AI for accountants in the UK: safe uses and review steps

This guide is for partners and managers of UK accounting practices choosing a first AI tool or reviewing what staff already use. Two changes make it current. Making Tax Digital for Income Tax began on 6 April 2026 and widens in April 2027 and April 2028, adding quarterly work per client. Xero’s developer terms, updated on 2 March 2026, bar using data from its API to train AI models. While building Filyst, our case management product, we made the server reject self-approval, so a person cannot sign off their own work. The sections cover safe uses, the ICAEW Code, data protection, Xero, tax, anti-money laundering checks, records and where to start.

What is AI for accountants?

AI for accountants is software that reads client documents and drafts entries, emails and summaries, while qualified staff decide what is sent and what reaches the books. It covers general chat tools, extraction tools that read statements and receipts, and assistants built into accounting software.

The safe pattern has one gate: a named person approves each output before it leaves the practice or posts to the ledger. The workflow below shows where that gate sits.

Which AI uses are safe for an accounting practice?

Risk depends on what the AI decides and what a person checks before the output is used. The table sorts common practice uses into three bands. The bands are our reading of the rules in the sections below, not an ICAEW classification.

What does the ICAEW Code of Ethics say about AI?

ICAEW’s generative AI guide says the five fundamental principles apply to the use of technology: integrity, objectivity, professional competence and due care, confidentiality and professional behaviour. The ICAEW Code of Ethics references these five principles from the International Ethics Standards Board for Accountants (IESBA) Code.

The IESBA Code was updated in 2022 to name technology threats. They include compromised objectivity caused by undue influence of, or reliance on, technology (section 112.1) and inadequate professional competence and due care due to limited awareness and understanding of technology (113.1 A2). ICAEW applies the principles to AI as follows:

• Competence:generative AI tools “are not fully qualified accountants”. Accountants should understand how a tool works, including its risks and limitations, and exercise professional scepticism when reviewing its output.
• Confidentiality: do not load confidential client or firm information into public generative AI tools.
• Objectivity:avoid automation bias, the habit of trusting a machine’s output over one’s own judgement.
• Skills: keep developing knowledge of generative AI through continuing professional development.

ICAEW’s dos and don’ts add two instructions a practice can write into its procedures: have policies and guidelines on how AI should be used, and include humans in the loop.

When does a practice need a DPIA for an AI tool?

In most cases. The data protection regulator says that in the “vast majority of cases” using AI involves processing likely to result in a high risk to individuals, which triggers a data protection impact assessment (DPIA), sometimes called a privacy impact assessment. Where a practice decides its use is not high risk, it should document why.

The UK General Data Protection Regulation (UK GDPR) applies to the automated or structured processing of personal data (Article 2(1)), so it covers client data in any AI tool. Article 35(3) requires a DPIA in three listed cases:

• systematic and extensive automated evaluation of people, including profiling, with legal or similarly significant effects;
• large-scale processing of special category data or criminal offence data;
• systematic monitoring of a publicly accessible area on a large scale.

Most practice AI fits none of the three. The regulator’s screening list adds a fourth route that does fit: innovative technology, including AI, combined with any one of the European criteria, such as evaluation or scoring, sensitive or highly personal data, or large-scale processing. Size alone rarely triggers it, because the regulator says “individual professionals processing patient or client data are not processing on a large scale”. The Information Commission took over the Information Commissioner’s Office (ICO) functions on 30 September 2026, and its DPIA and AI guidance is marked as under review after the Data (Use and Access) Act 2025.

DPIA for AI tools walks through the screening steps, and is ChatGPT GDPR compliant? covers general chat tools and client data.

How should AI-prepared entries reach Xero?

As drafts where Xero allows them, and through the practice’s own review screen where it does not. Xero’s Accounting API, the interface other software uses to write to Xero, accepts invoices, bills and manual journals as drafts, but bank transactions only as authorised, deleted or voided.

A bank line written through the API is live in the ledger at once. AI-prepared bank lines therefore wait in a separate review screen, where staff approve or correct them before the integration posts them. Bank statement extraction software lists the balance checks to run before that approval.

