You Can't Blame the Tool

I would like every firm to print one line and pin it to the wall. Accountancy Europe wrote it.

"Using GenAI does not shift or dilute individual responsibility."

GenAI is its short form for generative AI. The line comes from its paper on generative AI in audit, published in September 2026 and aimed mainly at small and medium-sized practices. Four of the six documents here say something close to it.

The tool can draft. The person signs.

The Signature Doesn't Move

The tool can't be held to account. Accountancy Europe says so in plain words. Generative AI, its paper says, cannot be held accountable the way an auditor can. Using it does not change who answers for the work. Responsibility for the conclusions, the audit evidence and compliance with professional standards stays with the engagement team. In the end it stays with the engagement partner. Whatever tools produced the draft or the analysis.

Nobody should have to guess where that line runs. The paper wants it written down. Firms should be clear about it in their policies. Auditors need to be able to explain and stand behind any output the tool helped produce. And sign-off and review procedures should make the line of accountability "explicit rather than assumed."

And the tool can be wrong in the worst way. Generative AI can produce "convincing but incorrect information," the paper says. Its output should not replace professional judgment. Where it is meant as audit evidence, it should be reviewed critically.

Convincing but incorrect. That is the dangerous kind. A wrong answer that looks wrong gets caught. A wrong answer that looks right gets signed.

A good forgery is worse than a bad one. Nobody looks twice.

Tax work gets no exemption. The IRS's website carries Issue Number 2026-19, dated June 24, 2026, titled "Introductory Guidelines for Responsible AI Use in Federal Tax Practice." Practitioners who use generative AI must thoroughly review every AI-created document before it goes to a client or the IRS. They "cannot rely solely on AI." In its conclusion, the ethical duties of competence, diligence and confidentiality "remain unchanged."

A tool that sounds human gets trusted like one. That is the risk the Dutch financial markets authority, the AFM, put its finger on. It looked at how audit firms use auditing tools, in a review it calls exploratory. Auditing tools that use generative AI, it says, can produce humanlike results. So there is a risk that the results are adopted without the auditor's critical assessment.

Think of a new hire who speaks with total confidence on day one. You still check the work.

The AFM's answer is one of its building blocks, set out in December 2025: "the external auditor is ultimately responsible for the outcomes from the (Gen)AI tool." The auditor must critically evaluate the output, and decide, on their own, when more human checking is needed.

The firm can't hide behind the tool either. Canada's audit regulator, CPAB, says in its 2025 annual report that it led the development of the international forum of audit regulators' technology paper of March 2025. That paper, CPAB writes, included a focus on "communicating our expectation that the audit firm retains responsibility for judgments made in the audit."

So stack them up. A European body of accountants. Tax guidance on the IRS's own website. The Dutch markets regulator. Canada's audit regulator. Different countries, different jobs, different words.

Four bodies. One message, as I read them. You can't blame the tool.

Who Checks the Checker?

If the person signs, the firm has to make sure the person can. CPAB, for one, says it will look at the firm.

Its annual report says the largest audit networks sped up their adoption of advanced technology in 2025. That included developing AI-enabled tools and agentic AI systems. CPAB says it will keep looking at the controls and processes firms build into their use of new technology. Its oversight work, it says, underlines the need for a human-led approach. That approach puts weight on professional skepticism, backed by training, supervision and review, among other things.

One limit, and it matters. CPAB's oversight does not include certifying the technology or assessing it in detail. It will share what it sees through its inspections and its outreach.

So CPAB will not vouch for the tool. I read that as leaving the testing to the firm.

The AFM's building blocks show where that work starts. An appropriate information security framework. A formal policy on auditing tools. Checks that the input data is relevant and reliable. And follow-up on what the tools produce.

The IRS turns to tax firms too. Its guidelines quote a rule from Circular 230. Those with principal authority over a firm's practice must take reasonable steps to make sure the firm has adequate procedures. For AI, the guidelines say, firms must put policies in place for compliance with Circular 230. These should include staff training, secure data handling, monitoring of AI's accuracy, and vetting of outside tools. And every step documented.

Here is the test I would put to any tool. Give it work where you already know the answer. If it misses that, why would you trust it with the rest?

One catch. Accountancy Europe notes that generative AI may give different outputs to the same or similar inputs. So I would run the test more than once.

What Your Audit Committee Wants to Know

Audit committees are asking the right question. In July 2026, CPAB published what it heard from them. These committees, it says, oversee a company's financial reporting, internal controls, financial and compliance risks, and the external audit. In the first half of 2026, CPAB held forums with committee members and chief financial officers.

They are seeking clarity on how their auditors use AI. They are interested in how firms build "challenge and validation functions" into audit work done with AI. The aim, in CPAB's account, is that audit teams still understand the business, still use proper professional skepticism, and still critically assess what the tools produce.

They also noted a risk. People may believe an audit done with AI does more than auditors are actually responsible for. If so, the expectation gap could widen.

Think of lane assist in a car. If people think it means the car never drifts, they expect more of the driver than the driver can promise.

The Order That Never Says AI

In the United States, the SEC's order on new audit rules never mentions AI.

In August 2024, the Securities and Exchange Commission approved changes to auditing standards of the PCAOB, the Public Company Accounting Oversight Board. The order says they take effect for audits of financial statements for fiscal years beginning on or after December 15, 2025. They address certain parts of audit work that use technology-based tools to analyze information in electronic form. The order calls the changes principles-based. In its words, they "further specify and clarify certain existing auditor responsibilities."

The SEC gave its reasons. The use of such tools is "substantially increasing," and is expected to keep increasing. They could make audit work more effective, for example by letting the auditor analyze more data. And PCAOB research indicates that some auditors may hold back from new technology, because of what the order calls "perceived regulatory uncertainty."

To me, that last reason is the most telling line in the order. The SEC does not say firms lacked tools. The brake it names is doubt that some auditors may feel about the rules. The SEC also says the changes address challenges that "may not be sufficiently addressed" under the current standards. But nothing in the order moves the auditor's duty onto the tool.

Where It Becomes Your Problem

These documents have limits. The IRS document calls its guidelines introductory, and says guidance from government agencies and professional bodies continues to evolve. The SEC's order is about technology-based tools in general and never mentions AI. CPAB does not certify the tools it sees. And Accountancy Europe writes mainly for smaller practices.

But the direction is clear to me. Whatever the tool does, a person with a name answers for it.

If you run a firm, that person works for you. Can they check what the tool produced? Can they explain it?

If not, the tool is not saving you work. It is moving risk to a place you can't see.