AI agents for accounting firms and finance teams.

What the coding step leaves untouched

Coding the bank feed is one step of a close. It is not the close.

The agent does not touch the balance sheet reconciliations. It does not touch prepaid and accrual schedules, payroll clearing, fixed assets and depreciation, sales tax, intercompany or loan amortisation. That is where close hours actually go at a CAS practice.

Judgment stays with a person. Accrual timing, revenue cut-off, related party classification, and anything needing a call with the owner all sit outside the agent's reach.

Firms are already using AI this way, not deeper. A 2026 survey of 486 bookkeeping and accounting professionals reports its task figures on an AI-active base, not the full sample.

On that base, use ran 75% for drafting client emails and communication, 71% for summarizing documents or meetings, and 69% for research.

Core work sat far lower: 42% for transaction categorization, 24% for bank reconciliation, 9% for tax return preparation.

Read that ordering before you scope anything. Communication and research first. Ledger work last.

How many bank rules can one QuickBooks file hold?

Intuit caps it at up to 2,000 bank rules per file. Each rule is bounded too, at a single rule with up to 5 conditions.

Most firms never reach 2,000. They hit something else first. The rule set stops being maintainable, nobody remembers why rule 340 exists, and a staff change orphans the whole set.

That is the point where an agent earns its place. The residue left after the rules is where the hours sit.

Does an agent cut the review workload or move it?

It moves it. The PCAOB regulates audits of issuers and registered brokers, so its standards do not bind a firm doing private company work. Its research still describes what happens to any team.

Examining a whole population, the PCAOB notes, may return dozens or even hundreds of items meeting the auditor's criteria.

The IAASB lands in the same place from a different direction. In its worked example, procedures run with automated tools do not provide sufficiently persuasive audit evidence on their own.

Two standard setters, one conclusion. Flagging is not finishing. If the agent triples the exception queue and nobody staffed the queue, the firm has bought work, not time.

Which standards actually bind your firm?

Start with the one that names AI outright. The AICPA's tax standards define a tool to include data analytics, statistical models, artificial intelligence among others. That has been in force since 1 January 2024.

If you do attest work, SQMS No. 1 is already live. It is effective for a firm's accounting and auditing practice as of December 15, 2025. Your system of quality management should already address it.

It reaches AI through the resources component. That section notes a resource from a service provider could be a methodology, an IT application, or people used in an engagement. An AI vendor lands squarely there.

The audit evidence standard is older than most firms assume. SAS 142 has been effective for audits of financial statements for periods ending on or after Dec. 15, 2022.

Only firms auditing issuers or registered brokers work under PCAOB rules. For those firms, AS 1201 states that the engagement partner is responsible for the engagement and its performance, including supervision of the team.

Does a summary count as tax return information?

Yes. The regulation covers anything the preparer builds out of return data. It states that tax return information also includes information the tax return preparer derives or generates from tax return information.

That closes the most common workaround. Sending a model a summary, a redacted extract, or a draft memo does not put you outside the rule.

The base definition is already broad. It reaches a taxpayer's name, address, or identifying number furnished in connection with preparing the return.

So scope the question properly. Ask what the agent touches, not what it stores.

Does it matter which country the model runs in?

It decides whether you need written client consent. If a person receiving return information sits outside the country, the taxpayer's consent under § 301.7216-3 prior to any disclosure is required. That holds even when the person works for your own firm.

The regulation treats remote viewing as disclosure. In its own example, a contractor abroad views data held on a US server, and Firm is required to obtain T's consent first.

For 1040 clients the default is redaction. A US preparer must redact or otherwise mask the taxpayer's SSN before the tax return information is disclosed outside of the United States.

Consent is available, but only through a narrow exception at 301.7216-3(b)(4)(ii). That route requires an adequate data protection safeguard as defined by the Secretary. The firm must also verify that safeguard inside the consent request itself.

Read that as an actual redaction step in the pipeline. Know your hosting region and your vendor's support locations before you scope anything.

Does running the agent in your own cloud settle the 7216 question?

No, and it is worth being exact about what it does change. Firm ownership puts the credentials, the logs and the hosting region under your control. It also lets you see what the agent did without asking a vendor.

It does not remove anyone from the section 7216 analysis. The team that builds and maintains the agent receives return information, which makes them a preparer under the same rule quoted above. If the agent calls a hosted model, the model provider receives the data too.

So the written notice and the contract terms still apply. So does the hosting region question, and the SSN redaction step for 1040 files.