Two Xero terms matter for AI. Since 2 March 2026, data obtained from Xero’s APIs may not be used to train AI or machine learning models. Xero also prices apps by plan: Starter allows 5 connected organisations at no charge, and Core allows 50 for $35 AUD a month with 10 GB of monthly data egress, then $2.40 AUD per GB, tax exclusive. Xero API pricing, limits and integration covers the connection, rate limits and tiers.

Where does AI help with Making Tax Digital for Income Tax?

AI helps by reading the receipts and statements clients send, so the digital records behind each quarterly update stay current and a person reviews the totals before submission. Making Tax Digital (MTD) for Income Tax requires digital records and quarterly updates to HMRC.

MTD for Income Tax applies to a client when all three conditions are met:

• the client is a sole trader or landlord registered for Self Assessment;
• the client has income from self-employment, property, or both;
• the client’s qualifying income is over the threshold for the tax year HMRC checks.

HMRC lists exemptions separately on its eligibility page. For the first year, the first quarterly update was due by 7 August 2026 and the second is due by 7 November 2026. Making Tax Digital for Income Tax: thresholds and deadlines sets out every date and duty.

Can AI carry out AML checks for a practice?

AI can read identity documents and company records, but the customer due diligence duty stays with the practice and a named person decides. The Money Laundering Regulations 2017 (MLR 2017) apply to “relevant persons”, which include external accountants and tax advisers (regulation 8(2)(c)).

Regulation 28(2) requires a relevant person to identify the customer, verify the customer’s identity and assess the purpose and intended nature of the business relationship. Regulation 28(12) says the extent of those checks must reflect the firm’s own risk assessment under regulation 18(1), and regulation 18(4) requires a written, up-to-date record of that assessment. An AI risk score is an input to that judgement, not the judgement.

The anti-money laundering (AML) records work in two layers. The AML firm-wide risk assessment sets how deep each client’s checks go; the client onboarding checklist collects the due diligence documents; and AML record keeping requirements explains how regulation 40 keeps them for five years from the end of the business relationship.

How long should a practice keep AI-processed records?

As long as the record the AI helped produce must be kept. Store the AI log, showing input, output, reviewer and changes, with that record so both are kept and deleted together.

What should a practice put in writing before staff use AI?

Two documents: an AI policy that names the approved tools, the data staff may enter and who signs off, and written answers from each vendor before any client data goes in. The AI policy template for UK accounting firms gives a policy to adapt.

Where should a practice start with AI?

Start with one task staff re-type by hand for every client, add AI there with a rule check and an approval step, and track three numbers: staff hours per client, the share of AI outputs reviewers change, and errors found after posting. A change rate near zero with very fast approvals is a sign review has become a formality.

This page is the accounting hub of a wider guide. AI in regulated industries covers the UK rules that apply to every regulated firm, including human review under UK GDPR. Software for accounting practices describes what we build for practices.

Our two-week workflow audit maps a practice’s systems, who re-types what and where AI could help, and ends with a written plan and a fixed quote. It costs £950, credited in full against a build agreed within 90 days. It is not a compliance review: it flags questions for the practice’s compliance person to decide. A pilot on one workflow starts from £3,000, and an integration costs £900–2,000. Prices are in GBP and exclude VAT.

Frequently asked questions

Sources

1. ICAEW, Generative AI guide: ethics
2. ICAEW, Generative AI guide: dos and don'ts
3. UK GDPR Article 2 (material scope), legislation.gov.uk
4. UK GDPR Article 35 (DPIA), legislation.gov.uk
5. ICO, When do we need to do a DPIA?
6. ICO, What are the accountability and governance implications of AI?
7. GOV.UK, Information Commission succeeds the ICO (30 September 2026)
8. Xero, Accounting API OpenAPI specification (status enums)
9. Xero Developer, Pricing and policies
10. HMRC, Check if you're eligible for Making Tax Digital for Income Tax (updated 26 March 2026)
11. HMRC, Quarterly updates for Making Tax Digital
12. Money Laundering Regulations 2017, regulation 8
13. Money Laundering Regulations 2017, regulation 18
14. Money Laundering Regulations 2017, regulation 28
15. Money Laundering Regulations 2017, regulation 40
16. GOV.UK, Company and accounting records
17. GOV.UK, How long to keep your records (self-employed)