# AI for accountants in the UK: safe uses and review steps

> How UK accountants can use AI safely: uses ranked by risk, the ICAEW Code, DPIAs, Xero drafts, Making Tax Digital, AML checks and record retention.

Pillar guide · Accounting practices · By Syed Husnain Khalid · Published 8 October 2026 · Last checked 8 October 2026
Drafted with AI. Each claim was checked against the primary sources listed below by AI on 8 October 2026; a person has not reviewed it yet.
Canonical: https://vexralabs.com/insights/ai-for-accounting-practices

Short answer

AI is safe in a UK accounting practice when it **reads and drafts while a qualified person checks and approves every output** before it reaches a client, HM Revenue and Customs (HMRC) or the books. The Institute of Chartered Accountants in England and Wales (ICAEW) applies its five ethical principles to AI and warns against overreliance on its output.

This guide is for partners and managers of UK accounting practices choosing a first AI tool or reviewing what staff already use. Two changes make it current. Making Tax Digital for Income Tax began on 6 April 2026 and widens in April 2027 and April 2028, adding quarterly work per client. Xero’s developer terms, updated on 2 March 2026, bar using data from its API to train AI models. While building Filyst, our case management product, we made the server reject self-approval, so a person cannot sign off their own work. The sections cover safe uses, the ICAEW Code, data protection, Xero, tax, anti-money laundering checks, records and where to start.

## What is AI for accountants?

AI for accountants is software that reads client documents and drafts entries, emails and summaries, while qualified staff decide what is sent and what reaches the books. It covers general chat tools, extraction tools that read statements and receipts, and assistants built into accounting software.

The safe pattern has one gate: a named person approves each output before it leaves the practice or posts to the ledger. The workflow below shows where that gate sits.

**Diagram: Review steps for AI in an accounting practice.** Six steps: client documents arrive; AI reads them and extracts the data; rules check totals and balances; a member of staff approves or corrects each entry in a review screen; approved entries are posted to the ledger, as drafts where the ledger allows them; and every step is logged on the client file with who approved it and when.

*AI does the reading. Rules do the maths. A person approves. The log records who.*

## Which AI uses are safe for an accounting practice?

Risk depends on what the AI decides and what a person checks before the output is used. The table sorts common practice uses into three bands. The bands are our reading of the rules in the sections below, not an ICAEW classification.

| Use | Risk | Review step |
| --- | --- | --- |
| Drafting client emails and meeting notes | Low | Staff read and edit before sending |
| Extracting data from statements, receipts and invoices | Medium | Rule checks, then staff approval before posting |
| Summarising management accounts for a client | Medium | An accountant checks every figure against the ledger |
| Scoring client money laundering risk | High | AI suggests; a named person decides and records why |
| Answering clients' tax questions | High | A qualified accountant answers; AI text is never sent as advice |

## What does the ICAEW Code of Ethics say about AI?

ICAEW’s generative AI guide says the five fundamental principles apply to the use of technology: integrity, objectivity, professional competence and due care, confidentiality and professional behaviour. The ICAEW Code of Ethics references these five principles from the International Ethics Standards Board for Accountants (IESBA) Code.

The IESBA Code was updated in 2022 to name technology threats. They include compromised objectivity caused by undue influence of, or reliance on, technology (section 112.1) and inadequate professional competence and due care due to limited awareness and understanding of technology (113.1 A2). ICAEW applies the principles to AI as follows:

- **Competence:**generative AI tools “are not fully qualified accountants”. Accountants should understand how a tool works, including its risks and limitations, and exercise professional scepticism when reviewing its output.
- **Confidentiality:** do not load confidential client or firm information into public generative AI tools.
- **Objectivity:**avoid automation bias, the habit of trusting a machine’s output over one’s own judgement.
- **Skills:** keep developing knowledge of generative AI through continuing professional development.

