AI policy vs. AI governance controls: the difference that matters after the document is signed.
For CPA, tax, bookkeeping and advisory firms, a written AI policy is an important starting point. The next question is operational: can the firm show that its rules are actually being followed?
| Policy answers… | Operating controls answer… |
|---|---|
| What AI use is allowed? | Which tools and use cases are currently approved, by whom, and when reviewed? |
| What data is prohibited? | How does the firm document incidents, exceptions and remediation when the rule is broken? |
| Human review is required. | Who reviews which categories of work before client delivery or final decision? |
| Vendors must meet standards. | Where is the vendor diligence record and when is it refreshed? |
| The policy is reviewed periodically. | Who owns the review cadence and what evidence shows it happened? |
Why this gap is showing up in 2026
AICPA published a Small Firm Generative Artificial Intelligence Policy Template in April 2026. Intuit followed with guidance focused specifically on AI governance for tax and accounting firms in June 2026. The direction is clear: the profession is moving beyond casual experimentation and toward documented governance.
A good policy can define the rules. But a firm still needs repeatable controls around tools, vendors, client data, review, incidents, evidence and ownership.
A lightweight governance stack for a small or midsize firm
- Policy: approved use, prohibited use, confidentiality and human-review standards.
- Tool register: every approved AI tool or embedded AI feature and its owner.
- Vendor review: a repeatable review of data handling, retention, training use, security and contractual terms.
- Usage register: important use cases, responsible users and review expectations.
- Incident log: exceptions, data exposure concerns, unreliable outputs and corrective action.
- Review cadence: periodic leadership review with dated evidence and named ownership.
Close the gap with the AI Governance Control Pack
Ops Control HQ built the pack for organizations that need practical operational governance around AI use—not another subscription and not just a policy memo.
$49 one time. Secure Stripe checkout and fulfillment using the checkout email.
Get the AI Governance Control Pack — $49The test
If a client, insurer, partner or reviewer asked tomorrow, “Show me how your firm governs AI,” could you produce current evidence of approved tools, vendor review, usage boundaries, human review, exceptions and ownership?
If the answer is “we have a policy,” but the rest lives in email, memory or scattered documents, the policy is ahead of the operating system.