The accounting profession in New Zealand is under more operational pressure than it has been in years. Staff shortages are real - enrolments in accounting professional programmes have declined sharply, experienced practitioners are retiring faster than new ones are qualifying, and Inland Revenue's enforcement activity is expanding at the same time. In 2024 alone, IRD issued 22 interpretation and consultation notes, up from just five across the previous four years. The compliance burden on NZ accounting firms is growing, while the people available to handle it are not.
Into that environment, AI tools have arrived - and accounting staff have noticed.
According to CPA Australia's Business Technology Report 2025, 89% of organisations across the Asia-Pacific region are using artificial intelligence in some capacity. In accounting specifically, 68% of tax and accounting professionals are excited or hopeful about the future of generative AI, according to the Thomson Reuters Institute. NZ accounting firms from the Big Four to small regional practices are actively exploring AI. NBR's Accountants 2026 series documented smaller NZ firms taking significant strides toward AI adoption, with some already deploying AI agents for tax, compliance, and financial analysis work.
The problem isn't that accounting staff are using AI. The problem is that most of them are using it before governance has caught up - and the partners and directors responsible for the firm often don't know what's happening.
Shadow AI in accounting arrives the same way it does in every professional services firm: one useful tool at a time, adopted by staff who are trying to do more with less time.
A graduate accountant preparing a tax research memo uses ChatGPT to get a quick summary of the GST treatment of a complex transaction. They've used the tool dozens of times for similar tasks. The query includes the client's name, their industry, and the transaction structure. The output looks authoritative. The memo goes forward without anyone asking where the research came from.
A senior accountant drafting an advisory letter pastes the client's financial position into an AI writing tool to help structure the narrative and tone. The letter is reviewed before it goes out. The financial data that was used to generate the draft is not reviewed - it's on a third-party server, retained under terms the accountant never read.
An accounts manager uses an AI transcription tool added to Teams several months ago to produce notes from a client planning meeting. The transcript includes discussion of the client's tax strategy, personal financial position, and estate planning intentions. The transcript is stored on a US-based server. No data processing agreement exists between the firm and the tool's provider.
A partner experiments with an AI-assisted benchmarking tool on a free trial connected to their work email. The tool ingests financial data from several client files to generate comparisons. The trial terms permit the provider to use that data for model improvement.
A bookkeeper uses a public AI tool to reconcile a complex transaction set, entering account codes, descriptions, and dollar amounts for multiple client entities simultaneously. The output saves two hours. The data is now in a system the firm doesn't control.
None of these staff members were acting carelessly. Each of them found a tool that made their work faster or better and used it. The issue is that nobody in the firm has visibility into any of it - and in an industry where client financial confidentiality is both a legal obligation and the foundation of client trust, that invisibility is where the risk lives.
Before the governance conversation goes too far, it's worth being clear about what's possible when AI is used well in an accounting context - because the opportunity is real and the firms that capture it properly will be more competitive than those that don't.
Tax research - AI tools trained on legislation, case law, and IRD guidance can dramatically accelerate preliminary tax research. The critical requirement is that outputs are verified by a qualified professional before being relied upon - AI tools in a tax context have a documented tendency to generate confident-sounding but incorrect interpretations, particularly on nuanced or evolving areas of NZ tax law.
Financial statement drafting and narrative - AI-assisted drafting of management commentary, disclosure notes, and advisory narratives compresses writing time significantly. Used within a governed environment where the underlying financial data doesn't leave the firm's control, this is one of the highest-value accounting applications of AI available right now.
Compliance documentation - Anti-money laundering documentation, client onboarding materials, and standard-form compliance correspondence are all areas where AI can reduce administrative time substantially without introducing material risk - provided the tools being used have appropriate data governance.
Client communication - Drafting and refining routine client correspondence - tax reminders, engagement letters, query responses - is a legitimate and low-risk application. The correspondence still goes through professional review before it's sent.
Research summarisation - Summarising lengthy IRD rulings, court decisions, or legislative commentary for internal use is an area where AI genuinely saves time without the same confidentiality exposure as client-specific work.
Microsoft Copilot within the firm's environment - For accounting firms on Microsoft 365 Business Premium, Microsoft Copilot provides AI capability within the firm's existing data governance structure. It can assist with drafting in Word, summarising emails in Outlook, generating meeting notes in Teams, and analysing data in Excel - without sending client data to external AI models. This is the governed alternative that most firms don't yet know they already have access to.