Some vendors do state their training position clearly. Karbon says that Karbon does not use your firm's data to train AI models. Owning the deployment does not replace that assurance. It just puts you in a position to check it.

Two technical floors apply either way. The Safeguards Rule requires you to protect by encryption all customer information held or transmitted by you both in transit over external networks and at rest, and to implement multi-factor authentication for any individual accessing any information system.

Do you have to tell clients you are using AI?

No rule forces it today. The Journal of Accountancy reports that no specific federal law or professional standard applicable to CPAs mandates disclosure when generative AI is used.

The AICPA Code is stricter about third-party providers generally. Before disclosing confidential client information, the member should inform the client, preferably in writing, that the member may use a third-party service provider. If the client objects, the firm drops the provider or declines the engagement.

There is a carve-out, and its edge is the live question. No notice is required for record storage, software application hosting, or authorized e-file tax transmittal services. Whether an agent that drafts and classifies is merely hosting is not settled anywhere.

Insurers are nudging firms toward telling clients anyway. McGowan's John Raspante recommends engagement letter language disclosing AI use, plus a clause letting clients opt out entirely.

Who is liable when the agent is confidently wrong?

The firm. Aon's Nicole Graham puts it plainly: generative AI can be confidently wrong. She adds that if the tool is wrong and nobody checks, a client will come after the firm, not the AI tool.

The claims data does not exist yet. Aon's Stan Sterna says there really hasn't been a lot of claims or large dollar amounts paid on claims. Pretending otherwise would mean inventing a number.

There is one live example of what unchecked output costs. In Clinco, T.C. Memo. 2026-16, three of the four cases cited in a taxpayer's brief did not exist.

Judge Holmes wrote that submitting a brief with fictitious caselaw is a recipe for sanctions.

The Journal of Accountancy reports that Clinco appears to be the first Tax Court case to address potential AI hallucinations.

The control is documentation, and it is cheap. Aon's guidance is to record in the client file the prompts used, how the outputs were verified, and who performed the review.

What the IRS says about which AI a firm may use

Not "no". On 24 June 2026 the IRS Office of Professional Responsibility issued Alert 2026-19, Introductory Guidelines for Responsible AI Use in Federal Tax Practice.

The AICPA summarizes the position fairly. OPR's message is not that practitioners may never use AI. Rather, AI must be used with human oversight, professional judgment, due diligence, confidentiality safeguards and accountability.

On review, OPR is specific. Practitioners must thoroughly review all AI-created documents before they reach a client or the IRS. They cannot rely solely on AI.

On where the data goes, it is equally direct. Practitioners must strictly handle all client data using only secure, enterprise-approved AI.

Vendor diligence is a duty, not a preference. OPR states that outsourced or third-party AI tools should be vetted, with the steps documented to show adherence to Circular 230 section 10.36.

What firms want the agent to do

Not run on its own. In the Intuit survey, only 6% want AI to execute autonomously.

The shape they do want is draft plus approve. In the same survey, 40% want AI as a support tool and 34% want AI to draft, with a human reviewing and signing off.

Trust levels match that. Financial Cents found only 19% trust AI enough to use it with limited review. On consequential decisions, Intuit found 64% say the work was entirely or primarily human-driven.

Firms are clear about what stays theirs. In the Financial Cents survey, 90% say human judgment matters more, not less in the AI era. The report calls it the most agreed statement it recorded.

Standards describe the same thing differently. The AICPA notes that audit standards require auditors to think critically and maintain professional skepticism. A model output cannot perform that on itself.

So build for draft plus approve. An autonomy pitch sells against what the buyer has already decided.

Does using AI mean lowering your fees?

The IRS has raised the question, and almost nobody warns partners about it. OPR states that billing clients for manual labor or time that was not actually spent or double billing for AI-assisted tasks may violate § 10.27. It adds that cost savings should be passed on openly.

The AICPA has pushed back. It calls that an overly simplistic view that ignores the full economics of AI adoption, and is seeking clarification from the IRS.

This is unresolved, and no page should pretend otherwise.

The practical move is to settle pricing before the build. A firm on hourly billing that cuts close hours has cut its own revenue.

How to start without betting busy season on it

Pick one workflow. Run it on a closed prior period. Compare the output against what the team actually did.

Intake and document sorting are the usual first move. A mistake there shows up immediately as a misfiled page, not silently as a wrong number. Sorting and indexing are also not a substantive determination about the client's tax liability.

