Why AI disclosure is now an accounting risk question
Whether to tell a client about AI use depends on what the tool does, what data it handles and the firm's duties and engagement terms. Direct client interaction and material reliance on AI usually deserve an explicit disclosure decision.
The CalCPA/CAMICO checklist makes that distinction explicit. AI used for research, drafting, audit automation or analysis under professional supervision is a different risk from an autonomous chatbot, automated tax guidance, AI-driven client service or a tool that makes operational decisions without human oversight.
Decide what the client needs to know
Consider what the client needs to know before agreeing to the work, sharing data or relying on the output. Review disclosure duties and engagement terms when AI interacts directly with clients, influences advice, handles client or taxpayer information in an external system, or materially informs a professional conclusion. These are review triggers, not a universal disclosure rule.
Internal drafting support may be lower risk if a qualified accountant reviews the work, the tool is approved, confidential data is protected, and the final judgement remains with the firm. Even then, firms should consider engagement-letter wording that explains responsible AI use in plain language.
Check where AI creates client disclosure risk
Five situations to check before deciding on disclosure
1. The client is talking to AI, not a person. If a chatbot, portal assistant or automated support flow answers client questions, clients should not be left thinking they are dealing with a human adviser.
2. AI influences advice or a client decision. If AI helps generate tax, audit, accounting or advisory recommendations, assess whether its role is material to the client and what disclosure is appropriate. Keep evidence of human professional review.
3. Client, taxpayer or confidential data enters an external system. Firms should check whether the provider stores, reuses, trains on, transfers or exposes data. For tax work, consent and restrictions around taxpayer information may be relevant before data is transmitted to third parties.
4. Law or regulation requires transparency. Check the privacy, consumer and transparency rules that apply to the work. The CalCPA/CAMICO checklist is US guidance; its discussion of taxpayer information and disclosure should not be treated as a statement of UK duties. UK firms need to check their own legal and regulatory context.
5. The engagement letter would otherwise be misleading. If AI meaningfully changes how services are delivered, the client should not have to infer that from generic technology wording.
What the disclosure should say
Good disclosure is specific enough to build trust, but not so detailed that it promises controls the firm cannot evidence. It should cover the type of AI use, the purpose, whether client data may be processed, who reviews AI-generated work, and what safeguards apply to confidentiality and quality control.
A practical engagement-letter clause might say that the firm may use approved AI tools to assist with research, drafting, analysis or workflow support, that AI-generated material is subject to professional review, and that the firm maintains policies for confidentiality, data protection and responsible use. Treat this as an illustrative scope for a clause, subject to review against the actual tools, workflows and engagement terms. Include only safeguards the firm can evidence.
Build an AI disclosure and governance model
The governance record behind the disclosure
Disclosure without controls is weak. Before approving a tool, keep a record of the business use case, data classification, vendor terms, retention settings, training opt-out position, access controls, review steps, incident process and accountable owner. For higher-risk use, add monitoring, sample checks and escalation rules.
Keep evidence of the approval decision, supervision and data controls alongside the disclosure record. That record should explain how the firm assessed confidentiality and professional standards for the particular use.
How to implement this in a small or mid-sized firm
Start with a short AI-use register. Put each workflow into one of four categories: prohibited, restricted, approved with review, or approved for low-risk internal support. Then attach disclosure rules to each category. Direct client interaction, client data in external tools and advice-shaping workflows should trigger stronger review and clearer client notice.
Train staff on examples rather than abstractions. A team member using an approved tool to tidy an internal checklist is different from uploading client tax records to a public assistant or letting a bot answer a client’s technical question. The policy should make those differences obvious.
Conclusion
Document the disclosure decision against the client's understanding of who does the work, how data is handled, how advice is formed and what safeguards apply. Use engagement wording that matches the workflow, and keep evidence of human review and data controls.
Turn AI policy into working controls
Need a safer AI route for your firm?
If this article reflects a live decision in your practice, the useful next step is to map the workflows, confidentiality risks, supplier controls and governance gaps before tools spread informally.