AI in the accounting firm: the rules, client data, and the mistakes to avoid

Asked “Do you use artificial intelligence?”, many professional firms answer with a chatbot open in a browser tab in mind. The answer is sincere and incomplete. AI has also entered the firms of accountants (commercialisti) and labor consultants (consulenti del lavoro) by routes nobody chose: a practice management software update, a feature in the email service, the automatic transcription of a meeting. In the meantime the rules have arrived, European, national and ethical, and some already have a penalty written next to them.

Let’s try to line up what a firm owner, and the people who work with them, should have clear in order to use the tool without the risks that a little organization is enough to remove. Many of these observations apply to a business as well.

The AI That Is Already There, Even Where You Can’t See It

The law does not define artificial intelligence as “a chat.” Article 3 of European Regulation 2024/1689, the AI Act, speaks of a machine-based system that operates with varying levels of autonomy and that infers from its input how to generate predictions, content, recommendations or decisions. Italy’s Law 132/2025 does not offer a definition of its own and refers to the European one. The practical point lies in the verb “infers”: a traditional program applies rules that someone wrote, while an AI system estimates a plausible answer. That is why it can get things wrong without anyone having written an error.

With this definition the list gets a good deal longer. The practice management software that proposes an accounting entry by reading the electronic invoice, the payroll program that flags an anomaly in a pay stub by comparing it with past records, the email service that summarizes messages and suggests replies, the platform that classifies incoming documents: none of them presents itself as “artificial intelligence,” and all of them are.

There are three ways in, and each calls for a different remedy.

• Generative assistants used by individuals, often with a personal account and terms accepted with a click. Here the risk is data leaving the firm ungoverned, and the remedy is internal rules and the choice of accounts.
• AI features inside practice management software, which arrive with an update and are often switched on by default. The risk is contractual: the data processor appointment signed years ago with the vendor says nothing about which model is used, where it runs, or who the subcontractors are.
• General-purpose cloud services, meaning email, documents, videoconferencing. An assistant enabled on the mailbox has, in practice, access to all of the firm’s correspondence, clients included.

In all three cases client data reaches a system the firm does not control. There is also a technical detail with legal consequences: many products “with AI” have no model of their own and call the model of a large provider, often outside the European Union. To know where the data goes, then, you need to know whose engine it is, as well as who sells the product.

The AI Act uses the term deployer for anyone who uses an AI system under their own authority in a professional setting. That is the firm’s role, with lighter obligations than those of whoever develops the system. “We only used it” is not a defense, though: it describes a role to which the law assigns responsibilities of its own.

Four Sets of Rules That Apply Together

Anyone using AI in an Italian firm operates within four sets of rules, and none of them replaces the others.

The first is the GDPR, which never mentions artificial intelligence but covers almost everything AI does in a firm, because almost all of it is processing of personal data. The second is the AI Act, in force since August 1, 2024 and applicable in stages. The stages were revised in 2026 by Regulation 2026/1744, the so-called Digital Omnibus, published on July 24 and in force from July 27: the obligations for the high-risk systems of Annex III, which include tools for selecting and evaluating workers, were pushed back to December 2, 2027. Since February 2, 2025 the prohibitions have applied, along with Article 4 on staff AI literacy, which the same Digital Omnibus rewrote as a best-efforts obligation: the firm must adopt measures that support the competence of those who use these tools and be able to demonstrate it, without having to guarantee a specific level.

The third set is Law 132/2025, in force since October 10, 2025. For firms what matters most is Article 13, which we will come to shortly. The law also delegates powers to the Government: a draft implementing legislative decree received preliminary approval on June 10, 2026 and, at the end of September 2026, had not yet been finalized.

The fourth is the rules of the profession. The National Council of Accountants amended its Code of Ethics, at Articles 21 and 45, with effect from November 21, 2025. The National Council of Labor Consultants has issued guidelines that invoke the same principles and has announced an amendment to its own code, which at the end of September 2026 had not been adopted.

A formula helps hold the picture together. The GDPR says what may be done with the data. The AI Act says what those who build the system and those who use it must do. Law 132 says how far AI may go in the professional service and what the client must be told. Professional ethics says what happens to the professional who fails to do so.

Support Yes, Judgment No

Article 13 of Law 132 takes up a few lines. The first paragraph provides that the use of AI systems in the intellectual professions “is intended solely for the performance of activities that are instrumental and supportive to the professional activity, with the intellectual work that is the subject of the professional service prevailing.” The second requires that information on the systems used be communicated to the client “in clear, simple and exhaustive language.”

