What are the most common AI readiness gaps at CPA firms?

The two most common gaps at accounting firms are Data & Security (Section 6) and Workflows (Section 3). Most accounting firms lack a written policy on what client data can enter public AI tools like ChatGPT, Claude, or Gemini — creating exposure under AICPA confidentiality guidance even when staff use AI with good intentions. The second gap is workflow documentation: most accounting firm processes run on institutional knowledge rather than documented procedures, which makes it impossible to apply AI consistently across the team. A firm can have curious, motivated staff and still see AI adoption stall because neither of these foundations is in place.

Is it safe for accounting firms to use ChatGPT or Claude with client data?

Not without a data policy. Public AI tools (ChatGPT, Claude, Gemini, Perplexity) in their default configurations send data to third-party servers for processing and may retain it for model training — which can create exposure under AICPA confidentiality rules and state CPA licensing requirements. The correct approach: establish a written policy distinguishing between (1) client financial data and tax records that should not enter public AI tools, (2) general knowledge work (research, drafting from anonymized inputs) where risk is lower, and (3) tools with enterprise data agreements (Microsoft Copilot with M365 Business Premium, Claude for Work) that offer stronger data handling guarantees. This policy doesn't require a lawyer to draft — it requires 90 minutes of honest thinking about what data is actually going where.

Which AI tools are best for small accounting firms?

The recommended starting sequence for a 5-50 person accounting firm: (1) Microsoft Copilot if you're already on M365 — it's the lowest data-exposure option for firms already in the Microsoft ecosystem; (2) Karbon AI if you use Karbon for workflow management — purpose-built for accounting firm tasks with stronger data handling than general AI tools; (3) Fathom for AI meeting summaries — no client financial data involved, immediate time savings, and a low-risk entry point that builds AI habit before more complex use cases. Add purpose-built AI tools only after you have documented at least one internal workflow and can confirm how client data is handled.

Does AICPA have guidance on AI use for CPA firms?

Yes. AICPA published an advisory in 2024 addressing AI tool use and client confidentiality obligations under the AICPA Code of Professional Conduct. The key takeaway for small CPA firms: the confidentiality rules that have always applied to sharing client information with third parties also apply to AI tools — sending client financial data to a third-party AI tool without client consent or a qualifying exception may violate AICPA ethics rules. Most small firms resolve this through an engagement letter addition and a clear internal data policy. The advisory does not prohibit AI use — it requires that firm owners think clearly about which data goes where.

AI Readiness Checklist for Accounting Firms

For owners and partners of CPA firms, tax practices, and accounting firms with 5–50 employees.

What this covers: Firm-type-specific AI readiness checkpoints · The two dimensions where accounting firms most commonly score low · One recommended first tool · Your specific next step.

You've heard about AI. Maybe a competitor just announced they're using it to cut turnaround on tax returns. Maybe a client asked how you're handling AI-generated financial analysis. Maybe you've tried ChatGPT once and weren't sure what to do with it.

The accounting profession is at an inflection point — and the readiness gap between firms that move intelligently and firms that either rush in or wait too long is widening fast.

This checklist tells you where your firm actually stands, with accounting-specific context the generic AI readiness frameworks don't cover.

Start with the full self-assessment: This page covers the checkpoints most relevant to accounting firms. For the complete 7-dimension, 35-checkpoint assessment, use the AI Readiness Checklist for Professional Services Firms.

Why Accounting Firms Score Differently

The seven AI readiness dimensions — Team Readiness, Tools & Technology, Workflows, Client Communication, Business Model, Data & Security, and Financial & ROI Readiness — apply to all professional services firms. But accounting firms have a specific pattern.

The two dimensions where accounting firms most commonly score low: Data & Security (Section 6) and Workflows (Section 3).

Accounting firms hold the most regulated client data of any professional services category: tax records, financial statements, payroll data, and in some cases health-adjacent financial information. Most lack a written policy on what can and cannot enter AI tools — creating exposure under AICPA confidentiality guidance even when staff use AI with good intentions.

The workflow documentation gap is equally common. Most accounting firm processes run on institutional knowledge rather than written procedures, which makes it impossible to apply AI consistently. If the workflow isn't documented, there's no reliable way to insert AI into it.

A firm can have curious, motivated staff and the best tools on the market — and still see AI adoption stall because neither of these foundations is in place.

Accounting Firm AI Readiness Checkpoints

Work through each checkpoint. Check off what you've done. Leave the rest unchecked — those are your next steps.

