An AI use policy tells your team which AI tools they may use, what data may go into them, who must review the output, and what gets recorded. For a CA firm it should be short enough that articles actually read it. Eight clauses cover most of what matters: tools, data, review, records, accuracy, training, client wording and review dates.
Last reviewed: 17 October 2026. Facts checked. We searched for what accounting-firm AI policies typically include. The results were practitioner and vendor guides (Accounting Today, a UK and an Australian accountancy site, a sample addendum from an IT provider) and mostly concern US and UK rules, which we do not apply to India. We found no ICAI-issued AI policy template, and we did not open ICAI's own site for this post. For the DPDP Rules we rely on search results citing PIB; we did not open the PIB page.
Why the policy matters now
Staff are already using AI. If you have no rule, they will use free accounts and paste client data into them. Common guidance in the sources we read points to the same risk: consumer tools may use inputs to improve models and may not let the firm audit or delete what was entered.
For Indian firms there is a second reason. The DPDP Rules were notified in November 2025 with an eighteen-month phase-in, so handling of personal data in client files is about to be regulated more closely. See our DPDP audit readiness checklist.
The eight clauses
1. Approved tools only
List tools the firm has assessed. Everything else is off limits for client work. Add a way to request a new tool. Use our AI audit tool evaluation checklist for the assessment.
2. Client data rules
State what may never be pasted into a tool that is not on the approved list: names, PAN, GSTIN, bank details, payroll data, trial balances, anything covered by confidentiality. Say whether anonymised data is allowed and how to anonymise. Our DPDP-safe prompt library has worked examples.
3. Human review
No AI output goes into a working paper, report or client advice without review by a qualified person. The reviewer signs off. Make it explicit that the signing professional is responsible, not the tool.
4. Records
Log AI-assisted work in the engagement file: tool, purpose, what was supplied, who reviewed. A short field in your working paper is enough. This is the same audit-trail idea we describe in the AI governance framework.
5. Accuracy and sources
Any section number, rule, rate or standard cited by AI must be checked against the primary source (the Act, the SA, the circular) before use. Models can state wrong things confidently. See AI hallucinations in audit.
6. Training
Every person gets a short briefing before getting access, and a refresher when tools change. Keep a list of who attended.
7. Client communication
Consider a plain line in your engagement letter saying the firm may use AI tools with safeguards. Take advice on wording and on any client who forbids it.
8. Ownership and review
Name the partner who owns the policy. Review it at least once a year, and whenever a vendor changes terms or you add a tool.
A one-page template
| Section | Fill in |
|---|---|
| Purpose | Why we have this policy |
| Scope | Who and which work it covers |
| Approved tools | Tool, plan, approved use, approver, date |
| Prohibited | Data and uses not allowed |
| Review | Who checks, how it is recorded |
| Incidents | Whom to tell within what time |
| Owner and review date | Name and date |
Incidents
Decide in advance what counts as an incident: client data pasted into a wrong tool, a wrong AI-drafted figure that reached a client, a vendor breach. Say who is told and how fast. Staff should know they will not be punished for reporting honestly.
Common mistakes
- A long policy nobody reads.
- Banning all AI, which pushes use underground.
- No named owner.
- Approving a tool once and never revisiting it.
- Treating "enterprise plan" as automatically safe. Check the terms.
Frequently Asked Questions
Does ICAI require a firm AI policy?
We did not find an ICAI rule requiring one. Confidentiality and competence duties still apply, and a policy is a practical way to meet them.
Can staff use free ChatGPT for client work?
Not for client data, under most firm policies. Consumer terms may allow use of inputs for model improvement. Check the terms of any account before use.
Should the policy cover AI inside accounting software?
Yes. Features added to tools you already use can send data to vendors too. Include them in the approved-tool review.
What should the engagement letter say?
A short statement that the firm may use AI tools with safeguards for confidentiality and review. Get legal advice on exact wording.
How often should we update it?
At least annually, and whenever you add a tool or a vendor changes its terms.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error