The first paragraph sets two limits. The first concerns the type of activity. Document research, summaries of long texts, draft letters, classification and extraction of data, transcriptions, and formal consistency checks prepare the service and are permitted. Interpreting a rule in light of the client’s case, choosing among tax or contractual options, assessing the risk of a transaction, and giving an opinion are the service itself. The accountants’ Code of Ethics has made the line explicit: AI may not carry out activities that evaluate or interpret the facts and rules that are the subject of the engagement.

The second limit is prevalence, which is measured by contribution and not by time. An opinion generated in its entirety and signed after a quick read breaks the rule even if every single step was “supportive.” The rule is respected by an opinion in which the machine found the sources and the professional selected, verified, argued and decided. The practical effect is that it falls to the professional to show that the intellectual work took place: in a dispute, saying “I checked” is not enough, you have to show how.

The penalties, for accountants, are already written. Replacing intellectual activity with AI, lack of knowledge of the technology, failure to verify reliability, and use that does not comply with the rules on security and personal data can cost a suspension of up to six months. Missing or insufficient information to the client, up to three. The duty to know the tool extends to staff as well, and this turns training from good practice into an obligation. For labor consultants there are not yet any specifically codified penalties, but Article 13 applies all the same, and the general duties of diligence, competence and confidentiality already cover improper use.

Then there is the client. Toward the client the professional is liable under the heightened standard of care of Article 1176(2) of the Italian Civil Code, and AI is not grounds for exemption. The assistant’s provider is not a party to the contract with the client, and its terms of use as a rule exclude any warranty of accuracy. A wrong deadline suggested by an assistant and passed on to the client is the firm’s mistake. The use of AI can in fact weigh in both directions: it aggravates fault if the error stems from an unverified output, because the limits of these tools are well known; it mitigates it if the firm can show verification procedures, compliant tools and trained staff. Finally, it is worth rereading the professional liability policy, which is mandatory for members of the professional orders: some insurers are introducing exclusions for damage linked to automated systems, and a written answer from the insurer settles the question before a claim arises.

Data That Leaves Does Not Come Back

Of all the risks, the one concerning client data comes first because it is the only irreversible one. A mistake can be corrected, a contract renegotiated, a fine paid. Data that has left does not come back.

The typical gesture takes ten seconds: a staff member copies a client’s document, pastes it into an assistant and asks for a summary. If that document is a pay stub, it contains sick leave, leave taken to care for family members with disabilities, union dues withheld: data that Article 9 of the GDPR gives heightened protection. And there is professional secrecy, older than the GDPR and safeguarded by Article 622 of the Italian Criminal Code: handing confidential information to a third party’s system that keeps a copy and may use it for its own models, without contractual safeguards, amounts to disclosing it.

The Decisive Variable Is the Account

The same assistant, with the same question and the same data, can be a compliant tool or a violation. It depends on the account. With a consumer account, free or paid, the contract is with the individual, and the provider as a rule reserves the right to use conversations to improve its models unless the user turns the option off. With a business account the contract is with the firm, there is a data processing agreement that designates the provider as a processor under Article 28 of the GDPR, and training is as a rule excluded by contract. On top of that, the firm manages access and closes the user account when someone leaves. Terms change over time and from one provider to another: they should be read when the tool is chosen and reread periodically.

Staff use of unapproved tools is the norm in firms, not the exception, and an outright ban pushes it into the shadows. What works better is offering everyone a compliant business alternative and banning the others. Even with the right tool, a discipline of the gesture remains: replace names with roles, remove identifiers that are not needed, paste the clause and not the whole contract. Hasty pseudonymization is reversible, however: a text with no names that describes the role, city, year of hiring and reason for dismissal identifies the person to anyone who knows the context.

If something ends up where it should not have anyway, time matters. A personal data breach must be notified to the Garante (the Italian data protection authority) within 72 hours of the controller becoming aware of it, unless a risk is unlikely. The staff member who stays silent out of fear sets that clock running without the firm knowing: immediate reporting has to be a stated rule.

“The Data Is in Europe” Does Not Settle the Matter

It is the reassurance every provider offers, almost always true and almost always insufficient. Three things need to be kept apart: where the servers physically are, who can access the data and from which country, and which legal system governs whoever controls it. According to Guidelines 05/2021 of the European Data Protection Board, remote access to data stored in the Union is a transfer to the country from which the access takes place. And the US CLOUD Act of 2018 allows that country’s authorities to order a provider subject to their jurisdiction to hand over data, wherever the data is located.

