Using AI in an Australian accounting firm

The short version

AI is now good enough to do real first-draft work in an accounting firm. It is not good enough to sign off on anything. The rules that govern how you use it are not new rules. They are the confidentiality, competence and privacy obligations you already have, applied to a new kind of tool.

Three regulators and standard setters have now said this plainly. The Tax Practitioners Board issued TPB(GS) 55/2026 on 22 July 2026. The OAIC published guidance on commercially available AI products in October 2024. The Australian Government published its Guidance for AI Adoption on 21 October 2025, replacing the Voluntary AI Safety Standard. And at the CPA Tax Forum on 20 August 2026, the ATO's Second Commissioner said "Agents and advisers will use AI" and that "only a professional can determine whether it is correct, relevant and appropriate."

This guide sets out what those sources actually say, where AI earns its place in a practice, where it still gets things wrong, and the questions to put to any vendor before client data goes near it.

What the rules say

Tax Practitioners Board: TPB(GS) 55/2026

The TPB's guidance statement, The use of Artificial Intelligence and the Code of Professional Conduct, was released on 22 July 2026 after an exposure draft in March. It does not create new obligations. It explains how the existing Code of Professional Conduct in section 30-10 of the Tax Agent Services Act 2009, and the Tax Agent Services (Code of Professional Conduct) Determination 2024, apply when AI is involved.

The central point is one sentence: tax practitioners "are still ultimately responsible for the tax agent services they provide to their clients." Using a tool does not move that responsibility anywhere.

The TPB also says practitioners should check AI-generated content "throughout each step of the workflow," be able to understand and challenge the output, and document each step. It notes that large language models can "hallucinate or provide inaccurate information."

On disclosure, the TPB expects that before client information is shared with an AI tool, the client is told who or what it will be disclosed to, where the data will be stored, and whether AI tools will be used. Permission can come through a signed engagement letter, a signed consent, a fact find with consent, or in some cases a general authority to disclose to third parties.

The statement also flags tax file numbers. The Privacy (Tax File Number) Rule 2015 may impose extra obligations, and the TPB suggests practitioners get their own advice on how it applies to AI use.

APES 110: confidentiality for members

For members of CPA Australia, CA ANZ and IPA, APES 110 applies as well. Paragraph R114.2 says a member shall not disclose confidential information acquired in the course of professional and business relationships. AUST R114.3 allows disclosure only where there is a legal or professional duty or right to do so, or where the client or a person with authority has authorised it and the law does not prohibit it. R114.1(d) requires reasonable steps so that personnel under the member's control, and "individuals from whom advice and assistance are obtained," comply with the member's duty of confidentiality.

Read together, the practical test is simple. If a tool sends client information outside the firm to a provider who can see, keep or reuse it, treat that as a disclosure and get the client's authority first. If the tool keeps data inside a controlled environment under contract, you are in a stronger position, but you still need to know that for a fact rather than assume it.

Privacy Act and the OAIC

The OAIC's Guidance on privacy and the use of commercially available AI products (published 21 October 2024, updated 17 January 2025) applies the Australian Privacy Principles to AI tools. Whether and how the APPs apply to your firm is worth confirming, and the TPB notes that some APPs, including APP 11 on security, may affect the consent question. The points that matter most for a practice:

• Public chatbots. The OAIC's best-practice position is: "do not enter personal information, and particularly sensitive information, into publicly available AI chatbots."
• Inputs and outputs both count. "Privacy obligations will apply to any personal information input into an AI system," and to output containing personal information.
• Due diligence is ongoing (APP 6, APP 11). Check the product suits the use, how it was trained, how it is secured and who can access data. "Due diligence for AI products should not amount to a 'set and forget' approach."
• Overseas disclosure (APP 8). Find out where a cloud system's servers are and whether personal information could leave Australia.
• Accuracy (APP 10). Take reasonable steps so personal information is accurate. The OAIC suggests human oversight and treating AI output as probabilistic, not fact.
• Transparency (APP 1, APP 5). Update the privacy policy and collection notices to describe AI use, and label any client-facing chatbot as AI.

Guidance for AI Adoption

The Department of Industry, Science and Resources published the Voluntary AI Safety Standard on 5 September 2024, with ten guardrails. On 21 October 2025 it was replaced by the Guidance for AI Adoption, which sets out six essential practices. They are voluntary, but they make a sensible firm policy skeleton:

1. Decide who is accountable. Name a partner who owns AI use, and write a short policy.
2. Understand impacts and plan accordingly. Think about which clients could be affected by an error.
3. Measure and manage risks. Screen each use by risk, and control the high-risk ones harder.
4. Share essential information. Keep a register of the AI tools you use, and tell people when AI is involved.
5. Test and monitor. Ask suppliers for evidence of testing, test yourself before rollout, and keep watching.
6. Maintain human control. The more the tool does on its own, the more oversight it needs.

Where AI helps in a practice

The best uses share a pattern. The work is repetitive, a qualified person can check the result faster than they could produce it, and a mistake is caught before it reaches the ATO or the client.

The TPB's own list of AI capabilities is similar: classifying and analysing information, detecting anomalies in client accounts, translating and summarising sources, and compiling forms from third-party information.

