The ICAEW's generative AI guide is direct about it: "You should define and implement a policy for the governance of generative AI", with "preliminary principles, guardrails or restrictions for use". Its do's and don'ts list starts with "Ensure you have appropriate policies and guidelines in place". The ICO's guidance on AI and data protection goes further, noting that in the vast majority of cases the use of AI on personal data will be the kind of processing that requires a Data Protection Impact Assessment. Neither body publishes a template. ACCA's technical alert on a firm's AI policy is the closest thing to a checklist, and it is a checklist, not a document you can sign.
So here is one. It is written for a practice of three to thirty people, it covers the tools you are actually using (the assistants, the features inside Xero, Karbon and Dext, meeting transcription, and anything you have had built), and it is structured so that the parts a regulator or an insurer would ask about are easy to find. Read it below, then take the editable copy.
Take the editable template
The full policy below as a Google Doc, with the register and the staff quick-reference, ready to put your practice's name on. First name and email, and it opens straight away.
Open the editable template → It opens as a Google Doc. Use File, Make a copy, to edit it as your own.
What the policy covers, and why each part is there
Scope that includes the tools you forgot about
Most draft policies cover "ChatGPT" and miss the AI already inside the practice software. JAX in Xero, Karbon's email summaries, Dext's extraction, the transcription in Teams. The template defines an AI tool as anything that generates output from a model, so the policy applies to all of it, and the register (Schedule A) is where you write down which ones are approved and for what.
Five principles, one of which does most of the work
Responsibility, confidentiality, scepticism, transparency and competence. The first is the one that matters: a named person reviews and signs off every output before it is relied on, sent, filed or posted. That single rule is what makes the rest of the policy enforceable, and it is the rule the ICAEW guide keeps returning to ("include humans in the loop", "review and challenge AI outputs with professional scepticism, avoiding automation bias").
Approved uses, and the list that is not negotiable
The template approves drafting, summarising, extraction with exact matching, narrative from prepared figures, research as a starting point, and writing automations. It prohibits, for any tool: client data in consumer services, relying on an AI answer to a tax or accounting question without checking the source, filing or posting anything unreviewed, decisions about individuals without human review, and anything that misrepresents who produced a document. The ICAEW legal page is unambiguous that confidential information and personal data should not go into a generative AI tool, and its ethics page adds that this holds even if the information has become public.
Client data: controller, processor, DPIA
Section 4 records what the ICO expects: a lawful basis per purpose, a DPIA by default, the practice as controller and the provider as processor, due diligence on terms and data location before approval, and data minimisation. The template's position is that if you cannot assess a provider's compliance, you choose another, which is the ICO's own wording.
Review and sign-off, including for automations
If your practice has had any automation built, section 5.3 is the paragraph to read. It requires that any automation using AI to propose postings, invoices, journals or client communications presents a plan for a person to approve first, and does not hold write access that bypasses that step. That is how we build them, and it is the design that keeps an automation inside this policy rather than outside it.
Transparency, training, incidents, review
A line in the engagement letter and privacy notice about the tools in use. Clients told when AI materially contributes to a deliverable. Meetings recorded only with everyone's knowledge. Annual training that includes recognising fabricated references and deepfakes (the ICAEW guide names deepfakes specifically). An incident route. A quarterly look at the register and an annual look at the policy, or sooner when a provider changes its terms, which they do.
How to adopt it in a week
- Monday: list every AI tool anyone in the practice uses, including the ones inside your software and the ones on personal phones. That list becomes Schedule A.
- Tuesday: for each tool, check the plan you are on and whether its terms prohibit training on your data. Business and API tiers generally do; free tiers generally do not. Move anything on a free tier to a business plan or off the register.
- Wednesday: name the policy owner and the sign-off level for client-facing and filed work. Fill in the brackets.
- Thursday: add the engagement-letter line and the privacy-notice paragraph. Brief the team using Schedule B.
- Friday: adopt it, date it, diarise the review.
What it does not do
It is not legal advice and it is not a DPIA. It gives you the structure to do both properly. If the practice is about to build automation on client data, the DPIA should be written alongside the build, and that is a conversation we have at the start of every engagement; the accountancy practices page describes how the compliance side is handled in practice.
Founder, Anco AI. Builds the systems this site talks about, and runs his own business on them.