Transfers to the United States rest today on the adequacy decision of July 10, 2023, the Data Privacy Framework, which covers only the self-certified organizations on the public list. The basis is valid, but its two predecessors were struck down by the Court of Justice, in 2015 and in 2020. On September 3, 2025 the EU General Court dismissed the action against the new framework (case T-553/23), but on October 31, 2025 an appeal was lodged (case C-703/25 P), which at the end of September 2026 was still pending. If the decision were to fall, there would be no transition period. You prepare by checking that the agreement with the provider also includes the standard contractual clauses as an alternative basis, by choosing the European region where it is offered, and by evaluating a European provider in good time for the most sensitive uses.

For providers subject to legal systems without an adequacy decision, the rule is blunter. On January 30, 2025 the Garante imposed an urgent restriction on the processing of Italian users’ data by DeepSeek, after the companies had answered its request for information by stating that they were not subject to European law. The quality of a tool is not a compliance criterion, and a provider that does not answer basic questions about data cannot be used. If we don’t know where a piece of data is going, that data does not leave.

Plausible Does Not Mean True

A language model does not consult a database when it answers. It generates the most probable sequence of words. It has learned the form of a citation, with number, date and reference details, and it reproduces that form even when the document does not exist or says something else. The invented text has the same tone as the correct one, and the system does not signal uncertainty.

In tax and labor matters there are five recurring forms: the rule that does not exist, the real rule with the wrong content, the invented administrative guidance, the invented court ruling, the superseded rule. The last is the most dangerous for a firm, because the subject matter changes several times a year and the model presents as current what it learned as of a certain date. In 2023 a federal court in New York sanctioned two lawyers over a brief containing six precedents invented by a generative assistant; in 2025 an Italian court had to take note of nonexistent citations in a defense filing. “The AI wrote it” carried no weight at all.

With numbers the problem is more insidious, because a result that adds up does not invite checking. The model treats figures as symbols and predicts plausible ones. With brackets, exemption thresholds and multi-step rounding, error becomes likely and stays silent. Worse still is when the arithmetic is perfect but built on the previous year’s rate: whoever rechecks the sum does not recheck the rate.

Two firm rules follow, each of which can be written in one line.

1. No citation produced by an AI system goes into a document without having been opened and read in the official source. Verifying means reading whether the source says what is attributed to it, not just checking that it exists.
2. No number intended for the client or for a filing is produced by a generative assistant. Numbers come from the practice management software, the spreadsheet, the official calculators. The assistant can explain a calculation or help set it up.

The verification, moreover, has to be documented, because the question that will be asked in a dispute is “show that you verified.” For routine documents, a note with the date and initials of whoever checked is enough. For opinions, reports and calculations with financial effects, it is worth keeping the successive versions and, where the professional departed from the machine’s proposal, two lines explaining why. Sources and numbers are checks that can be delegated to a trained staff member; the reasoning and the suitability for the client stay with whoever signs.

Finally, there is AI used against the firm. Fraudulent messages can no longer be spotted by their clumsy Italian, and a few seconds of recording are enough to clone a voice. Law 132 introduced a specific criminal offense, punishable by one to five years’ imprisonment, but that is a protection that comes afterward. What is needed beforehand is a habit: every request for a payment, a change of IBAN or the sending of sensitive data is verified with a phone call to a number already known, never the one given in the message.

What to Tell the Client, What to Ask the Vendor

The notice to the client is to be given when the engagement is conferred and renewed when the tools change significantly. It must say that the firm uses AI systems, for which activities, which systems at least by category, with what safeguards, and what requests the client can make. One page written the way you would talk in a meeting is the right size. The law does not require written form, but it is the only one that can be proven, and the accountants’ Code recommends it. Since October 9, 2025 there has been a model clause from the National Council of Accountants to be inserted in the engagement letter. It is not mandatory, and it gives the client the option of asking that AI not be used in their engagement. Better to know in advance which uses can be excluded and to say so: the features built into practice management software often cannot be switched off for a single client.

Three misunderstandings circulate around this obligation.

• A line about AI added to the privacy notice is not enough. These are two documents with different functions: one concerns how the firm processes data, the other how it performs the service.
• “Consent to the use of AI” is as a rule unnecessary and counterproductive. The processing involved in the engagement is based on performance of the contract and on legal obligations; consent can be withdrawn at any time and would tie the firm to an unstable basis.
• The waiver by which the client “accepts the risks” protects no one. It is void insofar as it excludes liability for willful misconduct or gross negligence, under Article 1229 of the Italian Civil Code, and it signals to the client that the firm does not trust its own tools.

