Artificial intelligence is rapidly becoming part of everyday accountancy practice. Whether firms are introducing AI tools or finding that existing software now includes AI functionality, the question is increasingly not whether AI will feature in professional services, but how its use should be managed.
In our work advising professional firms on engagement documentation, supporting policies and processes, and wider risk management, we regularly see the importance of ensuring that contractual terms keep pace with how services are actually being delivered, and January 2026’s update to Professional Conduct in Relation to Taxation (PCRT), which included topical guidance on the ethical use of AI, brought these issues into sharper focus.
Whilst PCRT applies specifically to taxation work, in my view the AI guidance has wider application. If a particular standard is necessary to manage the ethical use of AI in tax work, it is difficult to see why a lower standard should apply elsewhere. Firms should therefore consider what the guidance means for their practice as a whole.
Ethical risks
PCRT considers AI against the five familiar ethical principles of integrity, objectivity, professional competence and due care, confidentiality and professional behaviour.
Practical risks arise where clients are not given sufficient information about the firm’s use of AI, staff use AI without the firm’s knowledge, inappropriate tools are used, or AI-generated material is accepted without suitable review.
PCRT suggests providing appropriate disclosure that AI is used within the engagement letter and, where AI is fundamental to the work, informing the client before that work is carried out.
Hallucinations are a well-known example. My best advice is to treat AI rather like a very lazy junior who wants to please you and, on occasion, makes things up. If an AI tool provides a legislative reference, case or other source, ask for the source, check it independently and evidence that check on the file.
Firms cannot abdicate their professional responsibility to AI.
Commercial risks
Some firms remain nervous about AI and risk being left behind. At the other end of the spectrum, firms can be too quick to adopt new tools without properly understanding or testing them.
The sensible approach is a measured one. Firms do not need to lead the pack, but nor do they want to be at the back of it. They should understand what the AI they use can do, its limitations and risks, and how staff should use it.
Contractual risks
The first question is simple: do your engagement letters and terms of business permit you to use AI?
If so, to what extent? Does the wording cover AI used in performing the professional service, AI-enabled notetakers and AI used more generally in the firm’s business? How is confidentiality addressed? What happens if the client objects?
A firm may already use AI-enabled technology for AML, administration, research or other “behind the scenes” activities, so a blanket prohibition may be difficult or impossible to comply with.
If the objection relates only to AI being used in delivering the professional service, the firm should consider whether the restriction can be accommodated, how it will be communicated internally and how compliance will be monitored. It may increase costs or, in some cases, mean that the firm cannot act.
Any restriction therefore needs to be clearly agreed with the client and supported by robust internal processes.
Clients may also provide information generated using AI. Firms should consider whether their engagement documents adequately address reliance on client information and whether clients should be asked to identify AI-generated material. Professional judgement will still be required where information appears unreasonable or inconsistent with the client’s circumstances.
Operational and process risks
The contractual wording is only part of the answer.
A useful question is: who is actually using AI within the business? The answer may not match the list of products the firm believes it has authorised.
Clear policies and guidance are needed around which tools can be used, by whom and for what purposes. Appropriate due diligence should be undertaken on providers and products.
Processes should also address confidentiality and data protection, information barriers, recording prompts and outputs, checking and verification, and suitable human review.
Simply inserting an AI clause into the terms of business will not make an unsafe process safe. The contractual wording, policies, guidance, training and what actually happens on the client file need to support each other.
What does this mean for engagement letters?
When advising firms on engagement documentation, I always consider the three stakeholders that need protection: the firm, its staff and its clients.
Clear, well-drafted documents help clients understand what has been agreed, staff understand the scope and boundaries of the work and reduce the likelihood of disputes if something goes wrong.
In relation to AI, firms should consider whether their engagement documents address:
- transparency and consent;
- confidentiality;
- circumstances where AI is fundamental to the service;
- client objections;
- AI-enabled notetakers;
- data protection and data location;
- reliance on client-supplied information; and
- the use of third-party software.
The aim is not to make engagement letters longer, but to ensure that they accurately reflect how the firm provides its services.
Key questions to ask now
When reviewing your arrangements, consider:
- How is AI actually being used within the firm?
- Have the ethical, commercial and professional risks been considered with controls in place to appropriate manage them?
- Do the engagement documents accurately reflect how AI is used, including consent, confidentiality and client objections?
- Are there adequate policies, guidance, training and review processes to support the contractual position?
Engagement letters are an important part of managing the client relationship and the firm’s wider professional risk. In light of the PCRT guidance on AI and the evolving ways in which firms are working and using technology, I recommend that all firms review their engagement documentation to ensure that it remains fit for purpose and accurately reflects how their services are being delivered.
Members who would like to explore the issues in greater detail can watch Karen Eckstein’s webinar, Engagement Letters, AI and PCRT – practical issues, on which this article is based. The webinar explores the practical implications of the PCRT update alongside the wider ethical, commercial, contractual, operational and process risks arising from the use of AI.
