Ask how your accounting provider uses AI with company records

Request a description of how the provider uses AI during your engagement. Document extraction, draft correspondence, transaction suggestions and technical research raise different questions. Ask which tools receive company information, what data is included and whether use is optional or built into the agreed service.

Avoid evaluating the arrangement from a broad statement that the firm is AI enabled. A provider may use several tools with different terms. Ask it to identify the workflow relevant to your records and the person responsible for approving tools and reviewing their output.

Ask whether inputs or outputs are retained, used to train models, shared with additional providers or accessible to human reviewers outside the engagement team. Obtain current terms or reliable written confirmation for the actual product and account configuration. Do not assume a consumer version and an enterprise arrangement have identical protections.

FTC vendor-security guidance recommends addressing how vendors use, share, retain and delete data. Apply those questions to AI use in the accounting service. Identify records that require additional approval or should be excluded, such as sensitive employee data or restricted transaction documents.

Define the process when a tool or its data terms change. The company should know which material changes require notice or approval under the agreement. A one-time consent should not silently become permission to upload every future record into any tool an individual staff member chooses.

Ask how the provider checks extracted fields, suggested entries and technical explanations before using them. Identify which outputs may enter a draft and which require an authorized professional's review. A confidence score from a tool is different from evidence that the accountant evaluated the relevant facts.

NIST's AI Risk Management Framework is voluntary guidance for managing AI risks. It provides useful context for asking about evaluation and responsibility, but using the framework is not a certification of a firm's accounting work. Require the provider to explain its actual review process and retain evidence appropriate to the task.

Choose an approved example containing an ambiguity that matters to the workflow, such as an unclear invoice field or missing context. Ask the provider to demonstrate how the uncertainty reaches a human and how the final decision is recorded. Use safe data and avoid unnecessary disclosure during the demonstration.

Discuss what happens when the tool is unavailable or its output is rejected. The engagement should identify the fallback and any effect on timing or price. An automation benefit is useful only if the company understands the work and review that remain when the automation cannot complete the task.

Document the approved uses, material restrictions, reviewer responsibility and incident route. Clarify ownership and permitted retention of outputs that form part of your accounting records. Have privacy or legal advisers assess the actual arrangement where needed, without treating a generic AI clause as sufficient for every dataset.

Include temporary staff in the tool policy so approved workflows remain consistent when the regular preparer is absent.

Review significant changes at an appropriate service checkpoint. Ask for evidence of how the process handled exceptions, not claims that AI makes errors impossible. The company should be able to identify the professional responsible for its delivered work even when software performs part of the preparation.