ICAEW’s [dos and don’ts](https://www.icaew.com/technical/technology/artificial-intelligence/generative-ai-guide/dos-and-donts) add two instructions a practice can write into its procedures: have policies and guidelines on how AI should be used, and include humans in the loop.

## When does a practice need a DPIA for an AI tool?

In most cases. The data protection regulator says that in the “vast majority of cases” using AI involves processing likely to result in a high risk to individuals, which triggers a data protection impact assessment (DPIA), sometimes called a privacy impact assessment. Where a practice decides its use is not high risk, it should document why.

The UK General Data Protection Regulation (UK GDPR) applies to the automated or structured processing of personal data (Article 2(1)), so it covers client data in any AI tool. Article 35(3) requires a DPIA in three listed cases:

- systematic and extensive automated evaluation of people, including profiling, with legal or similarly significant effects;
- large-scale processing of special category data or criminal offence data;
- systematic monitoring of a publicly accessible area on a large scale.

Most practice AI fits none of the three. The regulator’s screening list adds a fourth route that does fit: innovative technology, including AI, combined with any one of the European criteria, such as evaluation or scoring, sensitive or highly personal data, or large-scale processing. Size alone rarely triggers it, because the regulator says “individual professionals processing patient or client data are not processing on a large scale”. The Information Commission took over the Information Commissioner’s Office (ICO) functions on 30 September 2026, and its DPIA and AI guidance is marked as under review after the Data (Use and Access) Act 2025.

[DPIA for AI tools](https://vexralabs.com/insights/dpia-for-ai-tools) walks through the screening steps, and [is ChatGPT GDPR compliant?](https://vexralabs.com/insights/chatgpt-client-data-policy) covers general chat tools and client data.

## How should AI-prepared entries reach Xero?

As drafts where Xero allows them, and through the practice’s own review screen where it does not. Xero’s Accounting API, the interface other software uses to write to Xero, accepts invoices, bills and manual journals as drafts, but bank transactions only as authorised, deleted or voided.

| Xero record | Statuses the API accepts | Where a person approves AI output |
| --- | --- | --- |
| Invoices and bills | DRAFT, SUBMITTED, AUTHORISED, PAID, DELETED, VOIDED | In Xero: write as DRAFT, staff approve |
| Manual journals | DRAFT, POSTED, DELETED, VOIDED, ARCHIVED | In Xero: write as DRAFT, staff post |
| Bank transactions (spend and receive money) | AUTHORISED, DELETED, VOIDED | In the practice's review screen, before anything is sent |

A bank line written through the API is live in the ledger at once. AI-prepared bank lines therefore wait in a separate review screen, where staff approve or correct them before the integration posts them. [Bank statement extraction software](https://vexralabs.com/insights/bank-statement-extraction) lists the balance checks to run before that approval.

Two Xero terms matter for AI. Since 2 March 2026, data obtained from Xero’s APIs may not be used to train AI or machine learning models. Xero also prices apps by plan: Starter allows 5 connected organisations at no charge, and Core allows 50 for $35 AUD a month with 10 GB of monthly data egress, then $2.40 AUD per GB, tax exclusive. [Xero API pricing, limits and integration](https://vexralabs.com/insights/xero-api-integration-accounting-practices) covers the connection, rate limits and tiers.

## Where does AI help with Making Tax Digital for Income Tax?

AI helps by reading the receipts and statements clients send, so the digital records behind each quarterly update stay current and a person reviews the totals before submission. Making Tax Digital (MTD) for Income Tax requires digital records and quarterly updates to HMRC.

MTD for Income Tax applies to a client when all three conditions are met:

- the client is a sole trader or landlord registered for Self Assessment;
- the client has income from self-employment, property, or both;
- the client’s qualifying income is over the threshold for the tax year HMRC checks.

| Qualifying income over | In the tax year | Must use MTD from |
| --- | --- | --- |
| £50,000 | 2024 to 2025 | 6 April 2026 |
| £30,000 | 2025 to 2026 | 6 April 2027 |
| £20,000 | 2026 to 2027 | 6 April 2028 |

HMRC lists exemptions separately on its [eligibility page](https://www.gov.uk/guidance/check-if-youre-eligible-for-making-tax-digital-for-income-tax). For the first year, the first quarterly update was due by 7 August 2026 and the second is due by 7 November 2026. [Making Tax Digital for Income Tax: thresholds and deadlines](https://vexralabs.com/insights/making-tax-digital-income-tax) sets out every date and duty.

