AI in finance and accounting
May the ledger go into the chatbot? Section 114 answers it, and not where finance teams look. The duty follows the information through its collection, use, transfer, storage and retention — and R114.2 prohibits using confidential information as well as disclosing it, so it bites even when nothing leaves the building.
§ 1 — Who it binds
Every professional accountant, in business and in public practice, whenever information acquired through a professional or business relationship is put into, held by, or used to build a technology tool. It reaches the individual rather than the platform, applies inside the employer’s own tenancy as well as outside it, and continues after the accountant changes employer. The Code takes effect through each IFAC member body that has adopted it.
§ 2 — In practice
Scope comes first, and 114.1 A1 settles it in an unexpected place. The principle is not only a duty to keep quiet about what you know; it extends to protecting information in the course of its “collection, use, transfer, storage or retention”, dissemination and lawful destruction. Read against a tool, that list is a specification. Pasting a trial balance is transfer. Whatever the platform does with it afterwards is storage and retention. Whether it is deleted, and on whose schedule, is lawful destruction. A function that has satisfied itself the supplier does not train on its data has answered one item on a list of six, and has usually answered it from a product page rather than from the executed contract — the same reading discipline customer information in AI systems demands of a supervised institution, arriving here as a personal professional duty instead.
R114.2 is the provision that catches the people who have thought about this carefully. It prohibits the accountant from disclosing confidential information and from using it for the advantage of the accountant, the firm, the employing organisation or a third party. The perimeter question — did anything leave — is therefore only half of it. A model fitted to a former employer’s management accounts, a benchmarking exercise built out of client margins, a private prompt library carrying a client’s pricing structure: none of those need involve disclosure to anyone, and every one of them is use. A technology review that asks only where data goes will not find them, which is the distinction Article 10 draws on the provider’s side, where training material is governed as an input rather than as a location.
The technology revisions added 114.3 A3, and it is the paragraph this page turns on. It addresses the case where a firm or employing organisation seeks authorisation to use or disclose confidential information, expressly naming training purposes, “the development of products or technology”, research, and use as source material for benchmarking data or studies. It then lists what should be communicated when that authorisation is obtained, preferably in writing: the nature of the information; the purpose, for which technology development is given as an example; who will undertake the activity; and whether the provider of the information, or any individuals or entities it relates to, will be identifiable from the output of the activity. That last consideration is a model-memorisation question written into an ethics code by a drafting project that closed in 2023, and it is not on the checklist of any finance function negotiating an AI contract today.
Two boundaries complete the picture. R114.3 sets out the circumstances in which disclosure or use is permitted; this page cites it by number alone, because the text reachable at research stage carried a jurisdiction-specific modification and the Council does not paraphrase a provision it has not read in the source. And R114.4 carries the duty past the end of the relationship: an accountant who moves on may use prior experience and may not use confidential information acquired in the former role. Applied to tools, that is the provision reached by a saved thread, a custom assistant or a prompt library that leaves the building on a personal account, none of which anyone treats as taking the files.
§ 3 — What a weak answer looks like
The tenancy boundary offered as the answer. The tool runs on the organisation’s enterprise licence, prompts are excluded from supplier training, and the review closes there. Section 114 asks four further questions that review never reached: on what terms was the material acquired, what use is now being made of it, how long does the platform keep it, and could anyone be identified from what comes out. A duty owed to the person whose information it is does not stop at the edge of a tenancy.
§ 4 — What discharges it
The artefacts an assessor asks to see, and what makes each one sufficient rather than merely present.
01
Written per tool: this assistant may take internal management information, that one may not take customer-identifying material. A single line forbidding “sensitive data” leaves the classification to whoever is in a hurry.
02
Naming the information, the purpose, who undertakes the activity, and whether the source or the subjects stay identifiable in what comes out. Obtained before the activity, not reconstructed after a query arrives.
03
Not from a supplier’s security page. The principle covers storage, retention and lawful destruction, so what is needed is a term somebody could enforce and a configuration that matches it.
04
Whether the people and entities the material concerns can be recovered from what the system generates. That question is separate from whether the input was ever disclosed, and it is rarely on a review checklist.
05
What a departing accountant may take with them. Prior experience travels; the material does not, and a saved thread holding a client’s pricing structure is the material.
§ 5 — When it applies
15 December 2024
Effective date of the Technology-related Revisions to Parts 1 to 3, which added 114.3 A3. An effective date for a code provision, not a statutory deadline, and it binds through the member body that adopted the revised text. The principle itself is older; no earlier date is asserted.
§ 6 — Exposure
No Code fine; disciplinary exposure through the adopting body, and separate statutory exposure
The Code sets no monetary penalty. Enforcement runs through the IFAC member body that has adopted it, which may investigate and impose sanctions running from reprimand and fine to conditions on practice and withdrawal of membership and the practising certificate. Data-protection law may attach to the same facts through a different instrument and a different enforcer; that exposure is not created by the Code and is not measured by it.
§ 7 — Worked example
A shared-services team pilots a general-purpose AI assistant on the group’s enterprise licence. To test it, an analyst pastes three months of the aged-debtor ledger — customer names, balances, disputed items and internal collection notes — and asks for a summary of collection risk. The licence terms state that prompts are not used to train the supplier’s models. The finance director approves the pilot. It is not reviewed by legal, on the footing that no data left the group’s own tenancy.
Which parts of Section 114 does the pilot engage?
More than the training question the approval turned on. The ledger is identifying information about the group’s customers, and pasting it is use and transfer whether or not it leaves the tenancy, so the principle is engaged at the first prompt. R114.2 then reaches the pilot’s own purpose: the summary is being produced for the employing organisation’s advantage, which is permissible only on the terms under which that information was acquired — a question nobody asked, because the pilot was framed as a technology decision. The 114.3 A3 considerations are unasked too. Nobody has stated the nature of the information, the purpose, who performs the activity, or whether those customers could be identified from what the assistant produces. And retention is simply unanswered: an assurance about training says nothing about how long prompts are held, or who inside the supplier can read them. None of this makes the pilot impermissible. It makes it unauthorised in the Code’s sense, which is a different and far cheaper problem to fix.
§ 8 — Elsewhere
Where another instrument addresses the same obligation. These are correspondences, not comparisons — the Council does not rank one framework against another.
MAS instruments reach customer information held by a supervised institution. Section 114 reaches the same material through the accountant handling it, and travels with that person between employers.
Article 10 governs the data a provider trains a high-risk system on. 114.3 A3 governs the authorisation an accountant needs before client or employer information becomes that data.
A correspondence indicates that two instruments address the same underlying obligation. It is not a mapping endorsed by either body, not a statement that one satisfies the other, and not a judgement about which is more demanding.
§ 9 — Where this is assessed
Examined in one credential, in the domains named on each card.
Responsible use and accountability · 15% of the paper
For finance and accounting professionals who use AI in analysis, close and reporting work — and verify the output before the numbers are relied on.
§ 10 — provenance
This page sets out what the instrument requires and what discharges it. The official text is the authority — these go straight to it.
§ 11 — Also read
Certification
What this page sets out is examined, on work the candidate has not seen, in the credential beside it. Every script is marked by an AI assessor first and an independent human assessor second, and every result is on the public register.
AIAC-FNAF
Certified AI in Finance & Accounting — Fundamentals2 hours · remote, proctored · valid 2 years