About this article This article is personal, general commentary. It does not represent or carry the endorsement of any employer, ICAEW, AAT or another professional body; it is not accounting, tax, legal, investment, employment or data-protection advice; and it creates no adviser–client relationship. No client or employer information has been used. Verify current rules and obtain advice appropriate to your circumstances before acting.
Financial records contain some of the most sensitive information a client can provide: names, addresses, bank details, payroll data, tax identifiers and commercially confidential results. That makes data handling the first question in any accounting AI project, not an item to consider after the tool has been purchased.
Confidentiality still applies
The professional principles have not changed because a new interface makes processing convenient. ICAEW links the use of generative AI to integrity, objectivity, professional competence and due care, confidentiality and professional behaviour.
ICAEW’s guidance is direct: “being transparent and honest in the use of Generative AI is essential”.
In practical terms, staff should not paste client records, tax questions with identifying details, payroll extracts or unpublished accounts into an unapproved public chatbot. Removing a client’s name may not be enough if the remaining information can identify the individual or business.
Questions to ask before use
- Purpose: What defined task is the system performing, and is all the proposed data necessary?
- Lawful handling: What is the lawful basis for processing personal data, and does the privacy information cover the use?
- Provider terms: Is input retained, used to train models, transferred internationally or accessible to subcontractors?
- Security: Are access controls, multi-factor authentication, encryption, logging and deletion arrangements adequate?
- Accuracy and rights: Can an output be corrected, explained and challenged before it affects a person?
- Exit: Can the organisation retrieve and delete its information if it changes provider?
GOV.UK summarises the continuing duties clearly: organisations must keep personal information secure, accurate and up to date, and tell people how it is used and shared. AI does not suspend those obligations.
Use the minimum data
A sensible design starts with data minimisation. Test prompts with fictitious or anonymised examples. Where a task only requires totals, do not provide transaction-level personal information. Separate client datasets and restrict access to those who need it. For higher-risk processing, consider whether a data protection impact assessment is required and obtain appropriate advice.
Keep a human in the decision
Where AI contributes to a recommendation or a decision affecting an individual, the reviewer must do more than click “approve”. Meaningful review requires access to the underlying evidence, authority to disagree and enough expertise to recognise an implausible answer. The ICO and Alan Turing Institute guidance on explaining AI-assisted decisions is particularly relevant here.
My rule is simple: if I would not be comfortable explaining the data flow, the checks and the final conclusion to the client, I would not use the system for that task. Trust is easier to preserve than to rebuild.
Continue reading on The Perry
- AI in Accounting and Bookkeeping: A Practical Guide for UK Businesses
- AI Bookkeeping Automation: Saving Time Without Losing Control
- Making Tax Digital for Income Tax in 2026: a practical first-year checklist
References and further reading
- ICAEW, “Generative AI and ethics” (accessed 29 August 2026).
- ICAEW, “ICAEW updates ethics course on AI and culture” (24 January 2025) (accessed 29 August 2026).
- GOV.UK, “Data protection and your business” (accessed 29 August 2026).
- GOV.UK / ICO and Alan Turing Institute, “Explaining decisions made with AI” (27 January 2025) (accessed 29 August 2026).