Doing bookkeeping faster is not the opportunity. Selling what it frees up is.

The four things being sold as an "AI accounting assistant"

This page is scoped to tools that touch the ledger, the bank feed and the workpaper. Research tools like Checkpoint Edge are deliberately out of scope here.

Inside that scope, four different products share one label. A bank feed classifier that suggests a category. A document extractor that reads a W-2 into a field. A drafting tool that writes the client email. And an agent that executes a step in your close.

Ask which one you are looking at before the demo starts. The first two touch the ledger and the workpaper. The third touches the client's inbox. Only the fourth does work without a person pressing a key.

The categories fail differently, so they need different gates. A bad category suggestion is caught in review. A bad email is caught by the sender. A bad agent action posts.

Firms buy across all four without noticing. That is how a practice ends up with three overlapping subscriptions and no measured saving.

Does the tool tell you when it is guessing?

Some do, and it is the single most useful feature in the category. QuickBooks grades its own suggestions. The lowest grade tells the user plainly that QuickBooks has limited data behind the suggestion.

Put this on your evaluation sheet. A tool that returns one answer with no confidence signal gives the reviewer nothing to triage by. Every line then gets the same attention, which is the same as no automation.

Confidence should sit at field level, not document level. A K-1 can be read correctly in eleven places and wrong in one.

Ask to see the low confidence queue during the demo, not the happy path. A vendor that cannot show you its own failure queue has not built one.

How much of a 1040 document set can software finish on its own?

Sixty five percent of standard documents, by the incumbent's own published figure. Thomson Reuters states that 1040SCAN eliminates the need to verify OCR data for 65% of standard documents by combining patented text-layer matching and AI.

Read the other half of that sentence. Roughly a third of standard documents still go to a person. Non standard documents are not in the denominator at all.

That remainder has a shape. SurePrep's review step color codes fields. It marks a field where OCR is uncertain about that field and requires verification.

Use 65% as your baseline when a newer vendor quotes you a number. Ask what their denominator is. Ask whether it includes the documents that arrive sideways in March.

The questions to put to a vendor in writing

There is a published list, and it came from the profession rather than a marketing page.

Clients want to know how their information is stored; whether their data is used to further train the generative AI model; who has access; whether their data is shared outside of your organization; how data is retained, by both the firm and any external provider(s); and whether the generative AI has de-identification procedures for stored information.

Send those six to the vendor before the second call. Add the three from the section above, plus one more. What does the published document scope exclude?

Some vendors already answer the training question on the record. Karbon states that it does not use your firm's data to train AI models, and no data is shared with third parties or used to inform any other Karbon customer's experience.

Ask for firm level controls too. Karbon notes that account administrators can disable AI functionality through firm settings. That is the switch a partner needs when a client objects.

Does automation cut review time, or just move it?

It moves it, and the evidence comes from standard setters rather than vendors. One note on scope first. The PCAOB material below governs audits of issuers. A firm doing private company work sits under AICPA standards instead. The pattern still transfers.

It is about what happens after a tool flags something. The PCAOB observed that because technology-assisted analysis may enable the auditor to examine all items in a population, it is possible that the analysis may return dozens or even hundreds of items within the population that meet one or more criteria established by the auditor.

The IAASB reaches the same place from the other direction. In its worked example, the procedures performed using ATT do not provide sufficiently persuasive audit evidence for Group A, rather it further informs the auditor's risk assessment.

So budget reviewer hours, not just preparer savings. A firm that cuts prep by a third and adds an exception queue nobody owns has traded cheap time for expensive time.

The obligation does not shrink either. The IAASB puts it in one line. Regardless of the tools and techniques used, the auditor is required to comply with the ISAs.

How you will know the pilot failed

Reviewer hours went up and nobody noticed. That is the most common failure. It is invisible unless you baselined the reviewer, not just the preparer.

Watch for a growing queue of files the tool will not take. Vendors publish scope limits, including orientation requirements and excluded account types. Those exclusions arrive as a pile at the worst moment.

Watch for silent coding to a catch all account. A close that looks clean because unknown merchants were swept into one line is worse than an obvious exception list.

And watch the measurement itself. In a survey of 1,073 firms, 40% said they had not yet figured out how to track efficiencies due to technological advancements. Most pilots end in opinion rather than evidence.

Where firms like yours have actually put AI so far

At the edges of the work, not the middle. A 2026 survey of 486 bookkeeping and accounting professionals published a task table. The figures below sit on an AI-active base rather than the full sample.

Those two bases are not the same, which matters on a page about denominators. The reported rows run like this:

- Drafting client emails and communication, 75% - Summarizing documents or meetings, 71% - Research and answering technical questions, 69% - Transaction categorization or coding, 42% - Financial reporting and commentary, 40% - Bank reconciliation, 24% - Tax return preparation, 9%

Read the bottom of that list before the top. Bank reconciliation at 24% and return preparation at 9% tell you where the technology has not earned trust yet.