Be honest about which risk that lowers. Indexing carries the lowest judgment risk, not the lowest data risk. The tool still receives complete W-2s, 1099s and brokerage statements, with names, addresses and SSNs on them. Every vendor question in the sections above applies unchanged.

Name an owner before the build starts. Make it a manager who knows the chart of accounts and can decide, not a partner in February.

Expect a messy stack, because most are. Among CAS practices surveyed, only 46% of respondents report using a specific set of software applications that are fully integrated.

Can an agent run AP and AR without opening a fraud hole?

An agent can do the matching and the chasing. It should not be the control that releases money or edits a vendor bank record.

Business email compromise targets exactly that seam. The FBI's advice is to use secondary channels or two factor authentication to verify requests for changes in account information with the intended recipient, per IC3 guidance on BEC. An agent holding both vendor master edit rights and payment release collapses that check into one system. Keep the two in different hands.

On the AR side, an agent can apply cash, age balances and draft reminders. Short pay reasons, credit limits and write offs stay judgments.

The part worth automating first sits upstream of the payment run. Publication 1281, the IRS guide to the backup withholding rules under section 3406, tells payers that for all payees the initial TIN solicitation is made when the payee opens the account or when the transaction occurs. An agent that will not create a vendor without a W-9 on file is working on the cause, not the January symptom.

Human gate: the person who releases payment, and who verifies any banking change out of band.

Can an agent tell us when a client crosses economic nexus in another state?

It can watch the numbers. It cannot make the registration call, and there is no single national threshold for it to code against.

South Dakota v. Wayfair upheld a law covering sellers that, on an annual basis, deliver more than $100,000 of goods or services into the state or engage in 200 or more separate transactions for the delivery of goods and services into the state. California instead reaches a retailer once total combined sales of tangible personal property for delivery in California by the retailer and all related persons exceed $500,000, with no transaction count at all, per the CDTFA. Two states, two different tests, and a client can be well past one while clear of the other.

The Court also left the door open, saying Congress may legislate to address these problems if it deems it necessary and fit to do so. Absent one federal test, an agent is coding against each state's own rule, so any threshold table it uses is a snapshot of legislation that keeps moving. Whether a vendor refreshes that table is a contract term, not something you can assume.

Honest scope: a rolling sales by destination view, an exception raised as a client approaches a stated threshold, and a recorded date when each threshold was last checked against the state.

Human gate: whoever approves a registration, and owns the back period exposure and any voluntary disclosure that follows.

Can an agent maintain a fixed asset schedule and depreciation?

It can maintain the schedule. It cannot make the two decisions that determine whether the schedule is right.

The first is repair or improvement. Under Reg. 1.263(a)-3(d), a unit of property is improved, and the related amounts generally must be capitalized, if the amounts paid for activities performed after the property was placed in service are for a betterment to the unit of property, restore it, or adapt it to a new or different use. Those are conclusions about facts, not fields on an invoice.

The second is the placed in service date. Publication 946 states that property is placed in service when it is ready and available for a specific use, that this is therefore not necessarily the date it is first used, and gives the example of a machine delivered in one year but not installed and operational until the next, which counts as placed in service in the later year.

The de minimis safe harbor is codeable, and strict. Reg. 1.263(a)-1(f) sets, for a taxpayer with an applicable financial statement, a limit of $5,000 per invoice or per item as substantiated by the invoice, written accounting procedures in place at the beginning of the taxable year, and an election made by attaching a statement to a timely filed original federal return including extensions. The election cannot be revoked. For a taxpayer without an applicable financial statement the regulation still reads $500, and Notice 2015-82 increased that limit to $2,500, so the operative figure is not the one printed in the CFR text.

Human gate: the preparer who signs the return the election rides on.

Can an agent build a client forecast or projection?

It can build the model. The professional standards stop you from issuing the result without the assumptions written down.

AR-C 70.19 states that the summary of significant assumptions is essential to the user's understanding of prospective financial information, and that accordingly the accountant should not prepare prospective financial information that excludes disclosure of it, nor a financial projection that excludes either an identification of the hypothetical assumptions or a description of the limitations on the usefulness of the presentation.

If you go further and examine a forecast, AT-C 305.12 says a practitioner should not examine a forecast or projection that discloses none of the significant assumptions, and AT-C 305.23 says the practitioner should evaluate the support for the significant assumptions individually and in the aggregate. The preface to those same attestation standards adds that although a practitioner may assist the responsible party in developing or presenting the subject matter, the responsible party remains responsible for it.

