The UK's Financial Reporting Council Says Investigation Subjects Must Be Ready to Identify, Explain and Justify Their Use of AI

The UK's Financial Reporting Council, the FRC, published its Annual Enforcement Review 2026, dated July 2026. It reviews its enforcement work of the year, under its Audit Enforcement Procedure and its Accountancy and Actuarial Schemes, and takes two linked themes, cooperation and information gathering. It describes no enforcement case about AI. Parts of the review follow, not the whole.

Information Gathering

The review says that in investigations under its Audit Enforcement Procedure it obtains the relevant audit files under its statutory powers. It also commonly sees material directly relevant to the audit opinion in other places: electronic communications within the audit team and with the entity under audit, draft workpapers and internal technical and risk consultations, internal quality reviews or investigation reports, shared network drives, hard copy documents and notes, and audit manuals and internal guidance. Over the past year, it says, it has obtained relevant information in an increasing number of its cases from non-email electronic communications, including instant messages. Such communications "may evidence potential breaches of standards," and the FRC says it also finds "material in these communications which explains and supports the decisions taken by the audit teams."

Under "Problems encountered," the review lists issues that prolonged or disrupted its information gathering this year. One is non-retention of material. "Some firms do not routinely retain non-email electronic communications used for the audit." In one case, it says, a firm deleted potentially substantial amounts of emails generated by the audit team after the investigation had started, and "no adequate explanation was given as to how the data came to be deleted." The review says the issues in its table, of which non-retention is one, "can cause significant delays in the gathering of material," and that in appropriate cases it will consider whether deficiencies in the provision of information by a firm constitute non-cooperation.

Beside that issue, under "How firms can assist," the first item is to "Establish and enforce comprehensive data retention policies covering all communication channels for the purposes of the audit (email, messaging, collaboration platforms and use of AI)." Among the other steps in the same cell are to "Implement legal hold procedures immediately on relevant data sources upon awareness of potential regulatory investigations," to conduct internal audit compliance checks with retention policies, and to "Use secure archiving systems to prevent accidental or unauthorised deletion."

The review puts the use of AI on the same list as email and messaging: a channel whose record a firm is advised to keep.

Overview by Executive Counsel

The overview says that with effect from July 1, 2026, in appropriate cases under the Audit Enforcement Procedure, "the Accelerated Procedure and the Early Admissions Process will enable swifter investigations and resolution while maintaining the requisite quality and rigour to justify public confidence" in the FRC's enforcement work. Their successful use, it says, "will rest to a significant extent on firms and individuals being prepared to engage with us on a fully open and energetic basis."

The overview then speaks of "a rapidly changing landscape for financial reporting, audit and actuarial work, fired by the development and use of AI," and says the FRC anticipates "extensive scrutiny by us in the year ahead of the use of AI in those contexts." It goes on: "Investigation subjects must be ready to identify, explain and justify their use of AI. Mindful of the risks and uncertainties of AI, users must continue to place human judgment front and centre of their work. Professional accountability rests with individuals."