AI in finance and accounting
The Code is comply or explain: a company may depart from Provision 29 and must then explain the departure in its annual report. What it asks for is a declaration, by the board, that the company’s material controls were effective as at the balance sheet date. Where one of those controls runs on a model that changes between balance sheet dates, that is the collision this page is about.
§ 1Who it binds
Companies listed in the commercial companies category or the closed-ended investment funds category, whether incorporated in the United Kingdom or elsewhere. The duty is the board’s and the company’s — the Code places nothing on an individual accountant, and no finance professional is personally answerable under it. It is comply or explain: departure is permitted and must be explained in the annual report.
§ 2In practice
Provision 29 is free to read and carries no reproduction bar, so here it is exactly. The board "should monitor the company’s risk management and internal control framework and, at least annually, carry out a review of its effectiveness. The monitoring and review should cover all material controls, including financial, operational, reporting and compliance controls." It then asks the board to provide three things in the annual report: a description of how it has monitored and reviewed the framework’s effectiveness; "a declaration of effectiveness of the material controls as at the balance sheet date"; and a description of any material controls which have not operated effectively as at that date, the action taken or proposed to improve them, and any action taken to address previously reported issues.
None of that is a requirement, and getting this right is the difference between a useful page and a wrong one. The Code operates on comply or explain. A company may depart from Provision 29 and report that it has done so, with an explanation; what follows is shareholder and FRC scrutiny of the explanation, not a sanction, because the Code carries none. It is frequently written about as the United Kingdom’s Sarbanes-Oxley and it is not: there is no personal certification, no securities-regulator enforcement, and nothing equivalent to the auditor attestation an accelerated filer carries. The consequence of a thin declaration is disclosure and what the market makes of it, and for a listed board that is not nothing.
The declaration is fixed to a moment — as at the balance sheet date — and that is what makes an AI-operated control awkward. A model-based control does not have a state at a date; it has a trajectory. Its behaviour on 31 December is a function of the version in service that week, the retrieval data behind it, the thresholds someone set in August, and whatever the supplier shipped in the meantime. A board declaring effectiveness at a date is attesting, at a point in time, to something that moves continuously. That is the same mismatch the US quarterly change disclosure runs into at deploying an AI tool mid-year, reached from the opposite direction.
Read the scope words carefully, because they are wider than most finance readers assume. Provision 29 reaches all material controls "including financial, operational, reporting and compliance controls". A tool that never touches the ledger — one that drafts regulatory returns, screens counterparties, or assembles narrative sections of the annual report — is inside the framework the board reviews if the control it sits in is material. Materiality here is the board’s own determination, made when it settles the material controls list, and that determination is where the AI question belongs. It is also the only place it can be asked annually, which is the other awkwardness: the review cadence is yearly and the reliance question arises every time the tool runs.
§ 3What a weak answer looks like
The declaration assembled from control owners’ certifications. Each owner confirms their control operated effectively, the confirmations are aggregated, and the board signs. For a manual control that chain carries real information, because a person is asserting something they did. For an AI-operated control the owner is usually confirming that the tool ran and the exceptions were cleared, which is a statement about availability rather than effectiveness — and it is made by the person least likely to have been told that the supplier changed the model in November.
§ 4What discharges it
The artefacts an assessor asks to see, and what makes each one sufficient rather than merely present.
01
The board’s own determination of what is material, and a flag against every control where a model produces or clears part of the work. A list that does not distinguish them cannot support a declaration that considered them.
02
The version, configuration and thresholds in service on the date, and a test performed against that configuration. Aggregate annual results describe a period; the declaration is fixed to a day.
03
Every change to the model, prompt, retrieval source or threshold, dated, with who authorised it. A control that changed three times in the year is three controls, and the declaration has to know which one it is about.
04
Not the declaration, which appears in the annual report, but the paper that went to the board and the discussion it produced. An assessor asks what the board was told about the AI-operated controls before it signed.
05
Where a control failed: the description, the remedial action taken or proposed, and the position on issues reported the previous year. The Provision asks for this, and a silent report implies it did not arise.
06
Comply or explain means departure is available and has to be explained. The artefact is the reasoning, prepared alongside the declaration rather than after a shareholder asks for it.
§ 5Worked example
A listed group’s material controls list includes a quarterly completeness control over revenue: an AI tool reads contract documents, extracts performance obligations, and flags contracts whose recognised revenue does not reconcile to the extracted terms. The tool was procured in March and the supplier upgraded the underlying model in November. The audit committee papers for the year end record that the control operated with no exceptions in the fourth quarter.
Can the board declare this control effective as at 31 December?
It can — comply or explain does not require a clean declaration, and a board that has done the work may say so. But the November upgrade means the control operating in the fourth quarter is not the control that operated in the second, and nothing in the papers says which one the no-exceptions result belongs to. Three things would make the declaration defensible. First, a record of what changed in November, when the group learned of it, and what it did to satisfy itself the extraction still performed on its own contract population rather than on the supplier’s. Second, evidence at the date rather than across the year: the version in service on 31 December, and a re-performance on a defined sample of fourth-quarter contracts. Third, an honest answer on the third limb — if the group cannot establish that the upgraded control operated effectively, the Provision asks it to describe that, the action taken and the action proposed. Describing a control that did not operate effectively is compliance with Provision 29. Declaring one effective on evidence predating the model it now runs on is not.
§ 6Elsewhere
Where another instrument addresses the same obligation. These are correspondences, not comparisons — the Council does not rank one framework against another.
Finance and accounting standards
COSO Principle 10, read with the 2026 generative-AI paper, supplies the working test for whether a person stands behind an AI-assisted control. That test is what a balance-sheet-date declaration has to rest on.
Clause 9.1 places a monitoring and evaluation duty inside an AI management system. Where one is in place, evidence a board needs at the balance sheet date is already produced on a defined cadence.
A correspondence indicates that two instruments address the same underlying obligation. It is not a mapping endorsed by either body, not a statement that one satisfies the other, and not a judgement about which is more demanding.
§ 7When it applies
1 January 2026
Provision 29 applies for accounting periods beginning on or after 1 January 2026. This is an accounting-period date, not a filing deadline: a company with a December year end first declares under it for the year ending 31 December 2026.
1 January 2025
The rest of the UK Corporate Governance Code 2024 applies for accounting periods beginning on or after 1 January 2025. The Code was published on 22 January 2024; publication and application are separate dates, and only the second governs a company.
§ 8Where this is assessed
Examined in 2 credentials, in the domains named on each card.
Close and reconciliation support · 20% of the paper
For finance and accounting professionals who use AI in analysis, close and reporting work — and verify the output before the numbers are relied on.
Accountability to auditors, committees and regulators · 15% of the paper
For senior finance and accounting professionals who set the terms on which AI is used across a finance function — and answer for the estimates, controls and disclosures it touches.
§ 9provenance
This page sets out what the instrument requires and what discharges it. The official text is the authority — these go straight to it.
§ 10Also read
Certification
What this page sets out is examined, on work the candidate has not seen, in the credentials beside it. Every paper is machine marked against its key and every result is reviewed and released by a named person, and every credential is on the public register.
AIAC-FNAF
Certified AI in Finance & Accounting, Fundamentals2 hours · remote, proctored · valid 2 years
AIAC-FNAP
Certified AI in Finance & Accounting, Professional2 hours · remote, proctored · valid 2 years
Ten questions on using AI at work. About two minutes, free. You finish as one of six types, with a card to share.
SHARE BY 31 DECEMBER, US$199 FEE WAIVED
A free quiz from the AI Assurance Council. Not a certification.