The distinction that matters across all of these is where the data goes. AI capability within the firm's managed Microsoft 365 environment is a fundamentally different proposition from public AI tools where client financial data leaves the firm's control.
A 2025 IBM report found that 20% of surveyed organisations encountered a cyber breach due to security issues involving shadow AI. Those breaches cost an average of $670,000 more than incidents that didn't involve shadow AI. For a regional NZ accounting firm, that figure isn't an abstraction - it's the end of the business.
Client financial confidentiality - Accounting firms hold some of the most sensitive financial information that exists - client tax positions, business valuations, personal asset structures, estate planning, and in many cases information that would affect the client's commercial relationships or personal life if disclosed. When that information is processed through public AI tools, it leaves the firm's control under terms that most clients would not have agreed to if they'd been asked.
IRD and regulatory exposure - Inland Revenue's enforcement activity is increasing - $116 million in additional enforcement funding in 2024, with a stated target of $4 returned for every dollar spent. In that environment, an accounting firm whose AI-assisted advice contains an error - a misinterpreted ruling, an inaccurate calculation, a hallucinated GST treatment - faces a professional liability question that compounds the underlying client issue.
Privacy Act 2020 - Accounting firms hold significant volumes of personal financial information about individuals. Processing that information through AI tools without adequate data governance creates Privacy Act exposure that most firms haven't fully considered. The question isn't whether an AI tool is intentionally misusing the data - it's whether the firm has met its obligations around how personal information is handled.
AML/CFT obligations - Accounting firms with AML/CFT compliance obligations have specific requirements around how client due diligence information is handled and stored. AI tools used for client onboarding or verification processes that don't meet those requirements create compliance risk that the firm's AML/CFT officer may not be aware of.
Professional indemnity insurance - Most NZ accounting professional indemnity policies have clauses relating to the use of third-party systems for client work. AI tools used without appropriate assessment or approval may create coverage questions at claims time - particularly where the AI output contributed to the error being claimed against.
The hallucination problem in a tax context - AI tools are confident even when they're wrong. In a general writing context, a confident error is embarrassing. In a tax advice context, a confident error in a GST treatment, a depreciation calculation, or an interpretation of the bright-line property rules is a professional liability claim waiting to happen. The output of any AI tool used for technical tax work requires review by a qualified person who understands the underlying law well enough to catch an error - which means it can never substitute for that professional judgement, only assist it.
Inconsistent quality across the firm - Different staff using different AI tools for similar tasks produces inconsistent outputs, inconsistent review standards, and inconsistent data governance. A firm that has five different AI workflows operating without coordination has a quality assurance problem that manifests in the work before it manifests in the risk register.
A lack of clear ownership of AI tools is all too common. Very often, the use of AI tools falls into an organisational grey area where there is a lack of both accountability and responsibility.
This is precisely the challenge facing most NZ accounting firms right now. Partners know AI is being used. They may have a general sense of what tools staff are experimenting with. What most don't have is a complete picture - which tools are active across the firm, what client data is being processed through each of them, and where the governance gaps sit.
That gap is wider than most firms expect once they look properly. AI features have been progressively embedded into tools firms already use - accounting software, practice management platforms, Microsoft 365 - often activated by default through product updates without triggering any formal review. The result is AI processing happening across the firm without anyone having made a deliberate decision about it.
59% of employees use shadow AI tools at work. Among executives and senior managers, 93% say they use shadow AI tools. In accounting, where the partnership structure means senior people have significant autonomy over their own workflows, this pattern is likely to be at least as pronounced as in other industries.
Visibility comes before policy. Understanding what's actually happening - which tools are in use, what data they're processing, where the configuration gaps sit in the firm's Microsoft 365 environment - is what makes subsequent policy and governance decisions genuinely informed rather than aspirational.
Accounting firms that have approached AI governance well share a consistent pattern: they started with understanding the current state rather than immediately building policy.
They found out what AI tools were in use across the firm - not by asking staff to declare tools they might assume aren't approved, but by gaining technical visibility into the applications and services connecting to their environment. They reviewed their Microsoft 365 configuration to understand which AI features were active and whether the firm's data governance settings were appropriate. They identified which tools had data processing agreements compatible with their client confidentiality obligations and which didn't.
From that foundation, the governance structure followed naturally:
An approved tool list that makes the decision once rather than leaving each staff member to make it independently. When staff know which tools are approved and what they're appropriate for, they use them consistently rather than defaulting to whatever they found most recently.
