- If your team already uses AI on client work without approval, your firm is running an AI program with no governance. The policy has to catch up to the behavior.
- One third of accountants, lawyers, and compliance professionals use AI tools their organization never approved, per the Thomson Reuters 2026 Future of Professionals report.
- Every tax preparation firm is already required by the FTC Safeguards Rule to keep a written information security plan. AI use belongs inside that plan, not outside it.
- Bans do not stop usage, they hide it. One approved lane plus a few hard red lines beats prohibition.
- A workable interim policy takes about a week: one approved tool list, a banned inputs list, a human review rule, and one partner who owns AI decisions.
It is late August. Extended partnership and S corporation returns are due September 15, extended individual returns land October 15, and somewhere in your office a staff accountant just pasted a client's depreciation schedule into a free chatbot to save twenty minutes. You found out by accident. There is no policy, nobody owns the question, and busy season is about to make everything faster and sloppier at the same time. If that is roughly what you typed into a chatbot at 11 pm, here is the checklist you wanted.
My staff is already using ChatGPT on client work. Do I ban it or allow it?
Neither. Give them one approved lane and a short list of hard red lines, in writing, this week. A blanket ban feels decisive, but the data says it mostly relocates the behavior to personal phones and home laptops where you cannot see it. In the Thomson Reuters 2026 Future of Professionals survey, unsanctioned AI use jumps to 41 percent among professionals who feel their organization is moving too slowly on AI. In other words, the stricter and slower you look, the more shadow usage you get. The move that works is the opposite: name the one tool staff may use, define exactly what may never go into it, and require that a human reviews anything AI-assisted before it reaches a client or a filing.
How common is unapproved AI use in accounting firms?
Common enough that you should assume it is happening in your firm right now: one third of accountants, lawyers, and compliance professionals told the Thomson Reuters 2026 Future of Professionals survey they use AI tools their organization has not approved. The same report, based on 1,816 professionals across 62 countries surveyed in spring 2026, found that 74 percent of professionals already use AI tools every week, while nearly one in five say their organization still lacks a clear AI strategy. Read those numbers together and the picture is plain: adoption arrived before governance at most firms, including, statistically speaking, yours. The partners who come out of this well are not the ones who used AI first. They are the ones who wrote down the rules first.
Is pasting client data into ChatGPT actually a compliance problem?
Yes. Every tax preparation firm, whatever its size, is required under the FTC Safeguards Rule to maintain a written information security plan describing how client data is protected, and the IRS Security Summit has publicly reminded tax professionals of that requirement for years. The plan, usually called a WISP, must cover how nonpublic client information is handled, who can access it, and through what systems. A consumer chatbot your plan never mentions, holding client Social Security numbers or depreciation schedules, is a hole in that plan, not a gray area. The IRS even publishes a free template, Publication 5708, for building one. So this is not a question of optics or of being old fashioned about new tools. It is a question of whether your firm's actual data flows match the document your firm is legally required to keep.
Want the complete system?
This is the sneak peek. The full governance framework, the seven decisions every partner group needs to make on paper, the client data rules, the staff usage guidelines, the engagement letter language, and the rollout plan for a firm with no IT department, is in The AI-Ready Firm: A Partner's Governance and Adoption Playbook for AI in an Accounting Practice. Written for partners, not programmers. Instant download.
The fall deadlines are three weeks out. What can I actually put in place in time?
An interim policy with four parts: one approved tool list, a banned inputs list, a human review rule, and one named partner who owns AI decisions until the full policy exists. The approved list can be a single tool on a paid business tier with training turned off. The banned inputs list is the heart of it: client names tied to financial data, Social Security and EIN numbers, account numbers, anything covered by your WISP. The review rule says no AI-assisted output reaches a client, a filing, or a workpaper without a human signoff, and the signer owns the result. The named partner answers questions so staff stop guessing. That is one page, one staff meeting, and roughly a week of elapsed time. It is not the finished governance program, but it converts invisible risk into a managed process before the September 15 crunch, and the full framework can follow after October 15. If part of the problem is that you personally have not kept up with what current AI tools can do, our plain-English guide Compound Intelligence covers how to work with AI that acts instead of just answering.
Will a strict AI policy push my best people out the door?
The evidence points the other way: clarity retains people, silence and slowness lose them. In the same Thomson Reuters report, 24 percent of professionals who see a gap between what AI can do and what their organization delivers say they are considering leaving within two years, and 62 percent say access to professional-grade AI tools would be a factor in accepting a new role. Meanwhile 96 percent say the AI they use must safeguard confidential data. Your staff are not asking for a free-for-all. They are asking for a sanctioned, safe lane so they can stop sneaking around. A firm that provides one is more attractive to good people, not less.
Ready to put this on paper before busy season does it for you? The AI-Ready Firm takes you from no policy to a working governance program a partner can run without an IT department.
Frequently asked questions
Do I need to ban ChatGPT at my accounting firm?
No. A total ban usually backfires by pushing usage onto personal devices where you cannot monitor it. A short written policy with one approved tool, clear banned inputs, and a human review rule manages the risk a ban only hides.
Is it legal for my staff to put client tax information into an AI tool?
Client data handling at a tax firm falls under the FTC Safeguards Rule, which requires a written information security plan covering the systems that touch client data. Feeding client data into a tool your plan does not cover creates a compliance gap. This is educational content, not legal advice, so confirm specifics with your own counsel.
What should a CPA firm AI policy include?
At minimum: the approved tools and account tiers, a banned inputs list keyed to your written information security plan, a rule that a human reviews and owns every AI-assisted output, a named partner accountable for AI decisions, brief staff training, and a scheduled revisit date.
My firm has no IT department. Can I still do this?
Yes. An interim AI policy is a governance document, not a technology project. One page, one staff meeting, and one accountable partner cover the first version, and the IRS's free Publication 5708 template helps with the underlying security plan.
ChatGPT is a trademark of OpenAI. Thomson Reuters is a trademark of its owner. DC Additive Pros is not affiliated with, endorsed by, or sponsored by either.
Cass Vega is the AI Systems Specialist & Digital Product Designer at DC Additive Pros, an AI-driven design and content role supervised by the DCAP team. Cass builds the storefront, the Playbooks & Field Manuals series, and this blog the same way the books teach: put AI to work, keep a human accountable. Reach the team at info@dcadditivepros.com. Educational content, not legal, financial, or professional advice.