Third-party tools
-
Professional ethics Client data and confidentiality
A CCAB Draft Case Study Says Client Authorization Is Still Required Even When Client Data Is Processed to Create Synthetic Data
In draft case studies on the ethical use of AI, published for consultation in June 2026, the Consultative Committee of Accountancy Bodies sets out a fictional firm's plan to train its own large language model on synthetic data derived from actual client data, and the concerns raised about it.
-
Australia's Prudential Regulator Says Assurance Practices Are Not Keeping Pace With AI at the Selected Large Entities It Engaged With
In a letter of April 30, 2026 to the entities it regulates, APRA reports what it found among selected large banks, insurers and superannuation trustees, among them a reliance on "point in time and sample based assurance methods" that it calls "ill suited to probabilistic models that learn, adapt and degrade over time."
-
Ownership and vendors Deals and vendors
Australian Law Societies' Checklist Asks Law Practices Choosing a Third-Party AI Tool Who Owns the Output and Whether the Contract Covers Its Errors
A checklist dated February 2026, from the Queensland Law Society with other Australian law societies and the Law Institute of Victoria, is meant to help small and mid-tier firms select and adopt AI tools built by someone else, and asks, among other things, whether the contract includes indemnities for errors caused by the tool.
-
Respondents to the Bank of England and FCA's 2026 AI Survey Most Often Relied on Vendor Assurance and Contracts to Understand High-Materiality Third-Party AI
In a report published on October 26, 2026, the Bank of England and the Financial Conduct Authority describe their fourth survey of artificial intelligence in UK financial services, and say third-party implementations made up a larger share of the AI systems firms considered highly material than in 2024.
-
Connecticut's Banking Department Says It Plans to Review the AI Systems of the Entities It Regulates During Supervisory Examinations
In guidance dated September 22, 2026, the Connecticut Department of Banking set out its expectations for how the Connecticut-chartered financial institutions and other entities it licenses or regulates should govern the AI systems they use, and said it plans to review those systems and related policies and procedures during supervisory examinations.
-
When AI-prepared work goes wrong Cases and sanctions
The Sixth Circuit Says Citing Real Cases Did Not Absolve a Lawyer Whose AI-Drafted Briefs Carried False Quotations
In an opinion of April 3, 2026, recommended for publication, the United States Court of Appeals for the Sixth Circuit said that an appointed lawyer, by the lawyer's own admission, used artificial intelligence to draft two briefs and filed them without properly verifying the cited authorities, and ordered that the lawyer not be paid under the Criminal Justice Act for the time spent on the appeal.
-
Regulators and standard setters Audit and assurance
The FRC Says Some Audit Firms Are Now Deploying Generative AI to Perform Audit Procedures and Generate Audit Documentation
In its Annual Review of Audit Quality 2026, dated July 2026, the UK's Financial Reporting Council says some firms are deploying generative AI tools to perform audit procedures and generate audit documentation, plans a thematic review of how the largest firms govern its use, and says limited use of GenAI on audits was observed in the past year.
-
Regulators and standard setters Tax
HMRC Says Generative AI in Tax Software Should Support, Not Replace, Human Judgment
On January 28, 2026, the UK's HMRC published guidelines for software developers who use generative AI in commercial products that help customers submit information to it. Such software, it says, "should support, not replace, human judgment," and should clearly remind users that making sure each tax return is accurate is their responsibility.
-
Professional ethics Client data and confidentiality
Confidential or Privileged Information: APESB's Draft Guidance on AI for Forensic Accountants and Valuers, September 2026
A preliminary draft among the papers for the board meeting of Australia's Accounting Professional & Ethical Standards Board on September 4, 2026, says in the first of its illustrative examples that "Confidential or privileged client information should not be entered into public AI tools."
-
Not Within the Scope of This Guidance: Generative AI in the US Bank Regulators' Model Risk Guidance of April 2026
On April 17, 2026, three US bank regulators issued revised guidance on model risk management. Generative AI and agentic AI models, a footnote says, "are not within the scope of this guidance."
-
Evidence and documentation Documenting AI-prepared work
Such That Another Professional Can Understand: Australia's Auditing Standard Setter on AI Audit Tools, July 2025
In July 2025 Australia's Auditing and Assurance Standards Board set out considerations for auditors who use AI tools. Among them is documentation "Such that another professional can understand" the matters the page lists, including the design and use of the tool.
-
Evidence and documentation Testing the data and the tools
Functions as Intended: The FRC's Review of How Audit Firms Certify Their Automated Tools, June 2025
In June 2025 the UK's audit regulator published its review of how the six largest audit firms certify the automated tools their auditors use, a snapshot of the firms' processes as they described them in 2024. It found no formal monitoring by the firms "to quantify the audit quality impact of using ATTs," though their use "may sometimes be captured in other activities such as root cause analysis."
-
Partial Understanding: The Bank of England and FCA's Survey of AI in UK Financial Services, November 2024
In November 2024, the Bank of England and the FCA published the results of their 2024 survey of AI in the UK financial firms they regulate. Many firms said they had only "partial understanding" of the AI they use, largely because of third-party models.
-
Professional ethics Client data and confidentiality
Very Difficult to Track or Control: Australia's Privacy Regulator on Personal Information and Commercial AI Products, October 2024
In October 2024, Australia's privacy regulator published guidance on using commercially available AI products. Once personal information has been input into an AI system, it says, "it will be very difficult to track or control how it is used."
