AI for Finance & Accounting

Module 10: Compliance and Limitations

---

Module Overview

AI offers real benefits, but finance professionals must understand its limitations, navigate regulatory considerations, and maintain ethical standards. This final module addresses the boundaries and responsibilities of using AI in finance.

Learning Objectives:

By the end of this module, you will be able to:

• Navigate regulatory considerations for AI in finance
• Manage ethical obligations when using AI
• Understand and communicate AI limitations
• Develop AI governance frameworks
• Use AI responsibly in professional practice

Estimated Time: 30-45 minutes

---

10.1 Understanding AI Limitations

Core Limitations of AI

1. Knowledge Cutoff AI models are trained on data up to a certain date. On its own training data alone, a model does not know about:

• Recent law changes
• Current market conditions
• New regulations
• Breaking news
• Events after training

Most assistants now search the web to fill that gap, so the answer you get may well be current. But searching introduces its own problem: the model is now repeating a source it found, and that source can be wrong, outdated, or the wrong jurisdiction. A confident answer with a link is still not verification.

Implication: Ask where the answer came from and check the source yourself. For tax, regulatory, and market-sensitive matters, confirm against the primary source, such as the tax authority, the standard, or the filing.

2. Hallucinations AI can generate plausible-sounding but incorrect information:

• Fabricated citations
• Wrong numbers
• Non-existent regulations
• Fictional precedents

Implication: Verify all factual claims, citations, and technical assertions independently.

3. Context Limitations AI knows what you give it access to, and nothing beyond that.

You can now give it a lot. You can upload statements, invoices, contracts, and spreadsheets directly. Many tools also connect to a document store such as SharePoint, Google Drive, or OneDrive, and read from it. Copilot reads the workbook you already have open.

What stays true is everything you have not connected or said:

• It does not know your firm's policies unless you tell it
• It does not know your client's history or intentions
• It does not see systems you have not connected, such as your ledger or practice management software
• It does not know the unwritten context behind a number, like why a provision was set the way it was

There is a second trap once you connect a source. The model can only see what it retrieved, and it rarely tells you what it missed. If it reads three of the twelve files in a folder, the answer will still sound complete.

Implication: Connect the real source instead of retyping it, then check what it actually used. Ask which documents it read and confirm the list matches what you expected.

4. Mathematical Unreliability This one has changed, and the distinction now matters more than the warning.

When a model answers a number from the text it is predicting, it is guessing at a plausible figure. That is genuinely unreliable and always has been. But assistants can now write and run code to do the calculation, and code does arithmetic exactly. A sum computed that way is not a guess.

So the question is no longer "can AI do math". It is did it compute this, or did it assert it?

• If you can see the code it ran, the arithmetic is sound
• If a number appears in prose with no visible calculation, treat it as a guess
• Ask it to compute rather than estimate, and to show the working

What code execution does not fix is the input and the choice of method. If you hand it the wrong column, a stale export, or ask for the wrong ratio, it will compute a precise and confidently wrong answer. Precision is not correctness.

Implication: Make it calculate rather than assert, and check the inputs and the method rather than the arithmetic. For anything that lands in a filing or a client deliverable, tie the figure back to source.

5. No Professional Judgment AI cannot:

• Assess materiality
• Evaluate risk appropriately
• Make ethical determinations
• Take professional responsibility
• Understand nuanced professional standards

Implication: You must apply professional judgment to all AI outputs.

---

10.2 Professional Standards and Ethics

Your Professional Responsibility

Using AI doesn't change your professional obligations:

Competence:

• You must be competent to evaluate AI output
• AI doesn't substitute for your expertise
• You need knowledge to identify errors
• Continuing education remains essential

Due Professional Care:

• Review AI work as you would review staff work
• Maintain appropriate skepticism
• Verify significant items
• Document your review process

Integrity:

• Be honest about how work was produced
• Don't represent AI work as independent analysis
• Acknowledge limitations when relevant
• Maintain trust with clients and stakeholders

Confidentiality:

• Protect client data when using AI
• Understand AI tool data policies
• Use appropriate security measures
• Don't share sensitive information unnecessarily

Professional Body Guidance

General Principles from Professional Bodies:

