Your clients are sending vendor questionnaires, and one section keeps showing up: how does your firm use artificial intelligence with client data? If you don’t have a written AI policy for accounting firms in place, you’re not alone. Most small firm owners are answering these questions verbally, inconsistently, or not at all. That gap is becoming a credibility problem, and this post gives you a concrete starting point to close it.

Why Clients Are Suddenly Asking About AI Policy for Accounting Firms

Your clients are being asked the same questions by their own boards, insurers, and larger customers. A business owner who has to document how their vendors handle sensitive financial data now has to include their accountant, and whether AI tools are involved. This isn’t paranoia. It’s a reasonable downstream effect of data security expectations working their way into everyday vendor relationships.

The second driver is media coverage. Stories about employees accidentally submitting confidential data to large language models have made clients nervous, and rightfully so. They’re not asking because they distrust you. They’re asking because they need documentation, and right now you may not have any to give them.

A written policy doesn’t have to be long or technically dense. For a firm of 5 to 20 people, one clear page is more useful than a 20-page document nobody reads. The goal is to describe what you actually do, not what you wish you did, and not what a large enterprise firm might do.

What a One-Page AI Policy for Accounting Firms Should Cover

Below is a working outline you can adapt. Each section should be short: two to five sentences is enough. The point is specificity, not length.

The Six Sections to Include

• Approved tools. Name the AI tools your staff are permitted to use, for example Microsoft Copilot within your Microsoft 365 tenant, or a specific tax research assistant. If a tool isn’t on the list, staff should not use it with client work until it’s reviewed. “Staff use their judgment” is not a policy.
• What client data may never enter a tool. Be explicit. Social Security numbers, EINs, bank account numbers, and individual financial statements should not be pasted into general-purpose AI chat tools. If your approved tools run under an enterprise agreement that processes data within your tenant, say so, but don’t claim protections you haven’t verified.
• Review and sign-off of AI output. Any AI-assisted draft, whether a memo, a tax position summary, or a client-facing email, must be reviewed by a qualified staff member before it goes out. State who is responsible for that review. This is quality control, and it is also your professional liability position.
• Vendor no-training and data retention terms. For each approved tool, document whether you have confirmed that the vendor does not use your inputs to train its models and does not retain client data beyond a defined period. Microsoft’s privacy documentation is one example of where to find and cite these commitments. If you can’t confirm this for a tool, it shouldn’t be on your approved list.
• Incident handling. Describe what happens if a staff member realizes they’ve submitted data they shouldn’t have. There should be a single point of contact (likely you or your office manager), a simple internal report, and a decision process for whether client notification is warranted. You don’t need a 10-step incident response plan. You need a clear first step and an owner.
• Staff acknowledgment. Each staff member should sign or digitally acknowledge the policy annually. This isn’t about distrust. It ensures everyone has actually read it, and it creates a defensible record if a client asks whether your policy is enforced.

What to Leave Out of Your AI Policy

This is where small firm owners get into trouble: writing promises they can’t keep because they’ve borrowed language from an enterprise security policy or a vendor’s marketing page.

Don’t write that your firm uses “enterprise-grade encryption” unless you have verified what that means for each tool in your stack. Don’t promise “real-time monitoring” of staff AI use unless you have a system that actually does that. Don’t say client data is “never” processed outside the United States if you haven’t confirmed data residency with every vendor on your list.

A client who receives an overpromised policy and later discovers a gap will feel more deceived than if you had simply said “here is what we do and here is what we’re still working on.” Honest, accurate, and limited is the right tone. If an area is still developing, say a formal vendor review process, note that you are building it rather than pretending it exists.

Also leave out enforcement mechanisms you don’t intend to use. If you write that you conduct quarterly AI tool audits and you know you won’t, remove it. An unenforced policy is worse than no policy, because it creates a written record that you didn’t follow your own rules.

How to Roll Out an AI Policy for Accounting Firms Without Overcomplicating It

Start with a staff meeting, not a memo. Walk through the approved tool list together and ask whether anyone is using tools that aren’t on it. You may be surprised. Staff often adopt AI tools to work faster and genuinely don’t know the firm’s position, because the firm has never stated one. That conversation is more valuable than the document itself.

Once the policy is drafted, have your attorney do a quick review, particularly of the data handling language. A one-hour review is worthwhile given the professional liability context. The AICPA’s guidance on AI in the accounting profession is also worth reading as you draft, particularly around professional judgment and responsibility for AI-assisted output.

After the policy is signed, store it where your engagement letters live. When the next client questionnaire arrives asking about your AI practices, you’ll have a document to attach rather than an explanation to improvise.

The Practical Standard: Accurate, Documented, Enforced

An AI policy for accounting firms doesn’t need to be sophisticated. It needs to be true. The firms that answer client questionnaires with confidence are not the ones with the most advanced technology. They’re the ones who wrote down what they actually do and hold their staff to it.

If you’re starting from zero, use the six-section outline above. Draft it in plain language. Have your team read it. Update it when your tool stack changes. That is a standard a small firm can meet, and it’s what most clients asking these questions are looking for.

Want to see where your firm stands before you write it? Take the free AI readiness quiz, or book a call and we’ll work through your tool stack, client obligations, and staff workflow together.