How to Set Up an AI Steering Committee at an Accounting or Law Firm

An AI steering committee is the small group that decides which AI uses your firm approves, which vendors may touch client data, what the AI policy says and when each approved use is reviewed again. At a 20 to 200 person accounting or law firm, three to eight people chaired by the managing partner or COO is enough. It does not replace duties the rules already place on specific people, such as an accounting firm's Safeguards Rule Qualified Individual and the partners responsible for firm procedures.

What does an AI steering committee do at a professional services firm?

It turns individual AI experiments into firm decisions with a record. It approves use cases and vendors, owns the AI policy, sets review dates and reports to the partners, so that when a client, a peer reviewer or a regulator asks who approved a tool, the firm has an answer.

Some firms call it an AI governance committee. CPA.com's 2025 AI in Accounting Report (June 2025, produced with be radical) tells firms in its pilot phase to "assign internal champions and establish a steering committee".

Most smaller firms have not yet written a policy, let alone formed a committee. Financial Cents' 2026 State of AI in Accounting and Bookkeeping report, a survey of 486 North American professionals fielded in July and August 2026, found that 87 percent of the more than 350 firms using AI had no formal written AI policy. Financial Cents sells practice management software, 68 percent of respondents work at firms of 2 to 30 people and 27 percent are solo practitioners, so treat it as direction.

Who owns AI at an accounting or law firm?

The managing partner owns accountability, the committee owns the decisions, and each approved use has a named owner who answers for it. The rules already put these duties on people, named or not: under Circular 230 the IRS may pick who answers if the firm names no one, and under Rule 5.1 every partner carries it.

Circular 230 at 31 CFR 10.36 requires the individuals with principal authority for a firm's tax practice to take reasonable steps to ensure the firm has adequate compliance procedures. The IRS Office of Professional Responsibility applied that section to AI in Issue Number 2026-19 (24 June 2026), guidance saying firms must deploy documented internal AI policies covering staff training, data handling and vetting of outside tools.

For law firms, ABA Model Rule 5.1(a) asks partners and lawyers with comparable managerial authority to make reasonable efforts to ensure the firm has measures giving reasonable assurance that its lawyers comply. A committee is how a firm meets these duties without a new executive title.

Who should sit on the committee?

Three to five people at a smaller firm and five to eight at a larger one, chaired by the managing partner or COO. Include someone who uses the tools daily, the person responsible for information security, and a risk voice: a quality partner at an accounting firm, a general counsel or ethics partner at a law firm.

Keep vendors and any implementation partner out of the voting seats. At an accounting firm, if the Qualified Individual works for an outside provider, which 16 CFR 314.4(a) allows, the firm keeps responsibility for compliance, must designate a senior member of its own staff to direct and oversee the Qualified Individual, and must require the provider to maintain a security program that protects the firm. That senior person belongs on the committee.

What does the committee decide, and what does it delegate?

Four decisions belong to the committee: approving use cases, approving vendors and models, owning the AI policy and setting review dates. Everything else, from day to day prompting to choosing engagements for an approved tool, sits with the named owner of that use.

The Gaper Ownership Map handles the first decision: each request arrives with every workflow step sorted into one of three tiers, and the committee approves the sorting, not just the tool.

Moving a step to a lighter tier is a new approval and needs evidence from the review log. The other three decisions:

• Vendor and model approval. The security owner does the diligence and the committee decides, using the Rent-vs-Own test: rent a point tool for narrow, common work, own a supervised agent when it touches systems of record, client data or risk. A model version change needs review, because the human-in-the-loop checks were set against the old one.
• Policy. The committee drafts and maintains it; the partners adopt it.
• Review cadence. Every approval carries a review date, and an approval past its date lapses until someone reviews it.

An AI steering committee charter outline you can adapt

Keep it to two pages:

1. Purpose. Approve and review the firm's use of AI on client and firm data, for the partners.
2. Scope. Every AI tool or feature touching client information, including AI added to software the firm already licenses.
3. Membership. Seats defined by role, not by name, with a tie-break for the chair.
4. Decision rights. The four decisions above, and what the chair may approve between meetings.
5. Intake. One short request form: the workflow, the data it touches, the tier for each step, the proposed owner and how success will be measured.
6. Records. An approval log with date, decision, conditions, owner and review date, kept with the firm's security and quality records.
7. Reporting and review. A note to the partners after each meeting, a fuller annual report, and a yearly charter review alongside the policy.

How often should the committee meet?

Monthly for the first two quarters, while the policy is new and requests are queued, then quarterly. Between meetings, let the chair and the security owner approve low-risk requests, such as an automated step on non-client data, and ratify them at the next meeting.

An accounting firm holding information on 5,000 or more consumers can feed the committee's annual report into the Qualified Individual's written report to the board or equivalent governing body, or to the responsible senior officer, under 314.4(i). 16 CFR 314.6 removes that report and three other duties below that line; our guide to the Safeguards duties under 5,000 consumers sets out what remains.

Which KPIs should the committee track?

Track measured results, not modeled ones: time saved per engagement taken from timesheets, the error rate reviewers find in agent-drafted work, turnaround time, and staff and client satisfaction. Add governance measures, such as tool coverage and lapsed approvals.