Trust is the limit, not availability. In the same survey, only 19% trust AI enough to use it with limited review.

Almost nobody wants the tool acting alone. In a separate Intuit commissioned survey of 725 US accounting professionals, only 6% want AI to execute autonomously. That survey is vendor funded, and its sampling method is published on the page.

The shape firms do want is draft plus review. Asked what role AI should play in client work, 40% want AI as a support tool and 34% want AI to draft, with a human reviewing and signing off.

What to leave in the client file

Three things, and none of them are hard. The same Aon column recommends that employees document the prompts used, how the outputs were verified, and who performed the review.

Store the named human approver, never a service account. If the log shows software approving software, the firm has automated away its own evidence.

Insurers are already asking to see the policy behind it.

Aon's risk control lead says carriers are going to ask a firm about their AI policy and procedures. They want to see firms are approaching the use of AI with the same basic risk management protocols that they would have in place for engagement letters or client acceptance and continuation or documentation.

Claims data does not exist yet, and that is worth saying plainly. The same source notes there really hasn't been a lot of claims or large dollar amounts paid on claims. Nobody can price this risk from experience.

What do we actually have to change in our WISP before we switch an agent on?

Nothing in the Safeguards Rule names AI, so what forces the update is the material change language, not an AI rule. 16 CFR 314.3(a) is what makes the program written in the first place, and 314.4(g) requires you to evaluate and adjust it in light of "any material changes to your operations or business arrangements". An agent deployment also lands on 314.4(c)(2), identify and manage the data, personnel, devices, systems and facilities that enable your business purposes, on 314.4(c)(7), adopt procedures for change management, and on 314.4(d)(2)(ii), which pulls a vulnerability assessment forward whenever there are material changes to your operations.

The concrete gap sits in the template most firms started from. Publication 5708 is a Security Summit sample, not a rule, and it says so: it is "not intended to replace your own research, to create reliance or serve as a substitute for developing your own plan". The Rev. 8-2024 edition does not mention artificial intelligence anywhere. Its sample disclosure paragraph lists state and federal tax authorities, the tax software vendor, a bookkeeping service, a payroll service, a CPA firm, an Enrolled Agent, legal counsel and business advisors. No model provider appears on that list. Sample Attachment E is a hardware inventory, its guidance covering computers, phones, storage devices, cloud storage and paper records, with no row for an inference endpoint. A firm that adopted the sample verbatim has a plan that does not describe the disclosure it is about to start making.

Is a model API a service provider under the Safeguards Rule if it retains nothing?

On the text of the rule, yes. 16 CFR 314.2(r) defines a service provider as any person or entity that "receives, maintains, processes, or otherwise is permitted access to customer information" through its provision of services directly to a financial institution subject to the part. Processes is listed separately from maintains, so an inference endpoint that receives a prompt containing customer information is inside the definition on its face, with or without retention.

Section 314.4(f) then sets three duties: take reasonable steps to select and retain providers capable of maintaining appropriate safeguards, require those safeguards by contract, and periodically assess the provider "based on the risk they present and the continued adequacy of their safeguards." The third one recurs, so an agreement signed at onboarding does not discharge it. The Commission made the same point in the preamble to the 2021 amendments, discussing a provider that stores and processes customer information: the firm must require that provider to encrypt it and "periodically determine whether it continues to do so."

Neither the rule text nor the 2021 rulemaking record mentions AI or model providers, so which parties in a given stack qualify is a facts question you have to work through with counsel, not one with a published answer. Running the agent in your own cloud changes who the vendors are, not whether the duty exists.

Does an agent running on a service account need multi factor authentication?

Probably not under the MFA provision itself, because that provision is written around people. 16 CFR 314.4(c)(5) requires multi factor authentication "for any individual accessing any information system, unless your Qualified Individual has approved in writing the use of reasonably equivalent or more secure access controls." Section 314.2(a) defines an authorized user as "any employee, contractor, agent, customer, or other person that is authorized to access any of your information systems or data", all of them persons.

The provisions you would actually govern a service account under are 314.4(c)(1), access controls that authenticate and permit access only to authorized users and limit each to what they need, and 314.4(c)(8), monitor and log activity and detect unauthorized access, use or tampering. Both of those are also written around authorized users, so on a strict reading the rule does not squarely address a non human identity anywhere. Treat that as a gap in the text, not as a permission.

The IRS restates the requirement more broadly than the rule does. Publication 1345, Rev. 12-2025, tells Providers to "implement multi-factor authentication for anyone accessing taxpayer information" and attributes that to the Safeguards Rule. Anyone is not the word the rule uses. If you are an Authorized IRS e-file Provider, expect the broader wording to be the one you get asked about.

