Practices ask the same question in different words: "Are we allowed to do this?" The answer is almost always yes, with conditions, and the conditions are consistent across ICAEW, ACCA, the ICO and HMRC. A person is accountable. Client data is protected. Output is checked. Nothing is filed by a machine on its own. Build to those four and you are inside every piece of guidance below.
ICAEW: the generative AI guide
ICAEW's Generative AI Guide was written in 2023 and reads as current. The positions that matter for a practice:
- Output "can be inaccurate", "can be biased" and "can be inconsistent". The response is "practising professional scepticism and questioning the output".
- Public tools "may breach data privacy and security requirements". The legal section says organisations should not put confidential information or personal data into a generative AI tool, and the ethics section adds that this holds even where the information has become public.
- "You should define and implement a policy for the governance of generative AI." The do's and don'ts list: have policies, train staff, start small, include humans in the loop, review and challenge output while avoiding automation bias, be transparent; do not abdicate responsibility or fall foul of data protection and IP.
What that means in a build: the model never has the last word, client data only goes to approved business-tier tools, and the practice writes the policy down. We published an AI policy template for accountants that follows the guide section by section.
ACCA: the pointers for a firm's AI policy
ACCA's technical alert on AI policy is a checklist rather than a template: purpose and scope, roles and responsibilities, a human in the loop, and links to the firm's data protection and IT policies. It overlaps almost entirely with ICAEW's position, which is convenient: one policy satisfies both.
The ICO: AI and data protection
The ICO's guidance on AI and data protection is the piece with teeth, because it is law rather than professional expectation. For a small practice the points are:
- DPIA by default. In the vast majority of cases, using AI on personal data is processing likely to result in a high risk, which triggers the legal requirement for a Data Protection Impact Assessment.
- Controller and processor. The practice decides purposes and means, so it is the controller whatever the contract says; the AI provider is usually a processor. The practice does its own due diligence, and if it cannot assess a provider's compliance it should choose another.
- A lawful basis per purpose, decided before processing and recorded in the privacy notice.
- Data minimisation. Only what the task needs; nothing collected on the off-chance it is useful later.
The Data (Use and Access) Act 2025 adjusted some of this (a "recognised legitimate interests" basis, lighter rules on automated decisions where safeguards exist, a complaints-handling duty) and its data protection provisions are in force as of 2026. The ICO notes its AI guidance is under review in light of it. The practical position for a practice has not changed: do the DPIA, record the basis, keep a person in the loop.
Making Tax Digital: the cycle that creates the work
MTD for Income Tax is live. Sole traders and landlords with qualifying income over £50,000 should have started from 6 April 2026; over £30,000 from April 2027; over £20,000 from April 2028 (gov.uk eligibility). Qualifying income is gross self-employment and property turnover before expenses, excluding employment, dividends and pensions.
Each client in scope sends four quarterly updates (standard quarters ending 5 July, 5 October, 5 January and 5 April, due a month and two days later) plus a final return by 31 January. The updates are cumulative category totals, no receipts attached, sent even when nil. For a practice that means four extra touchpoints per client per year where the books have to be in a fit state, which multiplies the query-clearing and receipt-chasing work that already dominated the week.
What automation can do here is everything around the submission: chase the records before each quarter closes, clear the queries, draft the client's confirmation message, flag the clients whose books will not be ready. What it must not do is the submission itself without a person. That stays inside your MTD software with a human pressing the button, which is both the sensible design and the one the guidance above expects.
What practices are doing with it
Xero's 2026 survey of 520 UK practice leaders reports AI saving practices an average of 7.1 hours a week, self-reported, with the top performers at 10.6, and finds that practices using AI daily are far more likely to have documented processes (87% against 18% of non-adopters). AccountingWEB and Sage's 2026 state-of-the-nation survey of 600 members found only about a quarter "very confident" they understand AI's capabilities and limits. Read together: the hours are real for practices that have done the groundwork, and most practices have not done it yet.
The groundwork is the policy, the register, the DPIA and documented processes. Then the build. The accountancy practices page sets out how we handle both halves, and what each stage costs.
Founder, Anco AI. Builds the systems this site talks about, and runs his own business on them.
