evidence for productivity gains is broad, even if task-specific results vary. A 2023 NBER working paper on generative AI in customer support found a 14% productivity increase on average, with larger gains for less experienced staff. An accounting firm should not copy that percentage into a business case, because tax research and client advisory work differ from customer support. The implication still holds: where work involves recurring text production against known standards, AI usually speeds the first draft.
Accounting software examples make the policy concrete. A team using QuickBooks Online for bookkeeping and a close automation product for reconciliations can ask a model to draft a variance explanation from exported general ledger detail, then route the draft into the close checklist. The workflow step matters more than the model name: ledger data enters a controlled template, the system stores the draft, and a reviewer approves or rewrites before client release.
That structure keeps AI useful. It also prevents the familiar failure mode in which staff paste raw outputs into client deliverables with no source check.
What creates most AI risk in accounting workflows?
The largest risk rarely starts with the model. It starts with uncontrolled process design. If staff enter client tax data into public tools without an approved data policy, the firm creates confidentiality risk. If a model drafts a nexus memo and no one verifies citations, the firm creates technical risk. If partners rely on AI summaries without reading the source notice, the firm creates governance risk.
Several external signals support a stricter approach to controls. The AICPA’s Statements on Standards for Tax Services place responsibility on the member for the work product and representations made to taxing authorities. The IRS does not shift accountability because software generated a draft. Meanwhile, software vendors continue to add AI features into bookkeeping, close, and practice management products. Product expansion increases the number of decision points where a firm must define whether AI can suggest, decide, or only prepare.
- Client-confidential data enters an unapproved public model
- Citations or thresholds appear in drafts without source verification
- AI writes outside the signed scope of work and triggers billing disputes
- Staff accept polished language as accurate technical analysis
- No audit trail connects prompt, source material, reviewer, and final output
A policy should therefore treat generative AI as a drafting engine inside a supervised workflow, not as an authority.
Which policy design works better: broad permission or controlled use cases?
Controlled use cases work better for most firms. Broad permission sounds efficient, but it produces uneven adoption and inconsistent controls. One manager may use AI only for internal note cleanup; another may use it to draft research positions from incomplete facts. The firm then carries different risk levels across similar engagements.
A controlled policy starts with named tasks. For example, a firm may permit AI for engagement letter summaries, internal SOP drafting, first-pass client emails, meeting note consolidation, and transaction coding suggestions below a set materiality threshold. The same policy can prohibit AI from final tax positions, unsigned client advice, source citation generation without verification, or any prompt containing protected client data in tools outside the approved stack.
This approach also aligns with total cost of ownership. Licence fees form only part of AI spend. Review time, rework, security assessment, and vendor management shape the real cost base. IBM’s Apptio business, which focuses on technology cost management, recently highlighted a common finance problem: organisations fund AI without a clear link to business value. The implication for accounting firms is direct. An AI policy should connect each approved use case to a measurable unit such as review minutes, days to close, write-up time, or turnaround time on routine notices.
Measurement needs care as well. Even adjacent digital metrics can mislead when systems classify activity badly, as shown in this analysis of AI referral traffic and distorted measurement. The accounting parallel is straightforward: if a dashboard counts every AI-assisted draft as time saved, while reviewer time and correction rates rise at the same pace, the metric masks cost rather than revealing value.
What should an accounting firm include in the policy document?
The policy should define scope, approved tools, data classes, review rules, and logging requirements. It should also assign ownership. IT can manage vendor approval, but tax and CAS leaders need to set the permitted use cases because they understand materiality, deadlines, and client expectations.
A practical standard includes one human review point before any client-facing output leaves the firm. For technical content, the reviewer checks source documents first and AI wording second. For bookkeeping workflows, the reviewer verifies the underlying transaction or reconciliation evidence before accepting the narrative explanation. Firms that want an AI-first culture need senior staff to model that behaviour by drafting the first pass of sensitive issues themselves and using AI to refine structure or clarity, rather than outsourcing judgement at the start.
The next step is a 30-day pilot on three controlled workflows: client notice summaries, month-end variance explanations, and internal SOP updates. The policy team should measure reviewer time, correction rates, and source-check compliance before any wider rollout.
Subscribe to our newsletter for the latest articles! Subscribe