## Can AI carry out AML checks for a practice?

AI can read identity documents and company records, but the customer due diligence duty stays with the practice and a named person decides. The Money Laundering Regulations 2017 (MLR 2017) apply to “relevant persons”, which include external accountants and tax advisers (regulation 8(2)(c)).

Regulation 28(2) requires a relevant person to identify the customer, verify the customer’s identity and assess the purpose and intended nature of the business relationship. Regulation 28(12) says the extent of those checks must reflect the firm’s own risk assessment under regulation 18(1), and regulation 18(4) requires a written, up-to-date record of that assessment. An AI risk score is an input to that judgement, not the judgement.

The anti-money laundering (AML) records work in two layers. [The AML firm-wide risk assessment](https://vexralabs.com/insights/aml-firm-wide-risk-assessment) sets how deep each client’s checks go; [the client onboarding checklist](https://vexralabs.com/insights/client-onboarding-accountants) collects the due diligence documents; and [AML record keeping requirements](https://vexralabs.com/insights/aml-records-accountants) explains how regulation 40 keeps them for five years from the end of the business relationship.

## How long should a practice keep AI-processed records?

As long as the record the AI helped produce must be kept. Store the AI log, showing input, output, reviewer and changes, with that record so both are kept and deleted together.

| Record | Minimum period | Source |
| --- | --- | --- |
| Limited company accounting records | 6 years from the end of the last company financial year they relate to, or longer if they show a transaction covering more than one accounting period, the company bought something expected to last more than 6 years, the Company Tax Return was sent late, or HMRC has started a compliance check | GOV.UK, company and accounting records |
| Sole trader records | At least 5 years after the 31 January submission deadline of the relevant tax year | GOV.UK, self-employed records |
| Customer due diligence records | 5 years from when the practice knows or has reasonable grounds to believe the business relationship has ended | MLR 2017, regulation 40(3) |

## What should a practice put in writing before staff use AI?

Two documents: an AI policy that names the approved tools, the data staff may enter and who signs off, and written answers from each vendor before any client data goes in. [The AI policy template for UK accounting firms](https://vexralabs.com/insights/ai-policy-template-accounting-firms) gives a policy to adapt.

| Question for the vendor | Answer to look for |
| --- | --- |
| Is our data used to train your models? | No, or only with an opt-in we control |
| Will you sign a UK GDPR data processing agreement? | Yes, before the trial starts |
| Where is the data stored and processed? | Named locations, with transfer safeguards |
| Can staff approve or correct every output? | Yes, nothing is sent or posted without approval |
| Is every step logged? | Yes: input, output, reviewer, change and time |
| Can we export all our data and leave? | Yes, in a standard format |

## Where should a practice start with AI?

Start with one task staff re-type by hand for every client, add AI there with a rule check and an approval step, and track three numbers: staff hours per client, the share of AI outputs reviewers change, and errors found after posting. A change rate near zero with very fast approvals is a sign review has become a formality.

This page is the accounting hub of a wider guide. [AI in regulated industries](https://vexralabs.com/insights/ai-in-regulated-firms) covers the UK rules that apply to every regulated firm, including human review under UK GDPR. [Software for accounting practices](https://vexralabs.com/accountants) describes what we build for practices.

Our two-week workflow audit maps a practice’s systems, who re-types what and where AI could help, and ends with a written plan and a fixed quote. It costs £950, credited in full against a build agreed within 90 days. It is not a compliance review: it flags questions for the practice’s compliance person to decide. A pilot on one workflow starts from £3,000, and an integration costs £900–2,000. Prices are in GBP and exclude VAT.

