Consider three hypothetical uses. An accountant uses an AI tool to make an email easier to read. Another uses it to suggest classifications across two thousand transactions. A third asks it to summarize a contract before preparing a client memo.
All three could say, "AI assisted with the work." The statement is true, but it does not tell a reviewer or client very much.
That is the weakness in the usual disclosure debate. One side argues that every use of AI should carry a label. The other treats AI like spellcheck and sees no reason to mention it. Both positions make the tool itself the deciding factor, when the more useful questions are what the tool influenced, what information it processed, how the output was checked, and who remained responsible for the result.
Accounting firms need a disclosure practice that gives the right person enough information to review, rely on, or question the work. That does not always mean a public badge. Sometimes it means an internal workpaper note. Sometimes the engagement terms should address AI-enabled tools before work begins. Sometimes the client should be told directly that AI materially shaped a deliverable. In every case, disclosure should clarify responsibility rather than move it to the software.
There is no single disclosure line for every accounting task
Professional guidance is moving toward transparency, but the exact obligation still depends on the work, jurisdiction, professional rules, engagement terms, privacy requirements, and firm policy.
The International Ethics Standards Board for Accountants says its five fundamental principles apply regardless of the technology involved: integrity, objectivity, professional competence and due care, confidentiality, and professional behavior. IESBA also says accountants should use an inquiring mind and professional judgment to identify and address technology-related ethical threats. Its July 2026 staff publication adds a useful boundary: professional accountants remain responsible for their judgments and decisions regardless of the level of automation.
That gives the discussion a foundation, but not a universal disclosure sentence.
More specific guidance shows why context matters. January 2026 guidance on AI in UK tax work, published through ICAEW for members of the Professional Conduct in Relation to Taxation bodies, says members should consider the level of transparency provided to clients, consider addressing potential AI use in engagement letters, and consider disclosing actual use when deliverables are provided. It also says direct advance notice may be appropriate when AI use is fundamental to the deliverable.
That is meaningful guidance, but it is specific to members doing UK tax work. A bookkeeping firm in Ontario or an accounting practice in Texas should not copy it as though it were the governing rule for every engagement. Each firm must check the professional, legal, contractual, and client-specific requirements that actually apply.
The practical lesson is narrower and more durable: the more AI shapes an important conclusion, affects a person, processes sensitive information, or changes what someone needs to review, the stronger the case for explicit disclosure.
Start with influence, not with the name of the tool
A firm can make the first decision by asking how much the AI influenced the work.
At the low end, the tool may correct grammar, reformat text, or help create an internal list from information the accountant has already verified. The accountant still needs to follow firm policy and protect confidential information, but a client-facing disclosure may add little if the AI had no meaningful influence on the accounting content or conclusion.
In the middle, AI may summarize source documents, draft an explanation, suggest coding, identify anomalies, or rank items for review. Now the tool has influenced what the preparer or reviewer sees first. Even if every item receives human review, an internal record becomes useful because another reviewer may need to understand the method, inputs, limitations, and checks.
At the high end, AI may materially shape analysis, proposed classifications, estimates, recommendations, risk assessments, client communications, or other outputs that people could rely on. Here, silence can make the work appear more directly human-produced or independently reasoned than it was. The engagement terms, reviewer, client, or another affected party may need a clear explanation before relying on the result.
The boundary should not depend on how impressive the software sounds. A familiar feature inside established accounting software can materially affect a conclusion. A famous generative AI model can also be used for a trivial wording change. Influence is a better starting point than brand name.
Use five questions to decide what should be disclosed
Before the work leaves the preparer, ask five questions.
1. Did AI materially shape the content or conclusion?
If removing the AI contribution would change the analysis, proposed treatment, selected evidence, risk signal, or wording a reader may rely on, the use was more than cosmetic. Record what the tool did and where human judgment entered.
2. Did the tool process confidential, personal, or restricted information?
Disclosure after the fact does not cure an unauthorized upload. The firm should first determine whether the tool is approved, what data may be entered, where the data goes, who can access it, whether it may be retained or used for training, and what the engagement or client permissions require.
The NIST AI Risk Management Framework is voluntary and not an accounting rule, but its governance structure is useful. It calls for clear roles, an inventory of AI systems, documented human oversight, knowledge limits, third-party risk controls, and communication about risks and impacts. Those controls belong before a disclosure label, not beneath it.
3. Would knowing about the AI change how someone reviews the work?
A reviewer may apply different procedures when AI summarized a contract, generated an accounting research path, selected a sample, or suggested transaction classifications. If knowledge of the method would change review depth, evidence requests, or skepticism, the reviewer should know before approval.
This is one reason internal disclosure can matter even when a client-facing statement is not necessary. The first audience is often the next accountable person in the workflow.
4. Could silence leave a reasonable person with a misleading impression?
If the deliverable presents analysis as though it came directly from the named professional, while a material part was generated or selected by AI, omission may weaken trust when the method is later questioned. The useful test is not whether the firm can technically avoid mentioning the tool. It is whether the explanation remains straightforward and honest about how the work was produced.
5. Do the engagement, law, professional rules, or firm policy require a particular notice?
This question is the gate. A practical framework cannot override applicable requirements. Tax, assurance, public-company audit, regulated data, employment, consumer, privacy, and contractual settings can create different obligations. The firm should identify the governing rule and named decision-maker before inventing its own standard.
