GUIDE / ACCOUNTING
AI policy for Australian accounting firms before 10 December 2026
Johnny Sukkar · Versantly
General guidance, not legal advice.
Use this guide to organise a conversation about the AI tools your firm permits, the work they may support and the people responsible for checking that work.
Take the resulting decisions to your privacy or legal adviser before treating them as policy or publishing a description of how your firm handles personal information.
Why now
The published research reproduces this description of the automated decision-making (ADM) transparency obligation from the Office of the Australian Information Commissioner (OAIC):
“From 10 December 2026, APP entities that use personal information in ADM with the potential to affect rights or interests will be required to provide information in their privacy policies about the kinds of personal information used and the kinds of decisions made using ADM.”
The study snapshot was taken on 3 September 2026, 98 days before the rule commences.
This is a measure of public disclosure on one day, not a compliance finding. The ADM transparency obligation is not yet in force, it applies only to automated decisions that could affect rights or interests, and a policy that says nothing about AI may sit above an excellent internal AI policy.
Ask your privacy or legal adviser to assess the quoted obligation against your firm's actual use of personal information and automated decisions.
What the 284-policy study found for accounting firms
The published study read 284 Australian accounting, legal and financial-services privacy policies on 3 September 2026, including 91 in the accounting/advisory segment.
No mention
87%
79 of the 91 accounting/advisory policies read made no reference to AI, machine learning or automated decisions.
This is a measure of public disclosure on one day, not a compliance finding. The ADM transparency obligation is not yet in force, it applies only to automated decisions that could affect rights or interests, and a policy that says nothing about AI may sit above an excellent internal AI policy.
Any mention
13%
12 of the 91 accounting/advisory policies read mentioned AI under the study's rubric.
This is a measure of public disclosure on one day, not a compliance finding. The ADM transparency obligation is not yet in force, it applies only to automated decisions that could affect rights or interests, and a policy that says nothing about AI may sit above an excellent internal AI policy.
Specific disclosure
5%
5 of the 91 accounting/advisory policies read specified uses and at least one safeguard.
This is a measure of public disclosure on one day, not a compliance finding. The ADM transparency obligation is not yet in force, it applies only to automated decisions that could affect rights or interests, and a policy that says nothing about AI may sit above an excellent internal AI policy.
A policy skeleton
Use these elements as a discussion outline to describe decisions your firm has made, not as a legally sufficient template.
- Approved tools
- Record each permitted tool and account type, the person who approved it, and the settings the firm has agreed to use, so staff can check the current list before starting work.
- Permitted tasks
- Describe the tasks allowed in each tool, the limits on those tasks and where staff should ask for a decision when proposed work falls outside the agreed scope.
- Data that stays out
- State what information staff must keep out of each tool, including the firm's restrictions on client and personal information, and use fictional material while a proposed use is being assessed.
- Who checks outputs
- Name the role responsible for checking an output before anyone relies on it, what they should check against the underlying records, and where they should take uncertainty or an error.
- Who approves changes
- Identify who can approve a new tool, task or setting, what information they need to make that decision, and where the decision and revised instructions will be recorded.
- Staff training
- Describe how staff will learn the agreed rules, practise on fictional material, find the current instructions and raise questions before using AI in the firm's work.
- Review cadence
- Set a review date and an owner, and include a review when tools, settings or the work change rather than leaving the document unchanged until the next scheduled meeting.
What to do before December
Start with the work
Ask the people doing the work to list the AI tools and tasks they use or propose to use, the information involved and where a person currently checks the output.
Make the decisions explicit
Use the policy skeleton to record permitted uses, unresolved questions and an owner for each decision, with proposed uses kept separate from work the firm has approved.
Review the privacy position
Give that record to your privacy or legal adviser to assess the ADM obligation and review whether the firm's privacy policy and collection notices describe its actual handling of personal information.
Walk staff through the rules
Before staff use an approved workflow, walk through the task with fictional material, the information that stays out, the human checks and the route for escalating an unexpected result.
Keep the record current
Assign someone to record approved changes, update staff instructions and bring the policy back for review on the agreed date or when the tools or work change.
Questions accounting firms ask
AI policy for accounting firms Australia
Start with a written policy that names approved AI tools, permitted tasks, data that must stay out, who checks outputs and who approves changes. Train staff on those rules and review them as tools and work change. Have your privacy or legal adviser check the policy against your firm's obligations. This is general guidance, not legal advice.
Can my accounting firm use ChatGPT with client data
Do not put identifiable client data into a public ChatGPT chat. First assess the tool, account settings, retention, training use and access against your firm's privacy and confidentiality obligations. Use fictional examples while an authorised person reviews the proposed use. This is general guidance, not legal advice.
Does an accounting firm's privacy policy need to mention AI
If AI is part of how your firm handles personal information, review your privacy policy and collection notices so they explain that use. Adding a generic AI sentence does not establish compliance; the wording should reflect what your firm actually does. This is general guidance, not legal advice.