What goes in an AI policy for a practice of ten people

Very few small practices have one. In Tolley's spring 2024 survey of 446 UK tax practitioners, only 8% of those in private practice said their organisation had created an AI policy in the previous 12 months (Tolley, May 2024). ICAEW's guidance, meanwhile, asks firms to "ensure you have appropriate policies and guidelines in place on how AI should be used" (ICAEW, Dos and don'ts of using AI).

The gap isn't because partners disagree with the idea. It's because "policy" sounds like a forty-page document, and nobody in a ten-person practice has a week to write one. It doesn't need to be that. The useful version is two pages, and most of it is decisions you've probably already made in your head.

What should an AI policy for a small practice contain?

Six things: which tools are approved and which aren't, what must never go into an AI tool, who checks AI output before it goes anywhere, how the practice tells clients, what training people get, and who to tell when something goes wrong. Everything else is detail.

Here's what each section says.

Which tools are approved?

Name them. One business AI tool, on a paid plan with a data processing agreement, that doesn't train on your data, is the usual answer for a small practice. Add the AI features inside the software you already use, once you've checked their terms. Everything else, including free personal accounts of the same products, is not approved for client work.

Keep the list in a separate register rather than the policy itself, so you can add a tool without reissuing the policy. The policy says "only tools on the approved register", and the register does the rest.

What never goes in?

This is the section ICAEW cares about most. Its guidance says to keep client and confidential internal data off public AI tools, and in July 2026 it added that firms "should ensure that confidential client information is not entered into systems without appropriate due diligence, contractual protections and internal approval" (ICAEW Regulatory News, 28 July 2026).

In a policy, that becomes a short list: client names and identifiers, financial records, anything covered by an engagement letter, passwords and the practice's own commercially sensitive information. Say plainly that these don't go into any tool that isn't approved for them, and that "approved" means approved for client data specifically, which is a higher bar than approved for drafting an email.

Who checks the output?

Whoever signs the work. ICAEW asks firms to "review and challenge AI outputs with professional scepticism, avoiding automation bias". Write that as a rule: nothing produced with AI goes to a client, to HMRC or to Companies House until a qualified person has checked it against the source, and that person is responsible for it as if they'd written it themselves.

A one-line usage log makes this visible. Who used AI, on which piece of work, who checked it and against what. It takes thirty seconds and it's the first thing you'd want if a client or a reviewer ever asked.

How do we tell clients?

ICAEW asks firms to be transparent about when AI has been used. The policy points to the sentence in your engagement letter and says who answers client questions. I've written separately about what that sentence should say.

What training do people get?

Short and recorded. ICAEW wants people using AI to have "an introductory understanding of how the technology works" and to be adequately trained. In the 2025 study for Chartered Accountants Worldwide, among people in organisations of 2 to 50 staff, only 18% expected their employer to provide AI training (Ipsos for Chartered Accountants Worldwide, April 2025). The policy fixes that expectation: everyone who uses AI on client work does the practice's session, and new starters do it in their first month. Keep a record of who attended.

Who do we tell when something goes wrong?

Name a person. If client data goes into the wrong tool, or an AI-drafted document goes out with an error in it, people need to know who to tell and that telling them is the right thing to do. A policy that makes mistakes reportable gets more honest use than one that only threatens.

What makes a policy unusable?

Three mistakes come up again and again. Banning AI outright, which just pushes use onto personal phones where you can't see it. Writing it for a firm of two hundred, with committees and review boards a small practice will never convene. And writing it once and never mentioning it again, so that by the second month nobody remembers it exists.

I lead a live AI rollout inside a regulated business, and the test I apply there is the one I'd give you: if you can't talk the team through it in fifteen minutes, it's too long.

What should a practice do this month?

Write the six sections, name the approved tool, and read the policy to the team in one short session. Then put the date of the next review in the diary.

• Decide the one approved tool and check its terms on training and data.
• Draft the six sections. Two pages. Plain English.
• Run a fifteen-minute session and keep a note of who attended.
• Diary a review in six months, because the tools will have changed.

My AI governance kit for accountancy practices has the policy already written in this shape, with the register, the usage log and the training outline, mapped to ICAEW's guidance. If you'd rather I set it up with your team, that's the team AI rollout.

Sources

1. 01Tolley, How Generative AI is Transforming Tax Practice. Survey of 446 UK tax practitioners, March to May 2024.
2. 02ICAEW, Dos and don'ts of using AI. icaew.com/technical/technology/artificial-intelligence/generative-ai-guide/dos-and-donts
3. 03ICAEW Regulatory News, Protecting client confidentiality: internal controls and the ICAEW Code of Ethics, 28 July 2026. icaew.com/regulation/regulatory-news/regulatory-news-2026-07/protecting-client-confidentiality
4. 04Ipsos for Chartered Accountants Worldwide, AI and the Future of the Chartered Accountancy Profession, April 2025.

This article is general information, not professional or legal advice. Check current ICAEW and ICO guidance for your practice.