The first four are the CPA.com report's pilot KPIs. Baseline each before go-live and never accept a vendor's estimate. Governance measures:

• Coverage. Tools found in use against tools approved.
• Speed of intake. Days from request to decision. A slow committee creates shadow AI.
• Reviewer correction rate. How often the approver changes an agent's draft; a rising rate is the signal to pause.
• Lapsed approvals. Approvals past their review date.
• Consents on file. For accounting firms, 7216 consents obtained against uses that need them.
• Incidents and near misses. What went wrong, and whether a step's tier should change.

How should the committee handle shadow AI?

Make it an intake problem the committee owns. Put a discovery sweep and a no-penalty amnesty on the first agenda, track tools found in use against tools approved and days to decision, and approve a replacement before restricting anything.

Our guide to shadow AI in law firms covers where to look and what the policy should say, and most of it carries over to accounting firms.

What does the committee owe under 7216 and the Safeguards Rule?

For an accounting firm, every use-case approval that touches tax return information needs a consent decision, and every approval of a vendor that will receive or access client information is service provider oversight under the Safeguards Rule. Both checks come before first use, because a 7216 consent cannot be given after the fact.

The IRS reminded practitioners in IR-2026-92 (18 August 2026) that under the Gramm-Leach-Bliley Act "tax and accounting professionals are considered financial institutions", which brings the FTC Safeguards Rule, 16 CFR part 314, into scope. Three elements map onto committee work:

• Service providers, 314.4(f). Select capable providers, require the safeguards by contract and periodically assess them: the vendor approval and its review date.
• Change, 314.4(c)(7) and (g). Adopt change management procedures and adjust the program for material changes to operations or business arrangements. Treat a new AI tool on client data as one, and record the WISP update in the same approval.
• The Qualified Individual, 314.4(a). The committee gives this person a seat; it does not replace them.

On 7216, 301.7216-3(a) permits disclosure or use as the taxpayer directs once the preparer has a written consent. The consent must be knowing and voluntary and generally must name the recipient of a disclosure under (a)(3)(i)(B), though for clients who do not file a Form 1040, (a)(3)(iii) allows a descriptive class of entities within limits. Under (b)(1) it must come first. For Form 1040 clients, Rev. Proc. 2013-14 sets the required format and wording. If an offshore team or any other preparer outside the United States will receive the data, (b)(4) bars consent to disclose a 1040 client's SSN to it, subject only to the narrow safeguard exception at (b)(4)(ii). Whether that reaches a model API hosted abroad is unsettled, so record the processing region in every approval.

Ownership of the tool does not remove the consent duty; it changes control over region, logs and masking. Our Section 7216 consent guide works through whether a model API call is a disclosure at all. This is information, not legal advice: have counsel review the consent forms and policy before the first approval.

For audit firms, SQMS No. 1 puts technological resources inside the quality management system, so be ready to show a peer reviewer who approved each tool.

What does ABA Formal Opinion 512 ask of a law firm committee?

It asks managerial lawyers to set clear policies on permitted generative AI use, and supervisory lawyers to make reasonable efforts so that lawyers and nonlawyers comply, including through training. A steering committee is the natural owner of that policy, the training record and the vendor diligence.

ABA Formal Opinion 512, issued 29 July 2024, ties supervision to Rules 5.1 and 5.3, and expects a firm using an outside AI provider to be satisfied the provider will do the work capably and protect confidential information.

For the committee that means three standing items: a signed policy, a training log that includes paralegals and staff, and a vendor file with terms of use, retention and training settings per tool. Opinion 512 says lawyers may not rely solely on a generative AI tool for work that calls for professional judgment, so keep a lawyer's name on those approvals. The Model Rules bind only as states adopt them and ethics opinions are advisory, so have ethics counsel check the policy against your state's rules. Our legal AI hub covers confidentiality and supervision in depth.

How does the committee work with an outside implementation partner?

The partner proposes and builds, and the committee approves and keeps the record. A good partner brings each use case to intake already sorted by Ownership Map tier, with the data it touches and the review step named, and hands over what the committee needs to review it later.

Gaper is the AI-native implementation partner that deploys supervised AI agents you own. The Gaper method (Assess, Scope, Build, Supervise, Hand over) ends with the firm holding the code, prompts, evaluation set, runbook and audit trail, so the committee reviews evidence it controls rather than a vendor's dashboard. Our page on what an AI-native implementation partner is explains when to use one. For a first use case, a free AI assessment maps one workflow and makes the build or buy call.

When is a steering committee overkill?

When there is nothing to decide. A firm with one approved business tool, no client data going into AI and a managing partner who already approves every software purchase needs a named owner and a review date, not a committee.

The core duties do not disappear with size: someone still holds principal authority for a tax practice under Circular 230 or managerial authority under your state's version of Rule 5.1, and an accounting or tax practice still needs a Safeguards Qualified Individual even below 5,000 consumers. Write down who holds each duty and keep the approval log. Convene the committee when a second use case touching client data arrives; if it then sits idle for two meetings running, fold it into the partners' regular meeting until a new request arrives.

Book a free AI assessment

Thirty minutes, no commitment. We map one workflow, make the build or buy call, and scope the smallest thing worth shipping.