A worked example: research with checking

A manager asks an AI tool whether a client's employee who was made redundant after four years is entitled to redundancy pay. The tool gives an answer and names the provisions it relied on. That is a useful start. The manager then opens those provisions in the Fair Work Act, confirms the facts the answer depends on, and checks any award or agreement that applies. The AI saved twenty minutes of finding. The professional supplied the judgement. That is the division of labour the TPB describes.

Where AI still fails

Nagaris tested 22 AI model setups on 112 Australian accounting questions for the Nagaris AI Accounting Index, with answer keys worked out from legislation, ATO guidance and state revenue office material. Two findings matter for any firm using AI.

State taxes

Duty and land tax differ in every state and change often. On the hard question set, the stronger models scored in the high 90s on state revenue. The smaller, cheaper models scored between 32 and 44. A tool that sounds equally confident about NSW transfer duty and Tasmanian duty on farm equipment is not equally reliable on both.

Counting business days

One question beat every model that answered it. A Victorian employer pays wages on Thursday 30 July 2026. Under Payday Super, the contribution has to reach the fund within seven business days. NT Picnic Day, Monday 3 August, is a public holiday for a whole territory, so under the ATO's rules it is not a business day. The deadline is Tuesday 11 August, matching the ATO's own worked example for that payday. None of the 14 setups that answered got it right. Most said 10 August. Four counted calendar days and said 6 August.

The lesson is not that AI is useless for super. It is that date arithmetic, thresholds and rates should come from a checked table, not from a model's memory. See the Payday Super guide and the due date calculator for that kind of question.

Other failure patterns to watch

• Stale law. Models are trained on a snapshot. Rates, thresholds and new measures after that snapshot may be missing or wrong.
• Confident citations. A plausible ruling number or section reference is not proof it exists or says what the model claims.
• Missing facts. A model answers the question asked. It rarely asks whether the client is a resident, whether the trust has made a family trust election, or which state the property is in.
• Specialist edges. The Index also tested whether a model knows when to stop and refer. Questions belonging to a lawyer, a financial adviser or an actuary need to be recognised as such.

Choosing a model

Firms asking "which AI should we use" are usually comparing three things: how often it is right, what it costs per answer, and how long it takes. The Index measured all three and the results cut against some assumptions.

The Index has limits it states openly: each question was answered once, so a gap of a point or two is a tie, and model releases move quickly. Treat any benchmark, including this one, as a reason to test rather than a reason to stop testing.

A practical approach for a firm: write down twenty questions your seniors would want to check twice, with answers worked from the primary source. Put them to any tool you are considering. The results will tell you more than a vendor demo.

Ask Nagaris takes a different route. Rather than a model picker, it routes each question to the setup that does best on accuracy, cost and speed together, using the Index results, with fallback models from other AI labs checking the work when needed. When a better model is released and beats the current one on the Index, it takes over. It also uses checked knowledge bases and lookup tables for rates, thresholds and business days.

Questions to ask any AI vendor

These come straight from the obligations above. A vendor who cannot answer them in writing is a vendor you can't yet use with client data.

For comparison, Nagaris stores client data in Australia on AWS Sydney servers, is ISO 27001 certified, and timestamps every action for an audit trail. Ask any provider for the same specifics.

Human review that holds up

The TPB wants checking "throughout each step of the workflow" and documentation of each step. In practice, that means review is designed in, not left to whoever happens to read the output.

• Match review to risk. A draft email to a client about a document request needs a read. Advice on CGT on a property sale needs the same review it would get if a graduate had written it, with the sources opened.
• Review what the AI did, not just what it said. If a tool updated a workpaper, coded transactions or drafted a lodgement, the reviewer needs to see the changes, not only a summary.
• Keep the record. Note that AI was used, what was checked and by whom. This supports Determination s 30 records and s 40 quality management.
• Train the team. Staff who use AI need to know its limits. Code item 8 is about keeping knowledge current, and that now includes knowing what a tool can't do.
• Keep sign-off human. AI that acts should act with a person's approval. Ask Nagaris, for example, acts with your sign-off.

Client consent and disclosure

The TPB lists the things a client should be told before their information goes into an AI tool: who or what it goes to, where it is stored, and whether AI will be used. The simplest place to cover this is the engagement letter, which is also one of the TPB's listed ways of getting permission.

A short clause might cover:

This is a starting point. Adapt it to the tools you actually use, keep it accurate as those tools change, and have it reviewed by the firm. Update your privacy policy and collection notice to match, as the OAIC recommends. See the engagement letters guide and engagement letter template.

Two edge cases come up often. Existing clients on a recurring engagement may not have agreed to AI use when they signed; reissue or amend the letter, or get a separate consent. Recorded meetings need the client's agreement to the recording itself, separate from consent to AI processing.

A sensible starting policy

For a small or mid-sized firm, a one-page policy can cover the essentials:

1. A named partner owns AI use and keeps a register of approved tools.
2. Only approved tools are used with client information. Public chatbots are not used with personal or client information.
3. Each approved tool has written answers to the vendor questions above.
4. Engagement letters and the privacy policy disclose AI use, and client consent is on file.
5. All AI output used in client work is reviewed by a qualified person, with the level of review set by the risk.
6. Rates, thresholds, dates and citations are checked against the primary source every time.
7. Staff are trained on what the tools can and can't do, and the policy is reviewed at least yearly.

None of this is complicated. It is the same discipline a firm already applies to a new graduate: useful from week one, supervised, and trusted more as the record of good work grows.