AI for Accountants Australia: Privacy, TPB, Governance

A practical guide to AI for Australian accountants and bookkeepers: TPB duties, privacy, client confidentiality, use cases and a roadmap. General…

AI for accountants in Australia comes down to one idea: you can use it, but your professional obligations come with you into every prompt. Client confidentiality, competence and reasonable care, and your responsibility for the final work do not change because a tool wrote the first draft. Practices that get value from AI settle privacy, confidentiality, professional obligations and governance first, and only then choose the tasks where AI helps.

That is the order of this guide: obligations first, then where AI fits, the risks and a starter roadmap. Many pages on this topic are lists of tools. We recommend none, and we are not accountants, tax agents or lawyers.

This is general information, not tax, accounting or legal advice. Nothing here is advice for your practice. Rules differ by registration, membership and structure, and they are changing. Everything we state about Australian guidance comes from official pages we read on 2 November 2026, listed under Sources. Your professional body, the regulator, your insurer and your own adviser decide what applies to you.

We work from Burleigh Heads on Queensland's Gold Coast, remotely, with no city offices, and we have been building software and AI systems for Australian businesses since 2016.

The short version

Start with obligations, not tools. The Tax Practitioners Board (TPB) says practitioners remain ultimately responsible for their work when they use AI.
Client information is the sharp edge. The TPB says AI can be a "third party" for confidentiality purposes, and permission is needed before client information goes into AI tools, depending on how they are configured.
Privacy law may apply. The OAIC says the Privacy Act applies to all uses of AI involving personal information. Whether it covers your practice is a question for your adviser.
Check outputs every time. The TPB treats AI output as a starting point, to be verified at each step.
Write it down. A short policy, an approved-tools list and an AI register beat informal use.
One date for the diary. From 10 December 2026, new privacy policy transparency requirements for automated decisions begin (APP 1.7).

Start with your obligations

If you are a registered tax agent or BAS agent, the starting point is TPB(GS) 55/2026, The use of Artificial Intelligence and the Code of Professional Conduct, issued on 22 July 2026 after an exposure draft in March 2026. The TPB describes AI as a significant productivity opportunity, and is clear on responsibility: practitioners are ultimately responsible, even if an AI provider makes the error.

The TPB ties AI use to the Code of Professional Conduct, including:

Confidentiality (Code item 6), covered in the next section.
Competence and reasonable care (Code items 7 to 10). There is no set formula. The TPB points to factors such as the scope of the work, whether output is checked, and whether AI is used for tasks outside the practitioner's own expertise.
Supervision and quality management. Section 35 of the Determination deals with supervision, and section 40 requires a documented and enforced system of quality management designed to give reasonable confidence of complying with the Code.
Records (section 30 of the Determination). TPB(GS) 52/2024 now lists records relating to the use of AI tools in providing tax agent services among the records to consider.

The TPB notes that large language models can hallucinate or be biased, and says practitioners should verify AI output at each step of a workflow, have processes to understand and contest it, and document those steps. It does not approve or endorse AI providers.

For members of the accounting bodies there is a second layer. APESB's APES 110 Code of Ethics for Professional Accountants took technology-related revisions into effect on 1 January 2025. APESB's Technical Alert of 31 October 2025 says members remain responsible for their analysis and professional judgements, should avoid undue reliance on AI, should critically verify AI output, and should disclose and supervise AI use. Where a service-specific standard requires disclosure of methodology and information sources, that would generally include AI. CPA Australia frames the same point through the five fundamental principles of APES 110, including professional competence and due care and confidentiality. The TPB notes APES 110 is not binding on every tax practitioner, and that its accredited professional associations may offer further guidance.

If you are a bookkeeper not registered with the TPB, TPB(GS) 55/2026 is not written for you, but it is a sensible reference. Ask your professional body or adviser what applies.

Client confidentiality and consent

This is where most practices should spend their first hour. The TPB's guidance reads "third party" broadly: any entity other than the client and the practitioner. Depending on how an AI tool is configured, it can be one. So the TPB says permission is needed before client information goes into AI models and tools, and clients should be told to whom their information goes, where it is stored, and whether AI may be used.

The TPB accepts that consent may come through a signed engagement letter, signed consent, another communication such as a fact find and consent, or in some cases a general authority. If AI use is a material change to how you deliver services or handle data, it says to consider updating your engagement terms and telling affected clients (see TPB(GS) 34/2019). One expert quoted by CPA Australia suggests saying in the engagement letter how you are using AI and how you are not.

On public tools, CPA Australia's article says not to upload client data into a public-facing AI tool, because confidentiality is not guaranteed there, while in-house tools are acceptable if they have adequate privacy and security. The TPB's Q&A adds that even where AI is hosted locally, disclosure depends on the circumstances and confidentiality and privacy duties still apply.

