For a growing accountancy firm, AI can offer an immediate operational benefit: less time spent summarising documents, preparing first drafts, finding information and handling repetitive work.
The governance questions can feel less immediate.
Who is using which tools? What information are they sharing? How are outputs checked? Which existing obligations apply, and who is tracking what changes next?
For firms with a few hundred employees, those questions deserve attention before an incident makes them urgent.
The gap between adopting AI and preparing for its consequences
A firm does not need thousands of employees to handle sensitive client information or produce advice that clients rely on.
Nor does it need a formal AI transformation programme for AI to enter its workflows. Someone might use a tool to summarise a document, explain a technical issue or prepare a client communication.
These are illustrative examples, but they expose an important question: does the firm understand where AI is influencing its work?
A risk or compliance function may exist without having a clear view of that activity. Responsibility can sit between IT, practice leaders, compliance and individual engagement teams, with no single owner connecting the picture.
The concern is not that people are deliberately ignoring risk. It is that operational adoption can move faster than the processes intended to govern it.
Existing responsibilities still matter
AI preparedness is not only about legislation that may arrive in the future.
Where AI processes personal information, existing data protection requirements can already be relevant. The ICO provides guidance specifically on applying data protection principles to AI. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/
Professional responsibilities also remain important. For members and regulated firms undertaking UK tax work, ICAEW’s PCRT guidance explains that responsibility for work remains with the member or firm when AI is used. It addresses confidentiality, professional competence and due care. https://www.icaew.com/technical/tax/working-in-tax/pcrt/topical-guidance-application-of-pcrt-to-ethical-use-of-artificial-intelligence-tools
Firms should also assess new requirements as they become applicable. That requires understanding the firm’s activities, jurisdictions and role in using or supplying AI. For example, the EU AI Act does not apply identically to every UK accountancy firm simply because it uses AI. https://digital-strategy.ec.europa.eu/en/faqs/navigating-ai-act
The practical task is to distinguish what applies now, what may apply next and what does not apply to the firm’s circumstances.
Financial exposure and reputational damage can overlap
Regulatory penalties are one possible consequence of certain breaches. They are not automatic, and their availability and severity depend on the applicable rules and circumstances.
But a preparedness discussion that stops at fines is incomplete.
Consider a hypothetical incident in which confidential client information enters an unsuitable AI service, or an inaccurate AI-assisted statement reaches a client without adequate checking.
The firm may need to investigate, correct work, involve advisers and explain what happened. Depending on the circumstances, there may also be contractual, professional or regulatory consequences.
At the same time, the client may ask a more fundamental question:
Can we still trust how this firm handles our information and exercises professional judgement?
For a firm with limited management capacity, dealing with the operational response and rebuilding confidence could put considerable pressure on the business. Headcount alone does not determine its ability to absorb that pressure.
Start with a manageable preparedness exercise
A growing firm does not need to begin with an elaborate governance programme. It can start by answering six questions:
- Where is AI being used? Identify actual workflows, including informal use.
- What information enters those workflows? Understand personal, confidential and commercially sensitive data.
- Who owns each use case? Assign a person who can make decisions and resolve exceptions.
- What must be checked? Define review requirements appropriate to the consequences of an error.
- What evidence is retained? Record relevant approvals, checks and decisions proportionately.
- Who monitors obligations and incidents? Establish a process for regulatory developments, escalation and response.
These answers should change as tools, workflows and responsibilities change. An approval made once cannot explain everything that happens afterwards.
AI governance deserves attention while a firm still has the opportunity to prepare calmly.
If a client asked tomorrow how AI had been used in their work, could your firm give a clear, evidenced answer?