Skip to content
Skip to content

Practical accounting administration guide · By Yes AI

Writing an AI use policy for practice staff

Published 5 min read

Staff may already be using AI tools to draft emails, summarise documents and fix spreadsheet formulas. A written policy tells them which tools are approved, what client information may go into them and how outputs are checked. This guide sets out what the policy should cover, drawing on the Tax Practitioners Board's July 2026 guidance on AI. It is administrative guidance, not legal advice.

Get help setting AI rules for your teamCall (03) 9003 0111Book a free practice consultation

Quick answer

A practice AI use policy should list approved tools and accounts, bar client information from public AI tools, set out when client permission is needed, require a person to review every output before it reaches a client or ledger, and say what records to keep. The TPB's Guidance Statement TPB(GS) 55/2026 explains how the Code of Professional Conduct applies to AI, and the OAIC's guidance covers privacy.

Small team of accounting staff in a Newcastle office meeting room discussing a printed policy document
Walking staff through the policy with examples from your own work makes the rules easier to follow.

Why does a practice need an AI use policy?

The TPB's guidance statement on AI, issued on 22 July 2026, says tax practitioners remain responsible for the services they provide when using AI and should not rely on AI output as a substitute for their own analysis. It also points to the Determination's requirement to establish, document and enforce a system of quality management. An AI use policy is one of the documented procedures that system can include. Without one, each staff member decides alone what goes into which tool, and the practice cannot show how AI use is controlled.

Which tools should the policy approve?

List each approved tool by name, the account type staff must use and what it may be used for. Separate business accounts set up by the practice from personal or free accounts, because data retention and model training settings can differ between them. Note the AI features built into software the practice already uses, such as the ledger, the practice management system or the email client, since those may process client data without staff opening a separate tool.

  • Tool name and account type, with practice business accounts only.
  • Approved uses, such as drafting, summarising or formula help.
  • Whether client information may be entered.
  • Who approved the tool, and when it is next reviewed.

What client information can go into AI tools?

The OAIC recommends, as best practice, that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools. The TPB says registered agents must obtain each client's permission before disclosing client information to a third party, which can include entering it into AI tools depending on how they are configured, and that permission can come through a signed engagement letter, signed consent or other communication. Give staff one simple rule: no client information in any tool that is not approved for it, and approved tools used only within what the engagement letter permits.

How should staff check AI outputs?

The TPB notes that AI models may hallucinate or give inaccurate information, and says practitioners should verify AI-generated content at each step of the workflow and document those steps. Turn that into a rule staff can follow: every AI output that reaches a client, a ledger, a working paper or a lodgement is read and checked by a person with the skills to judge it. Calculations are recomputed. References to legislation or ATO guidance are checked against the source. The reviewer's name goes on the file.

What records should staff keep?

Section 30 of the Determination requires practitioners to keep records that correctly record the tax agent services provided to each client. Where AI was used in that work, the record should show which tool was used, for what, and who reviewed the result. Keep this light: a note on the job or working paper can cover most tasks. For automated workflows, the system's own log can serve as the record if it shows the input, the output and the review.

How do you introduce the policy to staff?

Run a short session that walks through the policy with examples from your own work, using fictional client details. Show an approved tool with its settings, a prompt that would break the client information rule, and an output with an error that a reviewer should catch. Ask staff which tools they already use, since that list is the starting point for approvals. Review the policy when the TPB or OAIC updates its guidance, when someone requests a new tool, and at least once a year.

AI use policy areas and the guidance behind them

Policy areaDecision for the practiceRelevant guidance
Approved toolsWhich tools, which accounts and which usesOAIC due diligence on AI products
Client informationWhat may be entered, and in which toolsTPB Code item 6; OAIC best practice on public AI tools
Client permissionEngagement letter wording for AI and third partiesTPB(GS) 55/2026 on confidentiality
Review of outputsWho checks what before it is usedTPB guidance on competence and reasonable care
RecordsWhat is noted on the job, and whereSection 30 of the Determination
Tax file numbersWhether TFNs may ever be enteredPrivacy (Tax File Number) Rule 2015
Policy ownershipWho owns the policy and when it is reviewedSection 40 of the Determination on quality management

Practical checklist

  • Every approved tool is listed with its account type and permitted uses.
  • The policy states that no client information goes into unapproved tools.
  • Engagement letters cover any AI tools that process client information.
  • Every output that reaches a client, ledger or lodgement has a named reviewer.
  • Staff know where to record AI use on a job.
  • The policy names an owner and a review date.

Common questions

Does the TPB ban AI tools?

No. The TPB's guidance says AI tools, used appropriately, offer productivity benefits, and it explains how existing obligations apply when practitioners use them. It does not create obligations beyond those in the Tax Agent Services Act 2009 and the Code. The requirements on competence, reasonable care, confidentiality and records apply to AI-assisted work as to any other work.

Do BAS agents need an AI policy too?

The TPB's guidance applies to registered tax agents and BAS agents, which it calls tax practitioners. A bookkeeping practice that is a registered BAS agent has the same Code obligations on confidentiality and competence when its staff use AI, so the same policy areas apply.

Can staff use AI features built into Xero or Microsoft 365?

Treat built-in AI features like any other tool. Check what data they process, where and under what terms, then decide whether they are approved for client information. A feature inside software the practice already licenses may still send data to a separate AI service, so read the vendor's documentation before approving it.

What about personal AI accounts on staff phones?

Say plainly in the policy that client information never goes into personal accounts. Personal accounts sit outside the practice's control, and their data settings may allow the provider to use what is entered. If a staff member finds a personal tool useful, the request goes to the policy owner for review.

Should the policy cover AI note-takers in client meetings?

Yes. Meeting note-takers record and transcribe what clients say, which can include personal and financial information. The policy should say whether they are approved, how clients are told before recording starts, where transcripts are stored and who reviews the summary before it goes on the file or to the client.

Do we need to tell clients we use AI?

Where entering client information into an AI tool counts as disclosure to a third party, registered agents need the client's permission. The TPB recommends telling clients to whom and where the disclosure is made, where data is stored and whether AI tools may be used. The OAIC also expects privacy policies to explain an organisation's use of AI.

Sources and further reading

Continue planning

Plan the administration around professional review

Describe the administrative task, systems and review responsibilities. We can discuss document intake and staff handovers. Use a fictional example without client records or credentials. Accounting judgements, advice and sign-off remain with your practice.

Get help setting AI rules for your teamCall (03) 9003 0111Book a free practice consultation