Not legal advice

This guide summarises ICAEW guidance, the IESBA Code as ICAEW reports it, UK GDPR and the data protection regulator’s guidance, HMRC guidance, the Money Laundering Regulations 2017 and Xero’s developer documentation as at the date checked. It is not legal, tax or professional advice. The regulator’s DPIA and AI guidance is under review after the Data (Use and Access) Act 2025.

## Frequently asked questions

### Can accountants use AI under the ICAEW Code of Ethics?

Yes. ICAEW applies the five fundamental principles to AI: accountants should understand a tool's risks and limitations, apply professional scepticism to its output and keep confidential information out of public AI tools.

### Can AI post entries straight to Xero?

Xero's API accepts invoices, bills and manual journals as drafts, so staff can approve them in Xero. Bank transactions can only be written as authorised, so AI-prepared bank lines should wait for approval in the practice's own review screen.

### Does a small practice need a DPIA to use AI?

Usually. The data protection regulator says most uses of AI trigger a DPIA, because AI is innovative technology and is often combined with another high-risk factor such as scoring clients. If a practice decides a use is not high risk, it should record why.

### Can AI carry out AML checks for a practice?

AI can read documents, but the Money Laundering Regulations 2017 put customer due diligence on the practice, scaled to its own firm-wide risk assessment. A named person decides and records why.

### What should a practice automate with AI first?

One task staff re-type for every client, such as reading statements or receipts, with rule checks and an approval step before anything posts.

## Sources

1. [ICAEW, Generative AI guide: ethics](https://www.icaew.com/technical/technology/artificial-intelligence/generative-ai-guide/ethics)
2. [ICAEW, Generative AI guide: dos and don'ts](https://www.icaew.com/technical/technology/artificial-intelligence/generative-ai-guide/dos-and-donts)
3. [UK GDPR Article 2 (material scope), legislation.gov.uk](https://www.legislation.gov.uk/eur/2016/679/article/2)
4. [UK GDPR Article 35 (DPIA), legislation.gov.uk](https://www.legislation.gov.uk/eur/2016/679/article/35)
5. [ICO, When do we need to do a DPIA?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/data-protection-impact-assessments-dpias/when-do-we-need-to-do-a-dpia/)
6. [ICO, What are the accountability and governance implications of AI?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/)
7. [GOV.UK, Information Commission succeeds the ICO (30 September 2026)](https://www.gov.uk/government/news/information-commission-succeeds-the-ico-as-uks-data-protection-regulator)
8. [Xero, Accounting API OpenAPI specification (status enums)](https://raw.githubusercontent.com/XeroAPI/Xero-OpenAPI/master/xero_accounting.yaml)
9. [Xero Developer, Pricing and policies](https://developer.xero.com/pricing)
10. [HMRC, Check if you're eligible for Making Tax Digital for Income Tax (updated 26 March 2026)](https://www.gov.uk/guidance/check-if-youre-eligible-for-making-tax-digital-for-income-tax)
11. [HMRC, Quarterly updates for Making Tax Digital](https://makingtaxdigital.campaign.gov.uk/quarterly-updates/)
12. [Money Laundering Regulations 2017, regulation 8](https://www.legislation.gov.uk/uksi/2017/692/regulation/8)
13. [Money Laundering Regulations 2017, regulation 18](https://www.legislation.gov.uk/uksi/2017/692/regulation/18)
14. [Money Laundering Regulations 2017, regulation 28](https://www.legislation.gov.uk/uksi/2017/692/regulation/28)
15. [Money Laundering Regulations 2017, regulation 40](https://www.legislation.gov.uk/uksi/2017/692/regulation/40)
16. [GOV.UK, Company and accounting records](https://www.gov.uk/running-a-limited-company/company-and-accounting-records)
17. [GOV.UK, How long to keep your records (self-employed)](https://www.gov.uk/self-employed-records/how-long-to-keep-your-records)