Data & Security (Section 6 — Highest Risk for Accounting Firms)

I know which client tax data and financial records are going into AI tools — and whether those tools' data retention policies meet the requirements of AICPA confidentiality guidance
I've reviewed AICPA's 2024 advisory on AI tool use and can confirm my firm's data policies align with CPA ethics rules on client confidentiality
I have a written policy distinguishing client financial data (high restriction) from general knowledge work and internal communications (lower restriction) for AI tool use
I've confirmed the data handling terms for any AI tool used with client data — specifically whether the vendor stores or trains on that data, and whether an enterprise agreement is in place
I've mapped which AI tools at my firm have stronger data protections (Microsoft Copilot with M365 Business Premium, Claude for Work) versus those used in default free-tier configurations

Score: ___/5

If you scored 2 or below: Before expanding AI use at your firm, write a one-page data policy. Answer three questions: (1) What categories of client data does your firm handle? (2) What AI tools are staff currently using, including informally? (3) What's your rule on which data goes where? That document is both a compliance foundation and a staff communication tool.

Workflows (Section 3 — Second Most Common Gap)

I've identified my top 3 workflow bottlenecks — tax memo drafting, financial summary preparation, client report creation, or engagement letter drafting — that involve repetitive writing or structured output
At least one team member is regularly using AI inside an existing accounting workflow — not as an occasional side tool, but as part of their daily production process
I've documented at least one workflow end-to-end with enough specificity that a new hire could follow it — and identified where AI could contribute to specific tasks within it
I know how long our highest-volume deliverable takes today — so I can measure whether AI actually changes that number
I have evaluated at least one AI-enabled accounting workflow tool (Karbon AI, Microsoft Copilot in M365, or a CAS platform) that integrates with existing firm software rather than requiring a separate workflow

Score: ___/5

If you scored 2 or below: Pick your most time-consuming internal task that involves writing — a tax planning memo, a client financial summary, or an engagement debrief. Do that task with AI assistance this week and time yourself. Compare it to your usual time. That's your first data point and your first documented workflow.

Staff Guidance (Section 1 — Critical but Often Overlooked)

I have a documented guideline for which team members can use AI on which client work — so junior staff aren't making data-exposure decisions without firm guidance
I've had a direct conversation with my team about the difference between AI tools that are appropriate for accounting firm work and those that aren't
I have at least one team member who is curious about AI and serves as an internal experimenter — someone who will test tools and share what works

Score: ___/3

If you scored 0 or 1: Junior staff making data decisions without guidance is the most common source of AICPA-related AI exposure. The fix is a short written guideline, not a policy document. Even a one-paragraph Slack message outlining "these tools are OK for internal work / don't use these with client financial data" is a significant improvement over no guidance.

Your Recommended Starting Point

For accounting firms at the Foundation or Building stage, the fastest path to a safe first AI workflow is:

Use Fathom for AI meeting summaries — this workflow involves no client financial data, delivers immediate time savings, and builds the AI habit across your team before more complex use cases. If staff won't adopt AI for meeting notes, they won't adopt it for tax memos.
Add Microsoft Copilot for internal drafting — if your firm is on M365, you've likely already paid for Copilot. Use it for client email drafts, engagement letter templates, and internal memos. The M365 Business Premium data agreement provides stronger protection than public AI tools.
Evaluate Karbon AI for workflow-embedded tasks — if you use Karbon, the AI features built into your existing workflow tool are lower-risk than adding new vendors.

Do not start with a public AI tool (ChatGPT, Gemini, Claude free tier) for client-facing work until you have a data policy in place and can confirm your use case doesn't trigger AICPA confidentiality concerns.

Accounting Firm AI Readiness Score

Add your section scores. Use this table to find your stage:

Total Score	Stage	Accounting Firm Priority
18–23	Scaling	Focus on measurement and business model adaptation — AI efficiency gains should improve your margin, not just your turnaround.
12–17	Building	Close your lowest-scoring section first. For most accounting firms, that's Data & Security.
6–11	Piloting	Start with Fathom for meeting notes and build a data policy in parallel. Both take less than a week.
0–5	Foundation	One team conversation + one data policy statement this week. Don't buy tools yet.

Cross-Links

Complete 7-dimension assessment: AI Readiness Checklist for Professional Services Firms — covers all five firm types with 35 checkpoints
Already past readiness? AI Implementation Checklist for Accounting Firms — phase-by-phase execution guide once you've decided to proceed
Pricing model implications: After AI adoption, most accounting firms face a business model question. See how consulting-style pricing structures apply to accounting at the Consulting Firm Pricing Model Transition Worksheet

Want Accounting Firm AI Intelligence Every Week?

The Crossing Report delivers the week's most important AI developments — filtered specifically for professional services firm owners. Every Monday.

Free subscribers get the top 3 insights.

Premium subscribers ($19/month) get deep analysis, tool comparisons, implementation guides, and a specific action step for your kind of firm.

Subscribe free at crossing.one

The Crossing Report — Intelligence for professional services firm owners navigating the AI transition.

© The Crossing Co. You're welcome to share this checklist with other firm owners. Please keep it intact and credit The Crossing Report.