The AI in your accounting software is now squarely in scope

On 22 July 2026 the Tax Practitioners Board published TPB(GS) 55/2026, finalising the AI guidance it released in draft back in March.

‍

The headline is the part everyone has reported: using AI doesn’t reduce or transfer your obligations. Competency, confidentiality, reasonable care, record-keeping and supervision all still apply. Fair enough - that was in the draft too.

‍

The interesting bit is what changed between the draft and the final.

‍

‍

Three changes that matter

‍

First, the guidance now names AI that is embedded in software. The draft’s list of AI capability didn’t mention it. The final adds “AI features which may be embedded within software or third-party platforms”, along with AI that acts autonomously on the user’s behalf.

‍

Second, the confidentiality trigger got broader. The draft said client confidentiality could be engaged by entering information into “AI chatbots/copilots” - language built around someone typing into a chat window. The final says “AI models and tools”. That change captures AI processing your client data in the background.

‍

Third, the guidance now asks you to consider not just how client information is stored, but where, and how the AI is using it.

‍

Put together: the draft was written around AI you deliberately pick up. The final is written around AI that touches client data, full stop.

‍

‍

What it doesn’t tell you

‍

During consultation, the NTAA warned that AI is increasingly switched on by default in the platforms firms already run, and that practitioners often can’t tell where that data goes. It asked the TPB to confirm that simply naming your software providers to clients would be enough.

‍

The TPB didn’t confirm that. The recommended disclosure still includes where client data will be stored — which is exactly the thing your software vendor may not tell you.

‍

There is a practical route, though. The guidance accepts that “a general authority consenting to disclosure to third parties may also be acceptable”, and the final adds “whether AI tools may be used” to the list of things worth telling clients. For embedded AI, that combination is probably the most workable approach.

‍

‍

One more change worth knowing

‍

The final guidance adds a sentence that wasn’t in the draft: where you review AI output, each of those steps should be documented. It also brings the client-records obligation into play alongside quality management.

‍

An undocumented review has always been hard to evidence. Now the guidance says so outright.

‍

What to do about it

• List what’s actually running. Every platform holding client data - ledger, practice management, document storage, email. For each, what AI is present, is it on by default, can it be turned off?

• Update your engagement letters. If the wording predates AI, it needs revisiting. A general authority plus a named list of platforms is likely the proportionate approach.

• Record the review, not just do it. Wherever AI touches client work, someone qualified reviews and signs off - and there’s a record of it.

• Keep a vendor register. What each vendor has told you about AI and data location, and when. Re-check on renewal.

‍

‍

The short version

‍

The guidance rewards deliberateness. A tool you chose, understood, disclosed and reviewed sits comfortably inside the Code. A tool quietly processing client ledgers because it shipped switched-on is harder to place - not because it’s less safe, but because you can’t evidence any of it.

‍

That’s why XBert runs as a deliberate layer over your practice data rather than an assistant bolted into it: a named tool, in a defined scope, producing output a person reviews before it reaches a client. Easy to name in an engagement letter, easy to point to if anyone asks.

‍

The regulator has widened the net. The job now is knowing what’s actually running in your practice - including the parts nobody switched on.

‍