Monday morning in the accounts preparation team. A junior accountant has exported a client's general ledger and spotted a run of entries she cannot place. She pastes four hundred lines into a chatbot and asks what is likely to have happened. Two desks away, a tax adviser is having a different tool rewrite an advisory memo on a business succession, using his own account.
That is AI governance at an accounting firm in a nutshell. Not whether the firm may use AI, because it already does, but which tools are in use, what the firm has decided about them, whether staff know that decision while the ledger is sitting in the text box and whether the firm can show afterwards that its rules were followed. Our article on what AI governance is covers the subject in general. This piece is about what an accounting firm adds to it.
How is AI used at an accounting firm?
More than the partners realise. At many firms, Microsoft 365 Copilot is the tool that was bought and approved. Around it sits a second layer that rarely appears in any decision: ChatGPT or Claude for client emails and memos, a tool that explains a ledger or summarises a contract, a transcription tool for the client meeting and the AI features that vendors of accounts preparation, bookkeeping and payroll software have built into their own packages.
That last group is the trickiest: nobody asked for the AI assistant inside the bookkeeping package; it arrived with an update, appears on no list and sees the same figures the employee sees. Banning that layer does not make it go away; our article on shadow AI explains why.
Which data goes into these tools?
The work AI helps with is exactly the work that involves the client's figures.
| Task | What can be in the text | What can come out before you paste |
|---|---|---|
| Explain ledger entries | Client name, IBANs of suppliers and customers, revenue per customer or supplier, salaries in the payroll journal | The name and the counterparties; the patterns in the amounts stay usable |
| Rewrite the notes to the financial statements | Figures not yet adopted or published, the company name, events after the balance sheet date | The name and the amounts; the structure of the notes stays |
| Advisory memo on a business succession | Family names, valuations, tax positions, health as the reason for the transfer | Everything that points to the family; the tax question stays |
| Check a payslip or a tax return | Citizen service number, salary, tax credits, sometimes illness or a wage garnishment | This does not belong in a tool without a decision, even with the name removed |
| Transcribe a client meeting | Who said what about the business, the family and the plans | Decide beforehand whether the tool is allowed, rather than deleting the recording afterwards |
The citizen service numbers and the salaries stand out most, because they are personal data under the GDPR. But most of what a firm processes is not personal data and is confidential all the same: a client's revenue, a valuation, a figure not yet adopted. The GDPR does not cover that information; the duty of confidentiality does. Our article on ChatGPT and client files shows what a junior accountant should take out of a ledger before it goes into a chatbot.
What do the duty of confidentiality and regulatory oversight require?
Three frameworks apply; exactly how they apply differs from firm to firm.
The duty of confidentiality follows from the VGBA, the code of conduct and professional rules issued by the NBA (the Dutch professional body for accountants), which lists confidentiality as one of the fundamental principles. The duty rests with the accountant, who cannot pass it on to the vendor of a chatbot. A prompt containing a client's figures is therefore not a technical question but a professional one: who am I giving this to, on what terms and did I need to?
Oversight lies with the AFM, the Dutch financial markets regulator, which supervises audit firms and applies its strictest regime to firms that audit public interest entities, and with the NBA as the professional body. Neither prescribes nor bans any AI tool. What they do expect is that the firm can explain how it safeguards the confidentiality of client information, and "we have a policy" is a thin answer when nobody knows which tools are actually being opened.
The GDPR applies as soon as a person is in the prompt: the payroll records, the director-shareholder in the advisory memo. The Dutch Data Protection Authority has reported receiving several data breach notifications in which employees had put personal data into an AI chatbot, and advises organisations to set out which tools are allowed and which data may go into them. For a firm, that raises the further question of whether the vendor is a processor and whether a data processing agreement is in place, because with a free account there is none.
How do you tackle this without a year-long project?
A firm with three offices has allowed Copilot and built that into its policy and training. When it looks for the first time at which AI services are being opened from the browser, ChatGPT, Claude and Perplexity turn out to be in use alongside Copilot, as well as a contract analysis tool and the AI assistant inside the accounts preparation package. Two of them are not on any list. Nobody did anything wrong, because nothing had been decided about those two. What it does show is that a quarterly survey is out of date the moment it is finished.
Then the firm decides on each tool: allowed; limited use, with a condition the firm writes down (business account only, no client names and no figures before they are adopted); not allowed, with a named alternative; or, honestly, no decision yet. The account type matters more than the name of the tool: the same chatbot on a free account and in a business environment with an agreement are two different decisions. An AI policy for accounting firms sets out the rules that go with it.
The decision only works once the junior accountant sees it when she opens the tool, not on the day of the training. A tool without a decision gets a calm notice, public information only; a tool that is not allowed gets the approved alternative as the first button.
Then look, every quarter and at firm level, at what share of AI use goes through allowed tools, how many tools in actual use still have no decision and how often someone chose the alternative after a notice. Those are figures about tools, not about staff. They answer part of what a regulator or quality reviewer asks, not all of it, and stating that gap openly is what makes an overview credible. Our article on why a dashboard is not evidence explains the reasoning.
BeeSensible links a catalogue of over 1,000 assessed AI tools to the use observed in the firm: only the domain of an opened tool, at most once a day per device, with no user ID and no page content. An administrator sees in the Inbox which tools have no decision yet and records the decision. If the firm has switched notices on, that decision appears in the browser when someone opens the tool. BeeSensible does not block anything of its own accord; whether staff can still go on to a tool that is not allowed after seeing the notice is a setting the firm chooses.
