top of page

Chartered accountants: governing AI use within the firm

Writer: Alexandre KOERFER
Alexandre KOERFER
9 hours ago
5 min read
Calculator resting on a stack of accounting documents

Generative AI tools are making their way into chartered accountancy firms, often at the initiative of staff themselves. The applicable rules are not new: professional secrecy, data protection and responsibility for the work produced. What remains is to turn them into clear practices that the whole team knows.

Professional secrecy also applies to AI tools

Article 21 of Ordinance No. 45-2138 of 19 September 1945 (ordonnance n° 45-2138) binds chartered accountants to professional secrecy ‘under the conditions and subject to the penalties laid down in Article 226-13 of the Criminal Code’ (Code pénal) [1]. The same obligation applies, in particular, to trainee chartered accountants and to certain employees within the profession [1].

Entering a client's general ledger, a set of tax return forms (liasse fiscale) or a payslip into a consumer AI tool amounts to passing that information to the tool's provider. The white paper published by the Ordre des experts-comptables Paris Île-de-France (the Paris regional Order of Chartered Accountants) points out that confidential data, or data covered by secrecy, must not be submitted to a tool that does not offer sufficient safeguards [7]. It also notes that some general-purpose tools use the data entered to train their models [7].

In 2025, the Conseil national de l'Ordre des experts-comptables (the national council of the French Order of Chartered Accountants) published a model AI use policy (charte d'utilisation de l'IA). According to Compta Online, the document stresses that no sensitive data should be uploaded to unsecured platforms [8].

Protecting client data: the GDPR framework

On 18 July 2024, the CNIL (the French data protection authority) published a Q&A on the use of generative AI systems [6]. Several points directly concern firms:

  • where use involves personal data, on-premises deployment is generally presented as the safer option [6];

  • a cloud-hosted service requires a data processing agreement setting out responsibilities and authorised access to the data [6];

  • where possible, the provider's reuse of usage data should be disabled [6];

  • the data protection officer should be involved and, where applicable, a data protection impact assessment (DPIA) carried out [6];

  • users should enter only information they are authorised to share [6].

The Paris regional white paper adds that anonymisation ‘is an essential step’ before any sensitive information is sent [7]. Where anonymisation is impossible, for example with DSN files (déclaration sociale nominative, the monthly payroll returns filed by employers), certain uses must be ruled out [7].

The chartered accountant remains responsible for what AI produces

Article 12 of the 1945 Ordinance provides that chartered accountants ‘in all cases assume responsibility for their work and activities’ [3]. The liability of a chartered accountancy firm in its own right leaves intact the personal liability of each chartered accountant for the work he or she performs [3]. The text makes no distinction according to how the work was prepared.

The risks are well identified. The Paris regional white paper cites ‘hallucinations’, in particular invented tax or case-law references, and makes rigorous verification of AI-generated information ‘a golden rule’ [7]. The CNIL recommends never reproducing the outputs of these systems as they stand [6].

Verification should be proportionate to the use. For deliverables intended for clients, the model policy proposed in the white paper provides for sign-off by a manager and a thorough review [7].

Engagement letters, choice of tools and configuration

Article 151 of Decree No. 2012-432 of 30 March 2012, which forms part of the profession's code of ethics, requires a written contract defining the engagement and the rights and obligations of each party [4]. This contract may take the form of an engagement letter (lettre de mission) [4]. The texts reviewed do not require a specific AI clause. The engagement letter nonetheless remains the natural vehicle for informing clients of the tools used and of how their data is processed.

Choosing tools calls for a few prior checks:

  • where the data is hosted and processed [6] [7];

  • whether the provider can reuse the data entered, and how this can be disabled [6];

  • whether a GDPR-compliant data processing agreement is in place [6];

  • account settings, which should be set by the firm rather than left to each user.

The white paper recommends favouring professional tools designed for the profession and checking each solution's GDPR compliance [7]. It also mentions local hosting as the option offering maximum control [7].

AI use policy and AI literacy within teams

Regulation (EU) 2024/1689 on artificial intelligence (the EU AI Act) applies to ‘deployers’, that is, organisations using an AI system under their own authority in a professional context [5]. Its Article 4, as amended by Regulation (EU) 2026/1744, requires them to take measures to promote AI literacy among their staff and other persons using these systems on their behalf [5]. These measures take into account the technical knowledge, experience and training of those persons, as well as the context of use [5]. The obligation ‘does not require’ a specific level of AI literacy to be ensured for any individual [5].

The code of ethics points in the same direction. Professionals must ensure that the staff to whom they entrust work have competence appropriate to its nature and complexity [2]. The CNIL, for its part, recommends appropriate training for users and regular checks [6].

For the Paris regional white paper, the use policy is no mere formality: ‘It is a strategic tool’ [7]. The proposed model, to be adapted by each firm, covers in particular:

  • data classification: public, internal, client, sensitive [7];

  • the uses permitted for each category [7];

  • the levels of sign-off required for outputs [7];

  • incident management and a periodic review of the policy [7].

The same document describes team training as ‘fundamental’ and suggests appointing AI champions within teams [7].

Our recommendations

  • Take stock of the AI tools actually used in the firm, including those adopted by individuals, and of the data that passes through them.

  • Adopt a use policy that classifies data and sets out, for each category, the authorised tools and the level of sign-off required.

  • Choose tools whose hosting, non-reuse of data and processing arrangements are documented, then configure them centrally.

  • Train all staff and keep a record of the measures taken to promote AI literacy.

  • Update the template engagement letter to inform clients of the tools used and of how their data is processed.

If you would like to review how AI is used in your firm, Tao Sense offers a free assessment.

Sources

Comments

Commenting on this post isn't available anymore. Contact the site owner for more info.
bottom of page