This article will count 0.25 units (15 minutes) of unverifiable CPD. Remember to log these units under your membership profile.
AI is already part of the working day in many practices, often before anyone has decided how it should be used. A staff member pastes a client email into a chatbot to draft a reply, a bookkeeping package suggests how to categorise transactions, and a trainee asks an AI tool to explain a tax provision. A short written AI policy sets the rules for all of this, and the OECD AI Principles give you a ready-made structure for one, so you do not have to start from a blank page.
The Organisation for Economic Co-operation and Development (OECD) adopted the AI Principles in May 2019 as the first intergovernmental standard on AI, and its adherents updated them in May 2024. Forty-seven governments adhere to them. South Africa is not one of them, but as a G20 member it has committed to the G20 AI Principles, which were drawn from the OECD text. Five of the principles apply to "AI actors", meaning anyone who develops, deploys or operates an AI system, and that includes a firm that uses AI tools in client work.
Why this matters for your firm
When you sign off financial statements, prepare a tax return or give advice, you remain responsible for the work whether a junior, a template or an AI tool produced the first draft. A policy turns that responsibility into rules your staff can follow, and it gives you something to show a client or auditor who asks how AI is used on their work. The Protection of Personal Information Act (POPIA) also applies to client personal information entered into an AI tool, so the policy is a practical way to show how you protect it.
The draft national AI policy shows what can go wrong without that oversight. On 26 April 2026, the Minister of Communications and Digital Technologies, Solly Malatsi, withdrew South Africa's draft National Artificial Intelligence Policy after his department confirmed that its reference list included sources that did not exist. He said the lapse "proves why vigilant human oversight over the use of artificial intelligence is critical" and announced consequence management for those responsible for drafting and quality assurance.
AW looked at who carries the blame when AI gets something wrong in Who's responsible when AI gets it wrong? A written policy is how a firm makes sure that question has a clear answer before it is asked.
Turning each principle into a policy clause
Each OECD principle below is followed by sample wording for your policy. Adapt it to your firm's size, services and tools.
1. Inclusive growth, sustainable development and well-being: why you use AI
The OECD asks that AI benefit people and society. For a firm, this becomes the purpose of the policy.
Sample clause: We use AI to reduce routine work so that staff can spend more time on review and client advice. AI may not be used in a way that lowers the accuracy or quality of our work.
2. Human rights and democratic values, including fairness and privacy: client data
The OECD asks that AI respect people's rights, treat them fairly and protect their privacy. For a firm, the main risk is client information leaving your control.
Sample clause: Staff may enter client information only into tools on the approved list. Identifying details are removed where the task does not need them. All use of AI must comply with POPIA and our confidentiality obligations.
3. Transparency and explainability: explaining the output
The OECD asks AI actors to help people understand what a system can and cannot do, and to explain its outputs in plain language where feasible.
Sample clause: No AI output is used unless the person relying on it can explain how the result was reached. Where AI materially shaped advice or work a client relies on, the responsible partner or manager decides whether to tell the client.
4. Robustness, security and safety: review in proportion to risk
The OECD asks that AI systems work reliably and can be "overridden, repaired, and/or decommissioned safely as needed".
Sample clause: Low-risk uses, such as summarising a meeting or drafting internal notes, are checked by the user. High-risk uses, such as posting journals, preparing statutory submissions or giving financial advice, need approval from a named person before the output is used. Any tool may be suspended if it produces unreliable results.
5. Accountability: ownership and records
The OECD asks AI actors to be accountable for how AI systems function, to keep records of datasets, processes and decisions, and to manage risk throughout.
Sample clause: The person who signs off the work is responsible for any AI-assisted content in it. For material AI use, the file records the tool, the task, the information provided, the output and the reviewer. [Name or role] owns this policy and reviews it every [12 months].
Practical tips: putting the policy in place
Find out what is already in use. Ask staff which AI tools they use and for what tasks before you write anything, so the policy deals with real practice.
Build the approved tools list. For each tool, check the provider's terms on where data is stored, whether it is shared and whether it is used to train the provider's models.
Keep it short. One or two pages, using the five clauses above as headings, is enough for most practices.
Sort your common tasks by risk. List the tasks staff actually use AI for and mark each as low or high risk, so the review rule is clear in practice.
Train staff and get sign-off. Walk the team through the policy, ask each person to confirm they have read it, and add a line on AI use to your engagement file checklist.
Review it regularly. Revisit the policy at least once a year, and whenever you adopt a new tool or the rules on AI or data protection change.
Further learning
CIBA has two self-paced online short courses for accountants who want to build these skills, both open to accountants regardless of professional body.
AI skills for the modern accountant runs across three levels, from AI foundations to AI strategy for finance leaders, and is grounded in SARS requirements, POPIA, the Companies Act, IFRS for SMEs and the CIBA Code. It carries 10 CPD units.
The 28-Day AI Challenge for the Southern African Accountant sets a 15 to 20 minute task each day for four weeks, each with a judgement check and a ready-to-use prompt, and includes a data-security annexure. It carries 10 CPD units.
Trending
