AI Policy Template for Accounting Practices

Build Your AI Use Policy

List the AI tools your practice approves. For each one, name the plan, the workspace staff must sign in to and the work it can be used for. Add your input bans, review rules, contacts and review date.

Load the example to see a fictional practice that uses a team workspace to draft generic checklists from public material. The example keeps client information inside the practice and assigns sign-off to the engagement reviewer.

The draft updates as you fill in the entries. Select Check entries to see missing approvals or contacts. Copy the draft or download it as plain text, then edit it in your usual document editor for practice approval.

What an AI Policy Must Cover

Tool Approvals and Banned Inputs

Approve a specific plan and workspace for a specific task. Check who can access prompts and files, how long the provider keeps them and whether it uses them for training or passes them to another party.

The template bans tax file numbers (TFNs), passwords and access codes. It also keeps personal information out of publicly available generative AI tools. Add any tighter practice bans, such as bank details or unpublished client accounts.

Review and Sign-Off

Name who compares AI output with source records and who signs off before the work goes to a client. The Tax Practitioners Board (TPB) says registered tax and BAS agents remain responsible for competent services when they use AI.

Client Disclosure and Permission

Code item 6 requires a registered practitioner to obtain permission before disclosing information about a client’s affairs to a third party, unless there is a legal duty to disclose. The tool’s settings can determine whether a third party receives it.

Use the permission option only for a workflow your practice can approve. Describe what would be shared, who would receive it and where it would be held. Record permission before sharing and apply the input bans in either mode.

Suspected Breaches

Name the person who receives incident reports. If staff paste client information into an unapproved tool, they stop using it and report what was shared and where. The incident contact contains the exposure and checks any notification duties.

Australian AI Policy Guidance

The TPB guidance on AI and the Code explains how checking AI output and applying professional judgement help practitioners meet their duty of competence. The review clause gives staff a person to go to and a point at which approval is due.

For practices covered by the Privacy Act, Australian Privacy Principle (APP) 6 limits use and disclosure of personal information and APP 11 requires reasonable steps to protect it. The privacy regulator’s guidance on commercial AI explains how provider terms and settings can affect those duties.

The TFN Rule sets separate duties for TFN information. TFN recipients can also have duties under the Notifiable Data Breaches scheme when an incident involves that information.

The Australian Government’s voluntary AI Ethics Principles call for accountable oversight and privacy protection. The template names a policy owner and limits what staff can share. Its disclosure clause supports the principle of transparency.

Rolling the Policy Out to Staff

Have a principal approve the tool list and the sign-off and incident arrangements. Store the approved version where staff find practice procedures and give them the reporting contact during training.

Use a sample prompt in training. Ask staff to identify which workspace they would use, what information they would remove and who must review the result. Use fictional material.

Set the next review date before issuing the policy. Review earlier if a provider changes its terms, staff add a new AI task or the practice has an incident.