Monday morning in the compilation practice. A junior accountant has exported a client's general ledger and sees a run of entries she cannot place. She pastes four hundred lines into a chatbot and asks what probably happened. Two desks away, a tax adviser has an advisory memo on a business succession rewritten in a different tool, on his own account.
That is AI governance in an accounting firm in one picture. Not whether the firm may use AI, because it already does. Which tools are in use, what the firm has decided about them, whether the employee knows that decision at the moment the ledger sits in the text box, and whether the firm can show afterwards that the agreements were followed. What AI governance means in general is set out in what is AI governance. This piece is about what a firm adds to that.
What happens with AI in an accounting firm?
More than the partners know. In many firms Microsoft 365 Copilot is the tool that was procured and agreed on. Around it sits a second layer that rarely appears in any decision: ChatGPT or Claude for client emails and memos, a tool that explains a ledger or summarises a contract, a transcription tool for the client meeting, and the AI features that vendors of compilation, bookkeeping and payroll software have built into their own packages.
That last group is the hardest: the AI assistant inside the bookkeeping package was never requested, it arrived with an update, appears on no list, and sees the same figures the employee sees. Why banning that layer does not make it go away is in what is shadow AI.
Which data goes along with it?
The work where AI helps is exactly the work that carries the client's figures.
| Task | What can be in the text | What can come out before you paste |
|---|---|---|
| Explain ledger entries | Client name, IBANs of suppliers and customers, revenue per relation, salaries in the payroll journal | The name and the counterparties; the patterns in the amounts stay usable |
| Rewrite the notes to the financial statements | Figures not yet adopted or published, the company name, events after the balance sheet date | The name and the amounts; the structure of the notes stays |
| Advisory memo on a business succession | Family names, valuations, tax positions, health as the reason for the transfer | Everything that leads to the family; the tax question stays |
| Check a payslip or a tax return | Citizen service number, salary, tax credits, sometimes illness or a wage garnishment | This does not belong in a tool without a decision, even with the name removed |
| Transcribe a client meeting | Who said what about the business, the family and the plans | Decide beforehand whether the tool is allowed, rather than deleting the recording afterwards |
The citizen service numbers and the salaries stand out most, because they are personal data under the GDPR. But most of what a firm processes is not personal data and is confidential all the same: a client's revenue, a valuation, a figure not yet adopted. The GDPR does not help with that information; the duty of confidentiality does. What a junior accountant strips from a ledger before it goes into a chatbot is in ChatGPT and client files.
What do the duty of confidentiality and supervision ask?
Three frameworks; the exact application differs per firm.
The duty of confidentiality follows from the VGBA, the code of conduct and professional rules issued by the NBA, the Dutch professional body for accountants, in which confidentiality is one of the fundamental principles. The duty rests on the accountant, and the accountant cannot pass it to the vendor of a chatbot. A prompt containing a client's figures is therefore not a technical question but a professional one: who am I giving this to, on what terms, and did I need to?
Supervision sits with the AFM, the Dutch financial markets authority, which supervises audit firms and applies its strictest regime to firms auditing public interest entities, and with the NBA as the professional body. Neither prescribes an AI tool or bans one. What they do expect is that the firm can explain how it safeguards the confidentiality of client information, and "we have a policy" is a thin answer when nobody knows which tools are actually being opened. The GDPR applies as soon as a person is in the prompt: the payroll records, the director-shareholder in the advisory memo. The Dutch data protection authority reported several data breach notifications in which employees had put personal data into an AI chatbot, and advises organisations to agree which tools are allowed and which data may go in. For a firm that adds the question whether the vendor is a processor and whether a data processing agreement is in place, because on a free account it is not.
How do you approach it without a year-long project?
A firm with three offices has allowed Copilot and put that in policy and training. When it looks for the first time at which AI services are opened from the browser, ChatGPT, Claude and Perplexity turn out to be in use next to Copilot, plus a contract analysis tool and the AI assistant inside the compilation package. Two of them appear on no list. Nobody did anything wrong, because nothing had been decided about those two. What it does show is that a quarterly survey falls behind the moment it is finished.
Then the firm decides, per tool: allowed, limited use with a condition the firm writes down (business account only, no client names and no figures before adoption), not allowed with an alternative named, or honestly no decision yet. The account type weighs more than the name of the tool: the same chatbot on a free account and in a business environment with an agreement are two different decisions. The agreements that go with it are in an AI policy for accounting firms.
The decision only works once the junior accountant sees it when the tool opens, not on the day of the training. A tool without a decision gets a calm notice, public information only; a tool that is not allowed gets the approved alternative as the first button.
And then look, each quarter and at firm level: what share of AI use runs through allowed tools, how many tools with real use still have no decision, how often someone chose the alternative after a notice. Those are figures about tools, not about staff. They carry part of what a supervisor or quality reviewer asks, not all of it; why that gap is exactly what makes an overview credible is in a dashboard is not evidence.
BeeSensible links a catalog of 865 assessed AI tools to the use observed in the firm: only the domain of an opened tool, at most once per day per device, with no user id and no page content. An administrator sees which tools have no decision yet and records the decision in the AI Tools module. If the firm has switched notices on, that decision appears in the browser when someone opens the tool, never as a block.
