Make AI useful. Keep the professional in charge.

Know what happens between the client record and the final output

For accountancy practices, bookkeeping businesses and finance teams adopting AI-assisted document extraction, transaction classification, research or correspondence. We connect the tool inventory to the people who own quality and client trust.

• Client-data boundaries: record approved tools, access, retention questions and the treatment of confidential source documents.
• Professional review: define checks for unsupported answers, outdated source material and inappropriate reliance on generated calculations or explanations.
• Approval gates: identify where agents could post entries, send correspondence or initiate submissions, and require named authority before consequential actions.

The PCRT AI topical guidance, published on 19 January 2026, applies existing professional principles to AI-assisted UK tax work for the members and firms within its scope. It is professional guidance, not a new AI statute or a certification for all bookkeepers. Applicability is checked during scoping.

A working system, not just a policy

Seven practical outputs. Clear next steps.

1. AI system and agent inventory. Record the agreed tools and use cases, owners, data, suppliers and agent permissions. Include staff-reported shadow AI and embedded AI features.
2. Risk-appetite workshop. Agree acceptable use, escalation thresholds and activities that require approval or must stop.
3. Governance roles and RACI. Name who approves, operates, reviews and challenges each use case.
4. Completed risk register. Capture the identified risks, current controls, evidence gaps, owners and residual-risk decisions for the agreed scope.
5. Prioritised treatment plan. Separate urgent restrictions from 30-, 60- and 90-day actions, with owners and target dates.
6. Monitoring dashboard and review cadence. An editable, initially populated management dashboard using available evidence, with measures, review dates and triggers for incidents, supplier changes, expanded agent permissions and retirement. No live integrations or continuous monitoring.
7. Framework crosswalk. Map the outputs at a high level to the DSIT toolkit, ISO/IEC 42001 and NIST AI RMF. Flag potentially relevant EU AI Act duties for specialist confirmation where the organisation’s role, use case and territorial scope make them relevant.

A focused two-week engagement

Fixed fee: £4,950 + VAT. One entity or business unit, up to five AI systems or use cases and six stakeholders, delivered remotely. Includes a 90-minute discovery session, a two-hour risk-appetite workshop, an executive readout and editable deliverables.

Week one establishes the inventory, evidence gaps and decisions. Week two turns those findings into ownership, controls and an agreed action plan. Timing assumes access to the agreed people and evidence. Unknowns are recorded, not presented as verified controls.

We apply the government’s AI Risk Management Toolkit to the way your team actually works. The toolkit is guidance; using it is not government approval or certification.

The Sprint is a governance and readiness engagement, not a certification, legal opinion, full DPIA or fundamental-rights assessment, penetration test, technical model evaluation or implementation project. Discovery is interview- and evidence-led, not a network scan. Remediation, integrations and specialist reviews are scoped separately. Professional decisions and approvals remain with your organisation.

Build a repeatable approach before the next busy period

Give practice leaders a practical view of approved use, review responsibilities and unresolved supplier questions. Set review triggers for new software features, changing source material, errors and expanded automation.