That is the real constraint on tooling. Output you cannot decompose into named assumptions cannot meet those requirements, however good the number looks.

Human gate: client management, adopting the assumptions in writing before anything leaves the firm.

Is an AI agent inside the quality management standard, and what does it make us document?

It depends which practice the agent runs in. SQMS No. 1 applies to "all firms that perform any engagement included in a firm's accounting and auditing practice," and defines that practice as audit, attestation, review, compilation "and any other services for which standards have been promulgated by" the Auditing Standards Board or the Accounting and Review Services Committee. Where other AICPA technical committees write standards, "engagements performed in accordance with those standards are not encompassed in the definition of an accounting and auditing practice." Tax return preparation is not on the ASB or ARSC list, so an agent used only in tax work falls outside this particular standard.

Where it does apply, paragraph 33f requires a quality objective that "Appropriate technological resources are obtained or developed, implemented, maintained, and used to enable the operation of the firm's system of quality management and the performance of engagements." Paragraph 14 required compliant systems to be designed and implemented by December 15, 2025, with the evaluation of the system performed within one year after that date.

There is no required AI checklist. Paragraph A105 says the firm "may consider" matters including whether outputs "achieve the purpose for which they will be used" and "the need to develop procedures that set out how the IT application operates." On the peer review side the relevant text is application material rather than a requirement: paragraph .A48 of Peer Review Standards Update No. 2 names "human, intellectual, or technology resources" among the areas where inattention "may result in a deficiency or significant deficiency in a report with a peer review rating of pass with deficiencies or fail."

If the agent developed our analytical expectation, what does the file have to show?

The expectation itself, plus the factors behind it. AU-C 520.08a requires the audit documentation to include "The expectation referred to in paragraph .05c and the factors considered in its development when that expectation or those factors are not otherwise readily determinable from the audit documentation."

That is the requirement an output you cannot decompose will fail. Paragraph .05b also requires evaluating the reliability of the data the expectation was developed from, "taking into account the source, comparability, and nature and relevance of information available and controls over preparation," and .05c requires evaluating whether the expectation is sufficiently precise to identify a misstatement that could make the financial statements materially misstated. AU-C 520 says nothing anywhere about tools, technology or automation, so there is no accommodation in it to read in for an agent.

GAAS names the failure mode elsewhere. AU-C 220.A36 lists "Overreliance on automated tools and techniques, which may result in the engagement team not critically assessing audit evidence" among conditions that may impede professional skepticism, and .A65 adds that inappropriate use of technological resources "may, however, increase the risk of overreliance on the information produced for decision-making purposes."

Can we still sign the opinion if we built the agent for an attest client?

Probably not, and running it afterward is the separate problem. This is an independence question, so it only arises for a client you also audit, review or attest for.

ET section 1.295.145 of the AICPA Code of Professional Conduct defines a financial information system as "a system that aggregates source data underlying the financial statements or generates information that is significant to either the financial statements or financial processes as a whole," and adds that it "includes a tool that calculates results" unless the tool performs only discrete calculations, the client accepts responsibility for the input and assumptions, and the client has enough information to understand the calculation and the results. Paragraph .05 then says that when a member designs or develops an attest client's FIS, threats "would not be at an acceptable level and could not be reduced to an acceptable level by the application of safeguards and independence would be impaired." The Code's revision table records the interpretation as effective January 1, 2023.

Running it is where firms get caught. Paragraph .21 says post-implementation maintenance, support and monitoring impair independence if they involve the client "outsourcing an ongoing function, process, or activity to the member that would result in the member assuming a management responsibility," with examples including a member who operates the client's network, "such as managing the attest client's systems or software applications." Paragraph .22 leaves room only for services that are "individually separate, distinct, and not ongoing engagements" with no function outsourced to you.

The Professional Ethics Division's nonattest services toolkit is a checklist, not a rule, and the Code itself flags the related information systems practice aid as nonauthoritative. The checklist is still the fastest way to see where you stand: it lists "Accepting responsibility for designing, implementing, or maintaining internal control" and "Performing ongoing evaluations of the client's internal control as part of its monitoring activities" as examples of management responsibilities, and asks whether the client agreed, before the work started, to oversee the service through someone with "suitable skill, knowledge, and/or experience." If the answer is no, "independence is impaired and you can stop here."