The ATO's guidance to the public is a useful reminder of the stakes. It says AI can generate inaccurate, outdated or incomplete tax information, for example by quoting a rate from the wrong year, and that people should not share personal information such as a name, tax file number or bank details with AI tools. Your clients may be reading the same advice.

Privacy: what the Privacy Act and the OAIC say

Does the Privacy Act cover your practice? The OAIC says a business with annual turnover of three million dollars or less is generally not covered, but there are exceptions regardless of turnover, including health service providers, businesses that trade in personal information, reporting entities under the AML/CTF Act 2006, Commonwealth contractors, and businesses related to a covered business. The TPB says practitioners should consider whether the Privacy Act applies to them and seek advice.

Tax file numbers. The Privacy (Tax File Number) Rule 2015 is legally binding, applies to individuals' TFN information, and sits alongside the Australian Privacy Principles (APPs). The OAIC says it may apply to small businesses even where the rest of the Privacy Act does not. TFN data deserves its own line in your AI policy.

If the Privacy Act applies, the OAIC's guidance on commercially available AI products makes these points:

Inputs and outputs both count. Privacy obligations apply to personal information put into an AI system and to output that contains personal information, including inaccurate or artificially generated information about an identifiable person, such as a hallucination.
Use and disclosure (APP 6). Personal information put into an AI system must be used or disclosed only for the purpose it was collected for, unless consent or another permitted basis applies.
Security (APP 11). Assess a new product against your obligation to take reasonable steps to protect personal information, including whether the developer gets access to data you put in.
Privacy by design. The OAIC recommends a Privacy Impact Assessment, regular review rather than "set and forget", staff training, and updated privacy policies.

Data breaches. Organisations the Privacy Act covers must notify affected individuals and the OAIC when a breach is likely to result in serious harm. Your incident plan should include AI tools.

The date for the diary. The OAIC announced on 30 September 2026 that from 10 December 2026, APP entities must include information in their privacy policy where a computer program makes, or does something substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual's rights or interests, using their personal information (APP 1.7 and 1.8). Whether any tool in your practice meets that test is a question for your privacy adviser, and you cannot answer it without an inventory of what you use. The OAIC has published a fact sheet and flowchart.

Governance that fits a practice

Governance does not have to mean a committee. CPA Australia says AI use should sit inside a broader governance and quality management framework, with oversight that reflects how sensitive the information is and the consequences of a wrong output. CA ANZ lists an AI policy guide and template among its AI ethics and governance resources.

The TPB's Q&A lists records a practitioner may wish to keep: the AI tool used and its purpose, the human review at each step, the final work product, and client consent. Not every prompt needs retaining. The records should be enough to show you complied. We call this an AI register: one page per tool and use, with an owner, what data goes in, consent basis, who reviews the output, and a review date. It is our practical interpretation of the official lists, not an official template.

For a national reference point, the Voluntary AI Safety Standard from the Department of Industry, Science and Resources sets out 10 voluntary guardrails. Several map directly onto a practice: accountability (1), testing and monitoring (4), meaningful human oversight (5), informing end-users about AI-enabled decisions and interactions (6) and keeping records (9). The National AI Centre's Guidance for AI Adoption (21 October 2025) condenses this into 6 essential practices: decide who is accountable, understand impacts and plan accordingly, measure and manage risks, share essential information, test and monitor, and maintain human control. Both are voluntary. For the board-level view see AI Governance Australia, and for a formal management system see ISO 42001 in Australia.

Where AI fits: use cases and the questions to ask

CPA Australia suggests using generative AI as a thinking and drafting partner, for first drafts and ideas rather than final outputs, and says not to treat it as an authoritative source on standards, laws or regulations. Here is how that translates into a practice. The right-hand column is our suggested starting posture, not official guidance.

Use	Questions the guidance raises	Sensible starting posture
Drafting emails and client explainers	Is client information entered? Is the tool approved? Who reviews the draft?	Low risk with approved tools, no client identifiers and human review
Meeting notes and transcription	Whose personal information is recorded? Where is it stored and processed? Is there consent?	Do the privacy assessment and consent step first
Document handling and data entry	Does it touch TFNs, bank details or other client records? Who can access the data?	Only in a controlled environment, after checking terms and the TFN Rule
Tax and technical research	Outdated or wrong-year rules. Can you check the primary source?	Treat as a pointer, then verify against the legislation or the ATO
Reconciliation and anomaly flags	How was the tool tested? Who investigates the flags? Is it making decisions about people?	Human decides, with a record of the check
Client chatbots and portals	Privacy notices, accuracy, identification as AI, APP 1.7	Design privacy and disclosure in first

Begin where information is not confidential and errors are cheap to catch, and move up as your controls mature.