• AI should augment, not replace, professional judgment
• Practitioners remain responsible for work product
• Data security and confidentiality must be maintained
• Transparency about AI use may be appropriate
• Continuing competence in AI is encouraged

---

10.3 Regulatory Considerations

Data Privacy Regulations

Privacy laws differ by country and region. Examples include GDPR in the EU and the CCPA in California. Whatever law applies to you, the same habits help:

Privacy Considerations:

• Be mindful of personal data in AI prompts
• Understand where data is processed
• Consider data retention policies
• Ensure appropriate consent exists
• Document data handling practices

Best Practices:

• Use enterprise AI tools with privacy commitments
• Avoid including unnecessary personal data
• Anonymize data when possible
• Understand cross-border data implications

Industry-Specific Regulations

The regulators below are US examples. Most countries have their own financial, banking, audit, and tax regulators with similar concerns. Check the rules and guidance that apply in your own jurisdiction.

Financial Services (US examples):

• SEC and FINRA guidance on AI use
• Model risk management requirements
• Fair lending considerations
• Consumer protection requirements

Banking (US examples):

• OCC guidance on AI/ML
• BSA/AML implications
• Safety and soundness considerations

Audit (US example):

• PCAOB considerations for AI in audit
• Documentation requirements
• Quality control implications

Tax (US examples):

• IRS considerations for AI in tax practice
• Circular 230 obligations
• Due diligence requirements

Staying Current

Regulatory landscape is evolving. Stay current through:

• Professional body communications
• Industry publications
• Regulatory updates
• Peer discussions
• Continuing education

---

10.4 Confidentiality and Data Security

Protecting Client Information

Before Using AI with Client Data:

1. Understand the AI tool's data policies
2. Determine if data is used for training
3. Consider data residency requirements
4. Evaluate encryption and security
5. Check for relevant certifications

Risk Mitigation Strategies:

• Use enterprise versions with privacy commitments
• Minimize sensitive data in prompts
• Anonymize when possible
• Avoid sharing unless necessary
• Document your data handling decisions

Creating Safe Practices

Template for Data Handling Policy:

Help me create guidelines for using AI with client data.

Our practice involves:
- [Types of clients]
- [Types of data we handle]
- [Regulatory requirements]

Create guidelines covering:
1. What data can/cannot be shared with AI
2. Anonymization requirements
3. Approved AI tools and settings
4. Documentation requirements
5. Client consent considerations

Enterprise vs. Consumer AI Tools

Feature	Consumer AI	Enterprise AI
Data training	May use your data	Typically doesn't
Retention	Varies	Configurable
Privacy	Limited guarantees	Contractual commitments
Compliance	Basic	Enhanced certifications
Cost	Free/Low	Higher

Recommendation: Use enterprise tools for client work; reserve consumer tools for personal learning or non-sensitive tasks.

---

Try it: remove client data before you ask

The client in this exercise is made up, so it is safe to run here. In real work, never paste a note like this into an AI tool your firm has not approved.

Step 1. Run the starter prompt. Press Run with AI and read the answer. You may need to sign in first.

Step 2. Improve it and compare. Now make the prompt safe to use with real client data. The box below has the same prompt. Edit it there, so both answers stay on the page. Add these three things:

• Remove identifiers: replace the name with [Client] and the employer with [Employer]. Delete the client ID, the date of birth and the address. If age matters for the rules, write an age range instead.
• Keep what matters: the amounts, the types of income, the house move and the home working.
• A check step: "If you use any number, show how you got it. State any assumption about the tax rules."

What a good result looks like

• Both answers raise about the same questions: how the freelance income is reported, whether the pension payment gets tax relief, whether home working costs can be claimed, and whether the move changes anything.
• Your cleaned prompt has no name, ID, date of birth or address. The answer is as useful without them.
• If the AI adds up income, it gets 64,000 + 8,500 = 72,500.

Double-check this: if the AI says taxable income is 70,400, it took 72,500 - 2,100 and assumed the pension payment can be deducted. That depends on the rules where the client is taxed. Ask it to state the assumption, or remove the figure. Then read your cleaned prompt once more before you run it. Removing data is the step people forget.