A simple, readable AI policy covering what data can and can't be used with AI tools, what review requirements apply to AI-assisted work before it reaches a client, and how new tools get assessed and approved. Practical enough that staff will actually follow it, not a compliance document that lives in a folder.
Staff education that's specific to accounting work - the tax hallucination risk, the confidentiality implications of client data leaving the firm's environment, the professional indemnity context. General AI awareness training doesn't address the specific risks that accounting professionals face.
Microsoft Copilot as the governed alternative - positioned not as a restriction but as the tool that lets staff capture the productivity gains they're looking for without the data governance risk. A staff member who has access to a capable, approved AI tool within their existing Microsoft 365 environment has less reason to reach for a public tool for the same task.
Executive visibility - a clear, periodic picture of how AI is being used across the firm, what the governance posture looks like, and where the risks sit. For most NZ accounting firms, this is the piece that's currently missing. Partners know AI is happening; they don't have a dashboard that tells them where and how.
If your firm hasn't yet taken a structured approach to AI governance, the starting point isn't writing a policy - it's understanding the current picture.
Most NZ accounting firms that begin this process are surprised by what they find. Not because staff have been doing something they knew was wrong, but because the tools move faster than the conversations, and the gap between what's in use and what's governed is wider than anyone expected.
NSP's approach starts with exactly that visibility exercise - mapping the current state of AI adoption across the firm's Microsoft 365 environment, identifying shadow AI exposure, and reviewing configuration and governance posture before any policy or programme work begins. For accounting firms specifically, that exercise surfaces the client confidentiality, IRD compliance, and professional indemnity implications that generic AI governance frameworks don't account for.
For firms ready to go further, NSP's Secure AI Accelerator provides a structured 12-month programme covering AI enablement, security, governance, and ongoing optimisation - with executive reporting that gives firm leadership a documented, evidenced picture of AI governance maturity over time. The programme is built on the same foundation: understand the current state first, then build governance that reflects what's actually happening rather than what policy documents assume.
The accounting firms that will use AI most effectively aren't the ones that banned it or the ones that let it run ungoverned. They're the ones that found out what was already happening, made deliberate decisions about how it should work, and gave their staff the tools and guidance to use AI as a genuine competitive advantage rather than a professional liability.
If you're not sure how much AI is already in use across your firm's Microsoft 365 environment, that's the question worth starting with. NSP can help you understand your current shadow AI exposure and governance readiness before you begin building policies or wider AI initiatives.
Talk to NSP about AI governance for your firm →
Or call us: 0508 010 101
What is shadow AI in an accounting firm? Shadow AI refers to AI tools being used by accounting staff without formal approval, oversight, or governance from the firm's management or IT function. This typically includes public tools like ChatGPT being used for tax research, document drafting, or financial analysis, as well as AI features embedded in existing software that were activated without a formal review. In accounting, shadow AI is particularly significant because of the client financial confidentiality obligations and professional indemnity implications that apply to the work.
What are the risks of shadow AI for NZ accountants? The primary risks include client financial data being processed through public AI tools with permissive data handling terms, AI hallucination producing inaccurate tax or financial analysis, Privacy Act 2020 obligations being breached, professional indemnity coverage implications, and AML/CFT compliance gaps. Shadow AI breaches have been found to cost significantly more than standard cyber incidents due to the difficulty of containing damage across distributed, ungoverned AI usage.
Can NZ accounting firms use AI safely? Yes - with appropriate governance. The critical distinctions are whether client and financial data stays within the firm's governed environment, whether AI outputs are reviewed by a qualified professional before being relied upon, and whether the tools in use are compatible with the firm's confidentiality and compliance obligations. Microsoft Copilot within a properly configured Microsoft 365 environment is the most common example of governed AI use in an accounting context.
What should a NZ accounting firm do about shadow AI? The first step is gaining visibility - understanding what AI tools are actually in use, including AI features embedded in existing practice management and productivity software. From that foundation, firms can develop a practical AI policy, build an approved tool list, deliver staff training specific to accounting risk contexts, and implement Microsoft Copilot as a governed AI alternative.
How does Microsoft Copilot differ from public AI tools for accounting firms? Microsoft Copilot operates within the firm's existing Microsoft 365 data governance environment - it doesn't send client data to external AI models, and it respects the firm's existing permissions and access controls. This makes it fundamentally different from public tools like ChatGPT in terms of data governance risk. For NZ accounting firms on Microsoft 365 Business Premium, Copilot capability is already included in the licence - most firms are paying for it and haven't yet activated it in a governed way.