The 2025 PCPS National Management of an Accounting Practice Survey found that only 16% of responding firms were “very confident” in their ability to adapt to AI and automation over the next three years.
That figure is cited in a July 2026 Journal of Accountancy column by Nicole L. Graham, Esq., a risk consultant at Aon. It measures confidence in adapting—not how many firms use AI or whether they are compliant.
Graham’s central argument: firms that manage AI risk well treat it as a governance issue, not just a technology issue.
The question is whether AI use and controls will develop informally—or within clear guardrails.
Ten building blocks for an AI policy
Graham identifies ten areas firms should address:
Scope and purpose. Define the technology covered and connect its use to professional obligations, regulatory requirements, and client confidentiality commitments.
Governance. Establish approved tools, a process for requesting new ones, and an AI lead or committee.
Data privacy. Understand where inputs are stored, who can access them, and whether they are used for training. Set clear restrictions for sensitive information.
Quality and liability. Require human review and verify AI-generated research, technical explanations, and citations against primary authority. The signing CPA remains responsible for the deliverables.
Documentation and supervision. Establish how AI use and verification will be recorded in the engagement file and incorporated into existing review processes.
Bias. Assess outputs critically, particularly when they affect hiring, HR, or sensitive client decisions.
Transparency. Decide when AI assistance should be disclosed, including whether engagement letters need appropriate language. Seek legal advice on applicable obligations.
Acceptable use. Define permitted and prohibited uses with examples relevant to each function.
Training and implementation. Support the policy with tool-specific training, acknowledgements, spot checks, and feedback.
Maintenance. Update the policy as technology, firm practices, and legal requirements change.
Three habits that make the policy useful
Document the work
Graham recommends recording at least three things in the client file when documenting AI-generated research and procedures:
The prompts used.
How the outputs were verified.
Who performed the review.
The point is to make the review demonstrable—not merely assumed.
An AI-generated citation is not evidence that an authority exists or supports the conclusion.
The column recommends checking AI-generated research, technical explanations, and citations directly against primary sources—such as the IRC, Treasury regulations, IRS guidance, and applicable accounting and professional standards—before use.
Own the result
An AI tool does not take responsibility for the firm’s advice.
Graham emphasizes that the signing CPA remains responsible for the accuracy and completeness of deliverables. Professional judgment cannot be replaced by blaming the technology.
Where implementation matters
A written policy is only the starting point.
Graham recommends supporting it with training, oversight, employee acknowledgements, engagement reviews, and opportunities to report problems. These measures help turn policy language into everyday practice.
Three things to do this week
Our implementation suggestions:
Inventory the AI tools your team actually uses—including embedded features in existing software.
Assign an accountable AI lead, supported by the relevant technical, security, and engagement leaders.
Pilot an AI-use record for substantive engagement work: prompts used, verification performed, and reviewer identity. Keep it in an approved system suitable for the information involved.
The objective is not simply to have an AI policy.
It is to be able to demonstrate that the policy changes how work is performed and reviewed.
AI prepares. Professionals verify.
Want the full build-out?
Paid members get the Issue #10 implementation guide in the Notion backend. It walks through all ten blocks with draft clauses for attorney review, the setup for four Notion databases (tool register, use log, review sign-off, acknowledgements), the verification workpaper fields, a 30-day rollout, a maintenance calendar, and a 12-question self-audit.
It comes with the AI Implementation & Review System: prompt frameworks, a verification workpaper, and step-by-step setup guides for Notion, Airtable, or Sheets.
To be clear about what it is: a workflow and documentation system, not legal advice and not a compliance certification.
7-day refund if it’s not the right fit for your firm.
Ahmed
AI Accountant Edge
Professional AI workflow research for accounting firms
Source: Nicole L. Graham, Esq., “Drafting an AI policy that actually works,” Journal of Accountancy, July 1, 2026, citing the 2025 PCPS National MAP Survey.
Educational content only. Not legal or professional advice.