AI for accountants and bookkeepers, inside the TPB's rules

The client emails, plain-English explanations and checklists that fill a small firm’s week can start as a first version from an AI assistant. The Tax Practitioners Board (TPB) registers tax agents and BAS agents, the people paid to prepare other businesses’ Business Activity Statements, the form that reports GST, the goods and services tax. It has now said what it expects when they use an AI assistant, and the short version is reassuring: use it, check it, and ask your clients first.

The rules are national, so they bind a two-person firm in Western Sydney or the Blue Mountains exactly as they bind a big one.

What does the TPB’s AI guidance say?

It says AI is welcome, and you stay responsible for everything it touches. The guidance is TPB(GS) 55/2026, “The use of Artificial Intelligence and the Code of Professional Conduct”, issued on 22 July 2026 and re-read for this post on 14 October 2026.1

It opens on a positive note: “The TPB recognises that AI tools, when used appropriately, provide a significant opportunity to increase productivity and deliver efficiencies for tax practitioners, the public and Australia”.1 Then come four duties that matter to a small firm.

You answer for what the AI produces

The guidance says practitioners “remain accountable for the accuracy of information and advice they provide to their clients”.1 It warns that AI models “may hallucinate or provide inaccurate information”, meaning they can state something false with complete confidence.1

You check each step, and write it down

Practitioners “should verify and review AI generated content for accuracy throughout each step of the workflow”, and “Each of these steps should be documented”.1 The guidance ties that record to sections 30 and 40 of the 2024 Determination, the rules under the Code on keeping records and running a system of quality checks.1

You get the client’s permission before their information goes in

This is the big one. Code item 6 says: “Unless you have a legal duty to do so, you must not disclose any information relating to a client’s affairs to a third party without your client’s permission”.1

The guidance says practitioners “must obtain permission from each client prior to divulging client information to a third party (which can include entering client information into AI models and tools, depending on how these tools are configured and used)“.1 It recommends telling the client “to whom and where the disclosure will be made, where data will be stored and whether AI tools may be used”.1

Permission “may be by way of a signed letter of engagement, signed consent, or other communication such as a relevant ‘fact find’ and consent”.1 So the engagement letter, the letter that sets out the work before it starts, is the natural home for it.

The AI inside your software counts too

The TPB’s list of what counts as AI includes “AI features which may be embedded within software or third-party platforms” and “chatbot functionality, including ability to provide tailored advice in response to specific input”.1 So the AI built into your accounting software is in scope, not just ChatGPT, Claude, Copilot or Gemini.

Does it apply to bookkeepers?

It applies to registered tax agents and BAS agents, whom the guidance calls “tax practitioners”.1 The TPB says anyone providing BAS services “for a fee or other reward” must be registered unless an exemption applies.5

If you’re a bookkeeper who isn’t registered and doesn’t do BAS work, this guidance doesn’t bind you. Your clients’ details deserve the same care anyway, and the Privacy Act can still reach you, as below.

Who counts as a third party?

Anyone other than you and your client. The AI guidance says “a third party is any entity other than the client and the tax practitioner”.1

The TPB’s guidance on confidentiality, TPB(GS) 26/2014, last modified 20 July 2026, adds that a third party “may also include entities that maintain offsite data storage systems (including ‘cloud storage’)“.2 Its own example is a firm that runs its accounting software on an outside IT provider’s computers, and gets each client’s signed engagement letter to cover it.2

As I read it, an AI tool run by an outside company raises the same question. That’s why the AI guidance says “depending on how these tools are configured and used” rather than giving a yes or no.1

What about the Privacy Act?

It can apply even to a small firm. The Office of the Australian Information Commissioner (OAIC), the privacy regulator, says the Privacy Act 1988 exempts small businesses with an annual turnover of AU$3,000,000 or less, with exceptions.3

But the OAIC lists the Privacy (Tax File Number) Rule 2015 as a separate obligation,3 and that rule covers anyone “in possession or control of a record that contains TFN information”, TFN being short for tax file number.4 Under it, a TFN recipient “must not record, collect, use or disclose TFN information unless this is permitted under taxation, personal assistance or superannuation law”.4

The TPB’s guidance says those “additional obligations” apply where client information involves tax file numbers, and that practitioners should “seek their own advice” on the Privacy Act.1 Which parts apply to your firm is for you to check. This isn’t legal advice.

