Compliance for accountancy practices.
Client financial data puts UK GDPR documentation at the centre of your practice, the Worker Protection Act 2023 duty applies to your team, and AI tool use is one further exposure your PI insurer now asks about.
Why this matters
Client data first, then worker protection, then AI.
Client financial and personal data sits at the centre of a practice, so UK GDPR expects a privacy notice, a Record of Processing Activities, and a DPIA where processing is high risk.
Professional indemnity renewal questionnaires now probe data handling and AI governance together, and undocumented practice can affect cover.
The Worker Protection Act 2023 places a preventative duty on your practice as an employer, including harassment by clients and third parties.
EU AI Act Article 4 (AI literacy) applies to any firm using AI internally, including ChatGPT or Copilot for research, drafting, or analysis.
Recommended packs
The two tiers most accountants businesses need.
Clear pricing. 14-day refund.
Larger organisation, multiple entities or a wider rollout? Explore Enterprise.
Essentials
AI Acceptable Use and Literacy, the Article 4 floor PI insurers increasingly expect to see.
- AI Acceptable Use Policy
- AI Literacy Policy
Professional
For firms using AI on client data or in advisory work: Article 50 disclosures, oversight, vendor register.
- Everything in Essentials
- Article 50 Transparency Disclosures
- Human Oversight SOP
- AI Incident Response Procedure
- Vendor AI Risk Register
FAQ
Common questions for accountants.
We just use ChatGPT occasionally for drafting. Is that still AI use?
Yes. Article 4 literacy obligations apply to any AI tool use in business operations.
Does this cover MTD and HMRC specific obligations?
No. This covers AI governance. HMRC compliance is separate and handled by your tax software and practices.
Will my PI insurer accept this documentation?
The packs are written to statutory drafting standards, citing the relevant regulations. PI questionnaires typically ask whether you have a documented AI policy: you will.
What did the Digital Omnibus political agreement (May 2026) actually change?
The AI Omnibus entered into force on 27 July 2026. It extended the main Annex III high-risk timetable to 2 December 2027 and Annex I product-related high-risk rules to 2 August 2028, and simplified some requirements, including AI literacy. Article 4 still concerns measures supporting staff AI literacy; it does not require a particular certificate or a prescribed policy document. The duties and documents relevant to a business depend on its role and use case.
Has the high-risk AI deadline really moved to December 2027? What still applies now?
The AI Act applies in stages. Prohibited practices and AI literacy provisions already apply, and Article 50 transparency rules apply to the systems and content within their scope, subject to transitional provisions. Following the AI Omnibus, the main Annex III high-risk rules apply from 2 December 2027 and Annex I product-related high-risk rules from 2 August 2028. UK GDPR and existing workplace duties have their own requirements and timelines.
Does the Digital Omnibus mean we can wait until 2027 to act?
Check which provisions apply to your system and role now. Prohibited uses, relevant transparency rules, staff AI literacy measures and UK data protection duties may already require action. The Annex III high-risk transition does not suspend other applicable law, but it also does not make every future high-risk duty enforceable today. Policies and records should support the measures you actually implement.
What actually counts as a “high-risk” AI system under Annex III?
Annex III covers specified uses in areas such as recruitment, education, essential services, biometrics and law enforcement. Classification depends on the intended purpose and Article 6 criteria, including relevant exceptions. Healthcare systems may instead fall within Annex I product rules. Sector alone, or the mere use of AI, does not establish high-risk status.
Does the EU AI Act still apply to UK businesses post-Brexit?
The EU AI Act can apply to a UK provider placing AI systems on the EU market or putting them into service there, and to a UK provider or deployer where the system's output is used in the EU. Applicability depends on the role, system, intended use and Article 2 scope; using an AI tool or having EU customers does not by itself establish every obligation.
What happens if our business is not compliant?
The applicable duties, enforcement authority and penalties depend on the provision, operator role, jurisdiction and application date. The AI Act provides different maximum fines for different breaches and specific limits for SMEs. A documentation pack does not guarantee compliance or prevent enforcement. Obtain professional advice for a contested or high-stakes situation.
Reviews
What UK businesses say.
“Clausely is a total lifesaver! I used the Risk Checker and it really opened my eyes to where my business was exposed. It provided exactly the clarity I needed and gave me total peace of mind.”
Rosa Rambla Espejo
Ready to get your accountants compliance pack?
Tailored to your business. Delivered in minutes. Defensible for years.
Not sure where you stand? Take the free compliance risk check.