AI and client confidentiality in the UK: what ICAEW, the SRA and the ICO expect from accountants and solicitors

Accountants and tax advisers

Confidentiality is one of the five fundamental principles of the ICAEW Code of Ethics (subsection 114). In November 2026 ICAEW's Regulation & Conduct team reminded firms that confidentiality duties still apply when using AI, that entering client data into public AI tools can risk unauthorised disclosure, and that firms are expected to have policies covering generative AI and its confidentiality risks (ICAEW, 9 November 2026). An earlier ICAEW notice was blunter: if the information you are about to input includes client data, it's very likely to breach client confidentiality (ICAEW, February 2024).

For tax work, the seven Professional Conduct in Relation to Taxation bodies (including ICAEW and ICAS) published AI guidance in January 2026: inputting a client's data into a publicly available AI model without their consent is likely to constitute a breach of client confidentiality (ICAEW Insights, 19 January 2026). ACCA and the other bodies whose codes follow the IESBA Code apply the same confidentiality principle.

Solicitors in England, Wales and Scotland

The SRA Code of Conduct requires solicitors to keep the affairs of current and former clients confidential. The Law Society of England and Wales' guide Generative AI: the essentials asks firms to consider what input data they are likely to use and whether it is appropriate to put it into the tool. In Scotland, the Law Society of Scotland's Guide to Generative AI (October 2024) covers the issues generative AI poses for client confidentiality, information security and data protection.

UK GDPR: pseudonymised data is still personal data

Under article 4(5) and recital 26 of the UK GDPR, pseudonymised data that can be re-attributed with additional information is still personal data. The ICO's guidance on anonymisation and pseudonymisation (published 28 March 2025) makes the same distinction. That is why Velado calls what it does pseudonymisation: in your hands, with the key, the file is still personal data. What changes is what the AI provider receives: codes instead of identities, and no key to reverse them.

A practical routine for UK firms

1. Write it down. ICAEW expects a policy on generative AI. Say which tools are approved and for what.
2. Use a business AI account with a data processing agreement and training switched off.
3. Remove identifiers before upload: names, NI numbers, UTRs, company and VAT numbers, sort codes and account numbers, postcodes and addresses.
4. Keep the key on your computer, never in the chat.
5. Review the output with professional scepticism, then restore the real names locally.
6. Tell clients in your engagement letter how you use AI.

What Velado detects in UK documents

National Insurance numbers (with prefix rules), UTRs, Companies House numbers, GB VAT numbers, sort codes and account numbers, UK postcodes, UK mobile and landline numbers, English-style street addresses, names after "Client:", "Director:", "Tenant:" and similar, plus IBANs, cards and emails.

Price in GBP

• Individual, 1 user: £129 per year
• Firm, up to 5 users: £449 per year
• Firm+, up to 15 users: £990 per year

Prices exclude VAT and sales tax. Free public beta until 31 January 2027, then a 14-day free trial. All plans.

This page summarises public guidance for information only. It is not legal advice; check your professional body's current rules.