Neither the rule text nor the 2021 rulemaking record mentions service accounts or non human identities, so the allocation above is a reading, not a settled answer. What the text does settle is the deliverable: a written Qualified Individual determination. Note the conflict if that individual works for the vendor that built the system. Section 314.4(a) permits a service provider in the role, but then you must retain responsibility for compliance and designate a senior member of your own personnel to direct and oversee them.

Is every agent mistake a reportable breach?

No, and the rule gives you two different terms so you can tell which is which. A security event under 16 CFR 314.2(q) is any event resulting in "unauthorized access to, or disruption or misuse of, an information system, information stored on such information system, or customer information held in physical form." That is broad enough to reach an agent acting outside its intended scope even when nothing leaves the firm. A notification event under 314.2(m) is narrower: acquisition of unencrypted customer information without the authorization of the individual to which the information pertains. Only the second one triggers the FTC filing.

Two qualifiers matter. The written incident response plan at 314.4(h) covers security events "materially affecting the confidentiality, integrity, or availability of customer information in your control", so materiality is the limiter rather than whether data left the building. And 314.2(m) presumes unauthorized access is unauthorized acquisition "unless you have reliable evidence showing that there has not been, or could not reasonably have been, unauthorized acquisition of such information." Without logs good enough to rebut it, you own that presumption.

The IRS standard is worded more broadly. Publication 1345 says that for its reporting standard, "an event that can result in an unauthorized disclosure, misuse, modification, or destruction of taxpayer information (e.g., breach) must be considered a reportable security incident." Can result, not did. No volume threshold, and no encryption carve out like the FTC's.

Neither the rule text nor the 2021 and 2023 rulemaking records mention AI, so whether an out of scope agent action counts as misuse of an information system has no published answer. Decide where your own line sits, in the incident response plan and in writing, rather than during an incident.

Does AI training count for CPE, and does any state require it?

It counts, and no jurisdiction we could find requires it. NASBA's Fields of Study document, January 2024 lists Artificial Intelligence as a subject inside Information Technology, which is a technical field of study.

Two classification rules matter more than that headline. Courses in "the general use of software," the how-to kind run around a product, sit in Computer Software and Applications, which is non-technical, and the document names bookkeeping software such as QuickBooks as an example. And when a course "focuses on the application of information technology in an accounting, auditing or tax practice," it "should be categorized into the field of study of the respective practice: auditing, accounting, or taxes," so agent training built around return preparation counts as Taxes rather than as IT.

That matters because UAA Model Rule 6-4(b) asks for at least fifty percent of credits in technical fields, which its own chart puts at 60 of 120 on a triennial cycle, alongside 6 ethics credits. Nothing in the model rules requires a technology credit. The 2026 Statement on Standards for CPE Programs, effective August 1, 2026 and phased in through November 2028, does not mention artificial intelligence at all.

A client asks for everything the agent produced on their file. What do we owe them?

Less than most partners assume, and the line lands in an unexpected place. Under the Records Requests interpretation at ET 1.400.200 in the AICPA Code, you must make client-provided records and your work products available, plus member-prepared records without which the client's financial information would be incomplete, and absent extenuating circumstances "no later than 45 days after the request is made."

Working papers are treated differently: "Working papers are the member's property, and the member is not required to make such information available," subject to state and federal statutes and regulations and to your own contracts. The same interpretation says a member "is not required to make formulas available" unless the member was engaged to deliver them as part of a completed work product, or the formulas produced member-prepared records the client's information would be incomplete without.

Our reading, and it is a reading rather than a rule, is that prompts, configuration, agent logs and intermediate output look more like working papers and formulas than like a deliverable, so they are usually yours to keep. Two things narrow that. Paragraph .05 of the same interpretation says a state board may refuse to let you withhold records the Code would let you withhold, and the board rule wins. And Circular 230 section 10.28 runs a separate track, requiring prompt return of records the client needs to meet federal tax obligations, a term that by its own text reaches documents your firm prepared and presented to the client if the client needs them for current compliance.

Settle which of these the client gets before the first engagement letter goes out, not during the first argument about it.

Who at the firm has to own the agent's procedures?

One named person, under a rule that took effect in 2014. Circular 230 section 10.36 puts the duty on any individual who has, or individuals who have or share, "principal authority and responsibility for overseeing a firm's practice governed by this part," who "must take reasonable steps to ensure that the firm has adequate procedures in effect for all members, associates, and employees" for complying with subparts A, B and C of Circular 230. If the firm identifies nobody, the IRS "may identify one or more individuals" for the role, which is a worse way to learn who it was.

Two limits are worth knowing before over-reading that. Discipline under 10.36(b) requires willfulness, recklessness or gross incompetence by that person, plus firm people who "are, or have, engaged in a pattern or practice" of failing to comply. One bad output is not an Office of Professional Responsibility case.

And the text reaches members, associates and employees. It does not name contractors or vendors, so it does not by itself make an outside vendor's staff answerable for your procedures. If you want the vendor held to a procedure, the contract has to do that work.