---

10.5 Transparency and Disclosure

When to Disclose AI Use

Consider Disclosure When:

• Clients specifically ask about your processes
• Engagement letters address methodology
• AI significantly shaped deliverables
• Professional standards require it
• Trust and transparency are valued

Disclosure May Not Be Needed When:

• AI is used like any other tool (spellcheck, research)
• Work is thoroughly reviewed and validated
• Professional judgment is clearly applied
• AI served only as an efficiency aid

How to Communicate About AI

To Clients:

When asked about AI use, I explain:

- AI tools help us work more efficiently
- All AI output is reviewed and validated
- Professional judgment guides all conclusions
- We maintain appropriate confidentiality
- Our responsibility for the work remains unchanged

In Engagement Letters: Consider adding language about technology use if appropriate for your practice.

---

10.6 Building AI Governance

Governance Framework Elements

1. Policy:

• Approved AI tools and uses
• Prohibited applications
• Data handling requirements
• Review and approval processes

2. Training:

• Required AI competencies
• Ongoing education
• Best practice sharing
• Error learning

3. Quality Control:

• Review requirements
• Documentation standards
• Error tracking
• Continuous improvement

4. Risk Management:

• Risk assessment for AI use
• Incident response
• Escalation procedures
• Regular review

Sample Governance Policy

Help me draft an AI governance policy for a [firm type].

Key areas to address:
1. Approved AI tools
2. Acceptable use cases
3. Prohibited applications
4. Client data handling
5. Review requirements
6. Training requirements
7. Documentation standards
8. Compliance monitoring

Format: Policy document with clear sections

Implementation Checklist

Create an AI governance implementation checklist.

Firm context: [Size, type, services]

Checklist should cover:
□ Policy development
□ Tool selection and approval
□ Training program
□ Quality control procedures
□ Documentation requirements
□ Compliance monitoring
□ Regular review schedule

---

10.7 The Responsible AI Mindset

Principles for Responsible Use

1. Human-Centered:

• AI serves professionals and clients
• Humans remain accountable
• Technology enhances, doesn't replace, judgment

2. Quality-Focused:

• Maintain high standards regardless of AI use
• Don't let efficiency compromise quality
• Review rigorously

3. Transparent:

• Be honest about AI use when appropriate
• Acknowledge limitations
• Maintain trust

4. Secure:

• Protect confidential information
• Use appropriate tools and settings
• Follow data handling best practices

5. Evolving:

• Stay current with developments
• Adapt practices as technology and guidance evolve
• Continue learning

Self-Assessment Questions

Regularly ask yourself:

• Am I using AI appropriately for this task?
• Have I reviewed the output thoroughly?
• Would I be comfortable explaining my process?
• Am I maintaining professional standards?
• Is client confidentiality protected?
• Am I staying current with best practices?

---

10.8 Looking Ahead

The Evolving Landscape

AI in finance will continue to evolve:

• More capable tools
• Better integration with workflows
• Clearer regulatory guidance
• Industry best practices
• New opportunities and challenges

Preparing for the Future

Stay Current:

• Follow professional body guidance
• Monitor regulatory developments
• Learn from peers and industry leaders
• Continue building AI skills

Stay Grounded:

• Professional judgment remains essential
• Fundamentals don't change
• Client service is paramount
• Ethics guide all decisions

Stay Adaptive:

• Embrace beneficial change
• Adjust practices as appropriate
• Balance innovation with prudence
• Lead by example

---

Module 10 Summary

Key Takeaways:

1. Know the limitations: AI can hallucinate, only sees what you connect or tell it, and has no professional judgment. It can calculate reliably when it runs code, so check whether a number was computed or asserted, and check the inputs either way.

2. Maintain professional standards: Your obligations for competence, due care, integrity, and confidentiality remain unchanged.

3. Navigate regulations carefully: Understand data privacy requirements, industry-specific rules, and evolving guidance.

4. Protect confidentiality: Use appropriate tools, minimize data exposure, and maintain security.

5. Build governance: Develop policies, training, quality control, and risk management for AI use.

---

Wrapping Up This Module

This module covered the limits of AI and the rules around using it. AI is a useful tool, but it does not replace your expertise. You still own the judgment, the checks, and the final work. Professionals who use AI well and keep high standards will add real value to their clients and teams.

In the final lesson, The Road Ahead, you'll review the whole course and plan your next steps.

---

"AI doesn't replace professionals. It shows who takes their profession seriously."