If the answer to any question is uncertain, route the decision to the firm's qualified reviewer, ethics lead, privacy or security owner, or legal adviser as appropriate. Do not let the preparer settle a material disclosure question alone because the deadline is close.
Different audiences need different information
"Disclose AI" sounds like one action, but accounting work has several audiences.
An internal reviewer may need the tool or feature used, its task, the inputs or source set, the version or date when material, the output location, the checks performed, the exceptions found, and the name of the person responsible for the conclusion.
A client may need to know that AI-enabled tools could be used under the engagement, whether actual use materially affected a deliverable, what human review occurred, what limitations remain, and who stands behind the work. The explanation should be proportionate. A dense technical disclaimer can hide more than it reveals.
An external user, regulator, auditor, or other professional may need different information about methods, evidence, controls, or limitations. The appropriate detail depends on why that person receives the output and what they are entitled or required to understand.
One disclosure statement cannot serve every audience. A client note that says "AI may have been used" is too vague for a reviewer who needs to re-perform a classification. A technical model log is too much for a client who mainly needs to know whether the firm's professional remains accountable.
A useful disclosure explains four things
When disclosure is appropriate, keep it concrete.
-
Task: What did the AI do?
-
Boundary: What did it not decide or authorize?
-
Review: What evidence and checks did a qualified person apply?
-
Responsibility: Who owns the conclusion and final approval?
For example, an internal workpaper note might say:
An approved AI-enabled tool produced proposed descriptions from the listed source documents. The preparer checked every description against the cited source, corrected unsupported wording, and recorded open questions. The tool did not approve accounting treatment, post entries, or communicate with the client. The named firm reviewer retains responsibility for the final conclusion and approval.
This is an illustrative template, not a professional rule. A real firm should adapt it to its engagement, policies, systems, jurisdiction, and review requirements.
Notice what the statement avoids. It does not promise that AI makes the work accurate. It does not ask the reader to accept the output "at their own risk." It does not transfer responsibility to the tool. It explains the workflow.
A fictional example shows why a blanket label is not enough
Imagine a fictional bookkeeping firm preparing a monthly cleanup package. An approved AI-enabled feature reads transaction descriptions and suggests categories. A preparer reviews every suggestion against the source documents and firm policy. Unsupported items go to an exception list. A manager reviews the package and the accounting firm makes the final decision before any authorized posting.
The phrase "AI-assisted categorization" is accurate, but incomplete. A reviewer needs to know which transactions were in scope, whether the source documents were available, which rules the preparer applied, what exceptions remained, whether any suggestion was accepted without support, and who approved the final treatment.
The client may need a different explanation. If the engagement terms already describe approved AI-enabled tools and the firm retained full human review, a concise note may be enough. If the tool materially shaped a sensitive conclusion, used data outside agreed boundaries, or changed the method the client reasonably expected, more direct discussion may be necessary.
The example also shows why disclosure is not the control itself. A perfectly written notice does not make an unsafe tool safe, restore confidentiality, verify a hallucinated source, or replace professional judgment. It only makes the relevant use visible. The firm still needs approval, evidence, review, access controls, and a correction path.
The policy should be decided before the awkward case arrives
Firms will get inconsistent results if every accountant improvises disclosure after completing the work.
A simple internal policy can define approved tools, prohibited data, permitted tasks, required review, documentation fields, client-notice thresholds, engagement-letter language, escalation routes, and record retention. It should distinguish low-impact assistance from AI that materially shapes a deliverable or decision. It should also say who can approve an exception.
This approach matches the broader direction of current guidance without pretending that one framework governs every firm. IESBA emphasizes professional responsibility and the continuing application of ethics principles. NIST emphasizes defined roles, documented oversight, system limits, and third-party risk. ICAEW's tax guidance gives a concrete example of proportional client transparency. None of them turns a label into a substitute for judgment.
The policy should be reviewed as tools, professional guidance, laws, contracts, and client expectations change. The PCAOB's 2024 outreach found that the audit firms it interviewed were still investing in GenAI while recognizing its limitations and the need for strong supervision around privacy and security. That evidence is specific to the firms and audit context covered by the outreach, but the operating lesson travels well: adoption and governance need to move together.
The real question is what another person needs to know
Accounting firms do not need to choose between labelling every use of AI and saying nothing.
They need a proportionate explanation that follows material influence, confidential data, review needs, reasonable expectations, and the requirements governing the engagement. The disclosure may sit in a workpaper, an internal system record, engagement terms, a client note, or a direct conversation. Its location and detail should match the audience and risk.
The most important sentence is still the one about responsibility. AI may prepare, summarize, suggest, rank, or draft. The qualified human and the accounting firm retain the judgment, review, approval, and any separately authorized posting, filing, payment, payroll release, or client communication.
Where would you draw the line between ordinary software assistance and AI use that a reviewer or client should be told about?
Sources
-
IESBA: Ethics and Independence Approach to the Use of Technology
-
IESBA: Ethical Considerations for Accountants Using Emerging Technologies
-
ICAEW: Topical guidance on the ethical use of AI tools in tax work
-
ICAEW: AI in audit, transparency and third-party relationships
-
PCAOB: Staff observations on GenAI in audits and financial reporting
This article provides general operational education. It is not accounting, assurance, tax, legal, privacy, security, or compliance advice. Accounting firms should apply the rules, professional standards, engagement terms, and policies that govern their work, and retain professional judgment, final approval, posting, filing, payment, payroll-release, and client-communication authority.