AI for accounting firms: automating the close without losing control of client data

Every month your team does the same work for every client: pull the statements, reconcile, chase the missing receipts, post the accruals, write the note that goes with the numbers. QuickBooks and Xero already code a lot of transactions themselves. What they don't do is the work across your client list: which closes are stuck, what's missing for whom, and the monthly report each client expects.

That cross-client work is where an automated workflow helps a small firm most. It's also where client data gets copied into places. This guide covers both. It isn't legal advice: the rules below are pointers, and each firm checks them with its own advisers.

1. What to automate first

Pick one task that repeats for every client, every month, and that a person can check in minutes:

• The close checklist: for each client, what's in, what's missing and what's blocking, drafted as the "still needed" email for the bookkeeper to send.
• Reconciliation exceptions: a short list of what doesn't match and the likely cause, so the bookkeeper starts from that list instead of a blank reconciliation.
• The monthly client report: the numbers, the changes and the questions, drafted from the closed month for the bookkeeper to edit.

Leave out anything that decides: posting entries, signing returns, giving advice. The workflow drafts, and a person approves.

2. Where the data goes: three setups

Every AI workflow sends client data to a model somewhere. There are three common answers:

None of these is wrong in itself. What matters is that you choose the setup knowingly and can say which one applies to each client's data.

3. The rules that already apply to you

These rules already cover your firm, AI or not. Ask your own advisers how they apply:

• The FTC Safeguards Rule (Gramm-Leach-Bliley Act): the FTC names "tax preparation firms" among the financial institutions it covers. A covered firm must keep a written security programme, and its contracts with service providers must "spell out your security expectations" and let it monitor their work. Whether your other accounting work falls under it is a question for your advisers.
• IRC §7216: a tax return preparer needs the taxpayer's written, signed consent, naming what is shared and with whom, before disclosing tax return information, apart from the specific exceptions in the regulations (Treas. Reg. §301.7216-2). The IRS's own FAQ says a contractor that receives return information is treated as a preparer under the same rules, that sharing with another U.S.-based preparer who helps prepare the return is an exception, and that a preparer outside the U.S. needs the taxpayer's signed consent. So two questions for your adviser: does an AI vendor count as such a contractor, and where does its processing happen?
• AICPA Code, Confidential Client Information Rule (1.700.001): a member in public practice "shall not disclose any confidential client information without the specific consent of the client". Its interpretation on third-party service providers (1.700.040) gives two routes before a provider sees client information: a contract that binds the provider to confidentiality, with reasonable assurance that it has procedures to prevent unauthorised release, or the client's specific consent. How much assurance is enough "depends on the facts and circumstances, including the extent of publicly available information on the third-party service provider's controls", so a vendor that publishes where data goes and what it keeps makes the first route easier. An AI vendor is a third-party service provider in plain terms; ask your adviser which route fits.

An AI workflow is one more service provider that sees client data. Treat it like your payroll processor or document portal.

4. Keep each client's data separate, and keep a record

Two things make an AI workflow safe to run across a client list:

1. One client at a time. The workflow reads only the client it's working on, and nothing from one client's books ends up in another's draft.
2. A record of what it did. For each run: which client, what it read, what it drafted, who approved it. If a client or an examiner asks, you can show them.

5. How to tell if it's working

Measure the task you picked before you start: the hours your team spends on it each month. Measure again after a month or two. If the hours didn't move, the workflow isn't doing that task.

6. Questions to ask any vendor or agency

1. Where does my clients' data go, and is it kept after the task is done?
2. Is it used to train anything?
3. Can each client's data be kept separate from every other client's?
4. What record do I get of what the workflow read, drafted and who approved it?
5. Can it run on our own hardware if we want it to?
6. Which parts still need a person, and how long does that take?

---

If you run a law firm instead, the same questions apply to case document prep: see AI for small law firms.

Oye Collective builds automated workflows for small firms. Our own products run their models on the user's device: Actvt finds personal information in what it records without it leaving the Mac, and Chouette translates pages with the model running entirely in the browser. If you'd like to map one task in your close, book a call.