Which everyday jobs can AI help with inside these rules?

Start with the jobs that have no client in them. Next come the jobs where the client has said yes, the tool is set up properly, and you check the result.

Writing that has no client in it

Your newsletter, the service descriptions on your website and Google listing, a job ad, a checklist of what a sole trader brings to their appointment. Paste nothing about a client and there’s nothing to disclose.

If the listing is the job, our post on what a new client sees when they search your suburb has the words to use.

Plain-English explanations, with the client taken out

Take your own notes on a client’s question, remove the name, tax file number, ABN (Australian Business Number) and anything else that points to them, and ask an AI assistant to rewrite it for someone with no tax knowledge. Then read every line, because you answer for it.1

A prompt to start from: “Rewrite these notes as a short, friendly email to a client who has never done a tax return. Keep every fact. Don’t add anything I haven’t written.”

Reading new rules faster, then reading the source

Ask an AI assistant to summarise a new publication from the TPB or the ATO, the tax office, then check each point against the original before you rely on it. The TPB’s warning about made-up answers is the reason.1

Meeting notes, once the client has said yes

A write-up of a client meeting puts client information into a tool. So it needs the client’s permission first,1 a business plan with training on your data switched off, and your own read of the notes.

If the notes come from a recording, ask before you record. NSW law bans recording a private conversation you’re part of without the consent of all the main parties, unless another exception applies.8 Our post on customer details in AI covers which plans use what you type.

The permission wording in your engagement letter

Ask an AI assistant to write a paragraph that names the AI tools you use, who runs them, where the data is stored, and asks the client’s permission, which are the points the TPB recommends.1 Then check it as you would any change to your engagement letter, and get it signed before client information goes in.

Where does your own software already do the job?

In more places than you might think, so check before you pay for anything new. Xero says JAX, its AI, reconciles bank transactions, meaning it matches each line on your bank statement to a record in your books, “when it’s highly confident they match” and otherwise “suggests a match but leaves the transaction for you to reconcile manually”.6 Xero’s Smart Document capture reads receipts and bills from a photo or a forwarded email.7

MYOB’s AI BAS, labelled BETA on its page on 14 October 2026, meaning it is still being tested, “helps identify missing receipts, checks GST treatment and flags potential anomalies”.9 MYOB says the books update only with your approval.9

I wouldn’t buy a separate AI tool for those jobs, and I wouldn’t let anyone sell you one. The TPB counts AI built into software as AI too,1 so your check-and-record step still applies.

What should a small firm leave alone?

Four things, in my view:

• Tax file numbers in any AI tool. The TFN Rule’s limits on recording, using and disclosing them4 make an AI tool the wrong place to test. I’d keep them out entirely.
• A chat box that answers clients’ tax questions. The TPB lists chatbots giving tailored advice as AI,1 and you answer for every reply it gives at 10pm with nobody checking. Let a chat box take details and book a time; keep the advice for yourself.
• Client information in a free personal plan. On ChatGPT’s plans for individuals, OpenAI says “we may use your content to train our models” unless you opt out.10 Use a business plan and check the setting yourself.
• Anything you haven’t checked. The guidance says AI output shouldn’t be relied on “as a substitute for their own analysis of a client’s circumstances”.1

What to do this week

1. List every AI tool in the firm, including the AI inside the software you already run the firm on.1
2. Read your engagement letter for a paragraph on AI and outside providers. If there isn’t one, add it and get it signed before client information goes into an AI tool.1
3. Pick one plan for client work, a business plan, and check its training setting yourself.
4. Write down your check step: who reads AI output before it’s used, and where that’s recorded.1
5. Start with one job that has no client in it, such as this month’s newsletter.

None of this makes a firm “compliant”, and no tool is approved by the TPB. It’s a way of working that follows what the guidance says.

If you’d rather hand it over

On our menu, Safe rules for AI in your business writes down what AI may touch in your firm and what it must never. Engagement letters drafted gives you the letter, with the permissions you need, to check and send.

Both are on our page for accountants and bookkeepers. Start with one thing, or a bundle. If yours is different, we scope it.

Book a free hour.