Short answer: banning AI does not stop accountants using it. 74% of UK accountancy students and early-career finance professionals already use AI every day, so a ban pushes the work onto free tools on personal phones and laptops, where client data leaves the firm with no log and no record. The safer policy is a Safe Lane: approved tools, clear limits on what client data can go in, and a human check on everything AI produces.
Some UK accounting firms think the safest way to handle AI is to ban it. No AI, no risk. But the work still needs doing, and the tools are one tap away. When a firm says no, or its own tools hit their limit mid-deadline, people do not stop. They switch to whatever is on their own device.
What is shadow AI in accounting?
Shadow AI is any AI tool used for client work without the firm’s approval or oversight. A junior pasting a client’s bank statement into a personal chatbot to categorise transactions is shadow AI. So is a senior asking a free tool to summarise a client letter on their own phone.
The real risk is not the AI itself. It is where the client data goes. A bank statement pasted into a personal chatbot has left the firm’s control. There is no log of what was shared, no record of who shared it, and no agreement with the tool provider about what happens to it next.
What the data says about young accountants and AI
Intuit surveyed 1,003 UK accountancy students and early-career finance professionals aged 18 to 24 between 1 and 11 June 2026, including people studying for or recently qualified with the ICAEW, ACCA and CIMA (Intuit, October 2026).
| Finding | Share of respondents |
|---|---|
| Use AI daily or several times a day to learn, work and solve problems | 74% |
| Have concerns about keeping data secure when using AI tools | 93% |
| Believe they are better equipped to use AI than their managers | 90% |
Two of those numbers matter most for a practice owner. Daily use means AI is already part of how your newest people work, whether your policy allows it or not. And 93% worrying about data security means they know the risk. Intuit reports that young respondents expect employers to provide clear governance, training and safeguards. What many of them want is clear rules, not a ban.
Why a ban makes the data risk worse
A ban removes the approved route but not the need. The deadline is still Friday, the client still sent 400 lines of bank transactions, and a free tool will sort them in seconds. So the work moves to the one place the firm cannot see.
- No visibility. The firm does not know which tools are in use, so it cannot assess them.
- No record. If a client asks what happened to their data, there is nothing to check.
- No contract. The firm has no agreement with a tool its staff chose on their own.
Under UK GDPR, the firm stays responsible for the client personal data its people handle, whichever tool they use. The ICO’s guidance on AI and data protection is the place to start when deciding what an approved tool needs to meet.
The Safe Lane rule: three parts
Give staff approved AI tools
If the firm provides a tool that does the job, people never need their own. Pick tools the firm has assessed and contracted with, and make them easy to reach at the moments people actually need help.
Say clearly what client data can go in, and what never can
A one-page list beats a long policy nobody reads. Write it in examples your team will recognise, like the table below.
Keep a human check on anything AI produces
AI output is a draft. A named person reviews it before it reaches a client, a ledger or HMRC. For deciding which tasks a tool can run and which a person must sign, see the Undo Test.
An example data list (adapt it for your firm)
| Usually fine in an approved tool | Never in a personal or unapproved tool |
|---|---|
| Questions about published HMRC or Companies House guidance | Bank statements and transaction lists |
| Drafting a generic client email or checklist | Payslips, NI numbers, UTRs and dates of birth |
| Anonymised figures with names and identifiers removed | Passport, driving licence or other ID scans |
| Spreadsheet formulas and software how-to questions | Named client letters, emails and working papers |
Ask your team, without blame, which AI tools they used for work last month. If the honest answer includes tools the firm has never heard of, the ban is not working. The data is already moving; the only question is whether you can see it.
The same lane applies to outside help
Whoever handles client data, in-house or outsourced, needs the same lane: approved systems, clear limits, and a named person checking the work. Before giving any outside team access, ask three questions:
- Which systems will our client data sit in, and are they ones we have agreed?
- What is your rule on AI tools and client data, and is it written down?
- Who reviews each file before it comes back to us, by name?
For the wider security picture, including the paperwork UK GDPR requires before an offshore team sees client data, see whether offshore outsourcing is safe and the first-month checklist.
How EarthOne works
Client files stay inside agreed, GDPR-compliant systems, with senior review on every file. Our team works in your own software from named logins, and a UK GDPR Data Processing Agreement is signed before the first file moves. See offshore accounting services for UK firms or our GDPR and data approach.
Is your firm’s AI policy a ban, or a safe lane?
If you are adding outside capacity, tell us which systems your client data lives in. We will explain exactly where our team works and who reviews each file.
Send an enquiry