The risks, in plain terms

Confident but wrong output. The ATO, the TPB and CPA Australia all warn of inaccurate, outdated or biased output, and the reasonable-care test turns on whether you checked it.
Client information leaving your control. The mistake that cannot be undone, because the information has already been disclosed.
Undue reliance. APESB and CPA Australia both name it, and the TPB lists use outside your own expertise as a factor.
Features you did not choose. AI increasingly arrives inside software you already use. If nobody has listed it, nobody has assessed it, and it may matter for APP 1.7.
Supervision gaps and shadow use. If checking is rushed or nobody owns it, the control fails, and you cannot govern personal accounts and extensions nobody has declared.

A starter roadmap for a small or mid-sized practice

We give no durations, because the right pace depends on your size and how much AI is already in use. Run these in order.

Find out what is already happening. Ask everyone which AI tools they use, including personal accounts and features inside software you already pay for, and mark anything touching client information.
Set an interim rule now. One page: approved tools, what may never be entered (TFNs, bank details, client-identifying information in public tools), and who to ask.
Check your obligations. Ask your professional body, the TPB guidance, your adviser and your professional indemnity insurer what applies to you. These are questions for qualified professionals, not for us.
Assess privacy and tool terms. Where the Privacy Act applies, run a privacy impact assessment for each tool you keep, and read the terms on data use, training, retention, location, access and termination.
Write a short AI policy covering approved tools, permitted and prohibited uses, verification, supervision, records, client communication and review.
Sort out client consent. Decide how you will ask for it and how you will record it, and whether your engagement terms need updating.
Pilot one low-risk use, with a defined good output, a named checker and a recorded check.
Train and keep your register. Make checking someone's actual job, and log each tool, purpose, review and consent.
Review on a schedule. Guidance, tool terms and the 10 December 2026 privacy changes move, so give someone ownership.

Where Adaptive Media helps

We are a technology and AI consultancy, not an accounting or law practice. We give no tax, accounting or legal advice and recommend no AI vendors. We do the practical work around the decisions your own advisers make:

AI inventory and risk workshops, mapping tools, uses and where client information flows.
Governance design: a plain-language policy and AI register for you and your advisers to review and adopt.
Technical controls and readiness: scoped data access, logging and review steps, and a sequenced plan, as in our guide to AI readiness assessment in Australia.
Part-time AI leadership: if nobody can own this, see What Is a Fractional CAIO?.

If your practice is a small team, our guide to AI for small business covers the general owner's view. If you work alongside law firms, see AI for law firms for the legal-practice equivalent. We deliver remotely from Burleigh Heads, Queensland.

Frequently asked questions

Can Australian accountants and bookkeepers use generative AI at all?

Nothing in the official pages we read bans it. The TPB says it is neither for nor against AI, while making clear practitioners stay responsible for their work, and CPA Australia's article says there is nothing wrong with using AI in your practice.

Can we put client information into a public AI chatbot?

The official pages point strongly away from it. CPA Australia says not to upload client data into public-facing AI tools, the OAIC recommends as best practice not entering personal information into publicly available generative AI tools, and the TPB says permission is needed before client information goes into AI tools, depending on how they are configured.

Do we need client consent before using AI on client information?

The TPB says permission is needed where AI is a third party under Code item 6, and consent may be a signed engagement letter, signed consent, another communication or a general authority. Whether your configuration makes the tool a third party is a question for your adviser.

Does the Privacy Act apply to our practice?

It depends. A business with annual turnover of three million dollars or less is generally not covered, with exceptions listed by the OAIC, and the Privacy (Tax File Number) Rule 2015 may apply even to small businesses. The OAIC's checklist is not a substitute for legal advice, so ask your adviser.

What changes on 10 December 2026?

APP entities must add certain information to their privacy policy where a computer program makes, or substantially and directly helps make, a decision that could significantly affect an individual's rights or interests using their personal information (APP 1.7). Whether it touches your practice depends on your tools and coverage, so inventory first.

What records should we keep when we use AI?

The TPB's Q&A suggests records showing the tool used and its purpose, human review at each step, the final work product and client consent. Existing record-keeping obligations are unchanged by AI. See the governance section for our AI register idea.

Is there an official standard our practice should follow?

For tax practitioners, the primary guidance is TPB(GS) 55/2026 and, for accounting body members, APES 110 and the APESB Technical Alert, plus your body's guidance. More broadly, the Voluntary AI Safety Standard offers 10 voluntary guardrails and the Guidance for AI Adoption sets out 6 essential practices. Neither is a legal requirement. For a formal management system, see ISO 42001 in Australia.

Sources

Official and professional-body pages read on 2 November 2026:

Next step

List every AI tool your practice uses today, including the informal ones, and mark which touch client or personal information. That inventory is the starting point for your policy, your consent approach, your privacy assessment and your conversations with your professional body and advisers. If you would like help turning it into a governance and readiness plan, book an AI governance consult and we will talk through your systems, your workflows and a sensible first step. We do not provide tax, accounting or legal advice, and your own advisers remain the authority on your obligations.