For accountants, the use of AI must also be mentioned in the documents produced. The usual practice is a short note that declares the support and, with it, the professional verification. Proof of having informed the client should be kept with the file for at least ten years from the end of the engagement, which is the ordinary limitation period.

On the vendor side you start with an inventory, because AI entered the software after the contracts were signed. Asking “Are you compliant?” produces no information. What is needed are precise questions, in writing, with a request for a written answer: which features use AI and whether they can be switched off, whose model it is, in which countries the data, backups and logs are held, whether the firm’s data is used to train or improve models, how long requests and outputs are retained, who the sub-processors are. An evasive answer on training or location has to be resolved before continuing to use the feature.

In the contract the most important clause, and the one most often missing, concerns unilateral changes: any change of engine, sub-processors, location, use of data or default settings should be communicated with advance notice, with the right to object and to terminate without penalty, and new AI features should start out switched off.

When AI Concerns Clients’ Employees

This part concerns labor consultants and, directly, business owners: companies adopt tools that select, evaluate and monitor personnel, often without knowing that they trigger specific obligations.

Article 11 of Law 132 requires the employer to inform workers of the use of AI in the cases and in the manner set out in Article 1-bis of Legislative Decree 152/1997. It is not a new obligation: it has existed since 2022 and many companies have never complied with it. It covers decision-making or monitoring systems that are fully automated, such as those that assign shifts, score performance or filter job applications without human review. The notice must be given in writing before the activity begins, and to the union representatives as well. The administrative fine is monthly and grows with the number of workers involved: from 100 to 750 euros for up to five, from 400 to 1,500 above five, from 1,000 to 5,000 above ten.

Then there is the Workers’ Statute. A computer or a piece of business management software is a work tool. If a feature is added that measures time spent, evaluates productivity or analyzes the tone of communications, the tool acquires a capacity for remote monitoring that requires a union agreement or authorization from the Labor Inspectorate before it is switched on. And since February 2, 2025 the AI Act has prohibited emotion recognition systems in the workplace, except for medical or safety reasons: certain products for analyzing the company “climate” come close to that, and a prohibited system cannot be cured by an agreement.

On December 2, 2027 the high-risk rules will become applicable to systems used in recruitment, in decisions on promotions and terminations, in the allocation of tasks on an individual basis and in performance evaluation. A company that uses them will have to follow the provider’s instructions, entrust oversight to competent people, keep the logs for at least six months and inform workers and their representatives before the system is put into service. It is worth telling clients now to take stock of their tools and to ask vendors in writing for their compliance plan. Nothing that is on the way suspends what is already in force: anyone who is “waiting for the decree” to inform workers about the shift algorithm is already in breach.

A Month to Put Things in Order

All of this can be translated into four weeks of work within the reach of a firm of any size, in a sequence in which each step prepares the next.

You begin with the inventory: tools, vendors, people, types of data. You need a point person, and you need a small amnesty, that is, asking staff to declare the personal tools they use for work with no consequences for those who declare them. Without it, the inventory stays empty and false. For a firm of up to ten people this is two or three days’ work. The boxes left blank, such as “we don’t know where the data is,” become the questions to put to the vendors.

The second week is the week of decisions. One approved tool for each type of use, with a business account and two lines of justification. A table that says which class of data may go into which tool, using the real names. Internal rules of three or four pages in the language of the people who have to apply them: “never paste a pay stub into any assistant” is a rule; a reference to an article of the GDPR is not.

The third week looks outward: a clause in new engagement letters and a traceable communication to existing clients, an updated privacy notice, written questions to vendors, the record of processing activities, a reasoned decision on the data protection impact assessment. The latter, when it is required, has to be done before the processing begins and not after.

The fourth week is for the people. A training session of two to four hours built on the firm’s rules and not on the legislation in the abstract, closed by a test and by signing the rules. It is the only measure that acts on all the risks at once: someone who is trained knows what not to paste, knows that they have to verify, and recognizes a cloned voice.

That leaves the calendar: a review at least once a year, and one every time a new tool arrives or a vendor announces a change.

The cost of this setup is a fraction of the cost of an incident, but the best argument is a different one. A firm with business tools, clear rules, vendors that have been questioned, informed clients and trained staff uses artificial intelligence more often and with more confidence than one that uses it on the sly through its staff’s personal accounts.