Can accountants and bookkeepers in the UK use AI with client data?

Yes, you can, but putting client data into a publicly available AI tool without the client's consent is likely to breach client confidentiality, according to guidance published on 19 January 2026 by the seven professional bodies that jointly write Professional Conduct in Relation to Taxation (PCRT). The exact sentence is: "The input of client data into publicly available AI tools is likely to constitute a breach of client confidentiality, unless the client has consented to this."

That matters because it's an easy habit to fall into in a small practice: a client's figures pasted into a free chat window to get a summary written faster.

The good news is that the rest of the guidance is more encouraging than you might expect. It bans nothing. In effect, it says the rules you already follow cover AI too, and you need to apply them properly.

Where AI helps most in a small practice

The PCRT guidance names one compliance use directly: "Collating potentially large amounts of data provided by a client and identifying the key information relevant to their tax filing obligations." Reading through a shoebox of records and pulling out what matters is something these tools do well, as long as a person still checks the result.

The bigger saving is less glamorous. It's the chasing. Much of the work isn't the return itself but the weeks spent asking a client for the bank statement, the mileage log and the invoice that never arrived. Drafting those chasers, keeping track of who still owes what and writing the fourth polite version of the same email is work AI can take off your hands almost entirely, without touching a single figure.

If chasing clients for records is where your weeks go, we're happy to set up an automation that sends the reminders and keeps track of what's come in.

Making Tax Digital has made the chasing pile much bigger

HMRC expected around 780,000 people with business or property income over £50,000 to join Making Tax Digital for Income Tax from April 2026, and a further 970,000 from April 2027. The £20,000 threshold follows from 6 April 2028.

Each of those clients moves from one annual return to four quarterly updates plus the return, with deadlines of 7 August, 7 November, 7 February and 7 May. That's per self-employment and per property business, so a client with a trade and a rental property has eight updates, not four.

HMRC's own impact assessment estimates "a transitional cost to business of around £561 million and a net increase in the continuing costs of tax compliance of around £196 million". That's HMRC costing the businesses, not the agents. But every one of those submissions tends to produce a client asking what it is, whether they need to do anything, and why it's being asked for in November. Drafting clear, consistent answers to those questions is a sensible job for a well-set-up AI assistant, with you reading the reply before it goes.

If you'd like the routine "what is this and what do I need to send?" emails drafted automatically before each quarterly deadline, ready for you to check, we can set that up.

Your professional obligations don't change

Compliance with PCRT is mandatory for members advising on UK tax, and HMRC has endorsed it as an acceptable basis for dealings between members and HMRC. The AI guidance sits inside that, and its central line is clear: "Members are ultimately responsible for any work they produce, and for regulated firms any work which the firm prepares, irrespective of the use of AI tools in its creation." A member who fails to follow PCRT is "liable to be subject to the disciplinary process".

On competence, it says AI output "should also be regarded as if it were prepared by a less experienced junior colleague and reviewed with appropriate scepticism". It cites Harber v HMRC [2023] UKFTT 1007 (TC), the case where invented tribunal decisions were quoted to a tribunal.

On confidentiality, beyond the sentence quoted at the top, it notes that once information is entered into a public tool "control over that data is relinquished". Anything that does go in should be anonymised so thoroughly that the client can't be identified by combining it with anything else - think of it as removing not just the name from the letter, but anything that would let someone guess who wrote it. The guidance suggests adding a statement to the engagement letter that AI-enabled software may be used, and says AI-drafted correspondence should be reviewed for tone and content before it's sent.

In its list of risks it also names this one: "Using tax-return software that can automate the preparation and submission of a tax filing and can be configured to make human review optional." The safeguard is to review the data and the draft submission before it goes.

The same guidance is published by AAT and by ACCA. ICAEW's announcement puts it simply: "the ethical principles are consistent regardless of whether AI has been used as part of the work".

Business accounts and consumer accounts aren't the same

The difference between a personal AI account and a business one matters here. A personal account is a bit like a staff member using their own phone for work: what happens to the data depends on settings they chose, or didn't. A business or team account puts the data handling under the practice's control. We've written separately about whether AI tools train on your business data, and which kinds of plan do.

Money laundering supervision and insurance don't change either

If you provide bookkeeping or accountancy services by way of business, you're an accountancy service provider under the money laundering regulations and must be supervised, by HMRC unless a professional body already supervises you.

The PCRT guidance notes that AI can help with client due diligence checks and screening, and it can be good at that. It doesn't move the liability. Regulation 39 of the Money Laundering Regulations 2017 says that where you rely on a third party for due diligence, "the relevant person remains liable for any failure to apply such measures". The file is still yours to defend at inspection. It also makes client identity documents among the worst things to paste into a public chat window, because they're confidential client data and personal data at the same time.

On insurance, an article published by ICAEW in January 2026 and written by Marsh's head of UK affinity lists "over-reliance on AI tools without proper oversight" among the causes of breach-of-confidentiality claims, and warns against "AI washing" - overestimating what a tool can do without enough human oversight. It's a broker writing about a broker's subject, so it's fair to read it with that in mind. The practical step is a phone call: tell your broker what you're using now, rather than at the point of a claim.

Why a suggestion is safer than an automatic posting

The two big accounting platforms have drawn this line in different places.

QuickBooks suggests a category for pending bank transactions, with signals showing how confident it is - a green checkmark where "QuickBooks has strong data behind the suggestion, with a clear pattern in your history", down to an orange alert where it has limited data. You still press Post.

Xero's automatic bank reconciliation, which was still in beta when we checked, works the other way round, by design. Reconciliation is matching each line on the bank statement to the right entry in the books, like ticking off a till receipt against your card statement. Xero's product announcement says its assistant, JAX, "auto-reconciles transactions with high confidence", learning from your history and from anonymised transactions across Xero. The checking comes afterwards: "you have the flexibility to review, adjust, or take over at any time", a Reconciled page shows everything JAX has reconciled, and "subscribers and advisors can easily switch automation on or off for each bank account".

Neither design is wrong. But the difference affects how mistakes come to light.

An AI-drafted email gets checked by its nature. You read it before you send it, because sending is a separate step. If something's wrong, it's obvious: an odd sentence, right in front of you, before it leaves the office.

An AI-posted transaction isn't checked by anything. It's a number in a column that looks like every other number in that column. Because the tool learns from what it did, it repeats the same choice next month. The error tends to surface at year end or in an enquiry, by which point it isn't one mistake but twelve months of consistently misposted entries in accounts with your name on them - and PCRT is clear that you're ultimately responsible.

That's why first-pass categorisation is a good use and unreviewed automatic posting isn't. The suggestion saves you the thinking. The automatic posting removes the check.

What we'd suggest

Start with the useful half now, using a business or team account rather than a personal one, so the practice controls the data handling rather than an individual member of staff. Chasing, drafting, summarising and answering Making Tax Digital questions are where the time goes, and none of them need the tool to touch a figure.

Add the engagement letter line PCRT suggests. It's one sentence, and it avoids an awkward conversation later.

Then make a deliberate decision for each bank feed about whether automation posts transactions or only suggests them. Write down who reviews what it did and how often, and treat "we'll check it at year end" as a warning sign rather than a plan. Whatever tools you use, keep one rule: nothing goes to HMRC that a person hasn't read.

If you'd like help setting up the chasing, drafting and reminders so they run on a business account with a person checking everything before it goes out, there's more on what we set up, and we're happy to talk it through.

Sources

• Topical guidance: application of PCRT to the ethical use of artificial intelligence tools, 19 January 2026 - issued by the seven PCRT bodies, hosted by ACCA; the same guidance on AAT's site
• Professional bodies issue AI advice to members - ICAEW
• Professional conduct in relation to taxation (PCRT) - ICAEW
• Top 5 professional indemnity claims for accountants in 2025 - ICAEW, sponsored article by Marsh
• Making Tax Digital for Income Tax Self Assessment for sole traders and landlords - HMRC
• Send quarterly updates and Check if you're eligible for Making Tax Digital for Income Tax - HMRC
• Check if you need to register for money laundering supervision if you're an accountancy service provider - HMRC
• Harber v HMRC [2023] UKFTT 1007 (TC) - The National Archives
• Money Laundering Regulations 2017, regulation 39 - legislation.gov.uk
• How AI suggestions help match and categorize bank transactions - Intuit QuickBooks
• Get a first look at automatic bank reconciliation and the August 2026 update - Xero

Checked against the above on 15 September 2026. Software behaviour and MTD thresholds both change; check the links rather than trusting the date on this page.