Your quality management system now has to account for technology. Your state board is publishing AI guidance. Your malpractice carrier wants to see a policy. Your clients are asking how their data is handled. AboveBoard turns those questions into forty controls, a verified 0–100 score and a badge you can show, without a consultant and without calling it something it is not.
SQMS No. 1 took effect December 15, 2025 and requires every firm to identify and respond to quality risks, including those arising from technology resources (Journal of Accountancy, Aug 2025). The Texas State Board of Public Accountancy's August 2026 newsletter states that AI-generated analyses do not constitute audit evidence, calls confidentiality the most significant AI risk, and recommends formal firm AI policies covering approved tools, restrictions, review procedures, documentation and training. PCAOB staff observations (Jul 2024) found firms citing the need for strong supervision.
CAMICO, the CPA-owned professional liability carrier, published guidance on May 3, 2026 recommending an AI governance framework, vendor due diligence, documented training, bias reviews for any AI used in HR decisions, and engagement-letter transparency (CalCPA, May 2026). Across professional lines, ISO introduced a generative-AI exclusion for general liability policies in January 2026 and several carriers have added AI questionnaires at renewal (Fenwick, Jun 2026).
IRC section 7216 restricts how tax return information may be used or disclosed by a preparer, and the FTC Safeguards Rule requires a written information security plan for tax professionals. Neither mentions AI, and both apply to it. Pasting a K-1 into a consumer chatbot that retains inputs is a data-handling decision your policy has to have made in advance.
More than half of corporate tax and legal departments want their outside firms to use AI, but fewer than one in three know whether they do (Thomson Reuters, Mar 2026), so procurement is adding AI sections to vendor questionnaires. When a CPA regulator said it could not investigate Deloitte Canada's $1.6M AI-tainted report because the work was consulting, not public accounting (Canadian Accountant, Aug 2026), clients started asking who is watching.
Microsoft 365 Copilot, ChatGPT, Claude and Gemini for drafting client letters, summarizing guidance, cleaning up memos and building spreadsheets. Often on personal accounts unless the firm has said otherwise.
AI features inside tax research platforms and preparation software, from question-answering over primary sources to draft return review. Usually enterprise-licensed, and usually the tools with the best contractual terms.
Meeting transcription in Teams and Zoom, AI-assisted bank-feed categorization, document extraction, audit analytics and client portals with AI chat. Each one touches client data, and each belongs in your inventory.
Every firm answers the same forty questions. Here is what the evidence looks like when the firm does tax, audit, advisory and client accounting.
A written AI policy approved by the partners, a named owner (often the quality management or risk partner) with authority to stop a tool, an inventory of AI tools and use cases, and AI on the quarterly partner agenda.
Evidence examples: the SQMS 1 risk assessment entry that names AI tools as a technology resource and the response designed for it; a partner resolution naming the AI owner; the AI register showing which tools are used in tax, audit and advisory.
A classification that tells staff what may never be entered into an AI tool (Social Security numbers, returns, trial balances, anything covered by section 7216), an approved-tools list, enterprise terms with no-training clauses, managed logins and retention settings.
Evidence examples: a one-page data classification with tax-specific examples; the vendor terms review log for each approved tool, with the no-training clause highlighted; SSO configuration showing AI tools sit behind firm accounts, and the WISP section that references them.
A written rule that a preparer or reviewer signs off on anything AI-assisted before it reaches a client or a workpaper file, recorded spot-checks, an incident plan that covers AI data exposure and output errors, and monitoring of vendor changes.
Evidence examples: the review procedure stating that AI output is a draft, never evidence (the Texas board's exact position, Aug 2026); a QA sampling log from busy season; the AI section of the incident plan, tied to your breach-notification obligations under the Safeguards Rule.
Role-appropriate training with completion tracked, signed acceptable-use acknowledgments, reviewer training on how to verify AI output, and partners who have completed a governance module in the last twelve months.
Evidence examples: the LMS report showing 90%+ completion, including seasonal staff; the acknowledgment file; the partner-group training record. AboveBoard Academy courses carry CPE, so the hours count twice.
An AI clause in engagement letters, a public statement on how the firm uses AI, a review step for any "AI-powered" claim in proposals or on the website, a standard answer bank for client questionnaires, and a complaints path.
Evidence examples: the engagement-letter paragraph CAMICO recommends; the firm's AI statement URL; the last three client questionnaire responses, consistent with each other.
No firm is listed at any level with a zero on G1 (written policy), D3 (vendor terms reviewed) or O1 (human review before client-facing output). For a CPA firm, those are also the three things a state board investigator asks for first.
Read the full rubricThe AI section is answered from the evidence file the reviewer verified, and your registry entry gives procurement a link instead of a promise.
When the application asks for an AI policy, training records and review procedures, you attach the dated report and year-stamped badge.
The board-ready report shows each domain, each gap and the fix. The organized evidence file is the same one you would hand a peer reviewer or a state board.
State boards are, rightly, sensitive to the word "audit." AboveBoardAI issues a score and a verification under a private, voluntary standard. It is not an audit, review or attestation engagement under AICPA or PCAOB standards, involves no financial statements, and expresses no opinion. It verifies that governance practices exist and are evidenced on the review date. See independence and What is an AI audit?
Take the free Snapshot. Ask every department head which AI tools their team used in the last 90 days, on what work. Write it down; that is your first AI register.
Adopt an AI acceptable-use policy (our template takes an afternoon). Decide which tools are approved, move them onto firm accounts with enterprise terms, and write the three-line data rule: what may never go in.
Add one sentence to your engagement quality procedures: AI output is a draft that a named preparer or reviewer signs off. Roll out Academy Foundations to all staff and collect acknowledgments.
Insert the AI clause into engagement letters for new engagements. Start the full AboveBoard assessment; your Snapshot answers carry over and most firms finish the forty questions in a week.
Growth Firm (50–249) $18,000; Established Firm (250–999) $42,000; Enterprise (1,000+) from $75,000. Every tier includes the assessment, independent review, score, badge, registry listing, board report and Academy Foundations. ISO/IEC 42001, by comparison, runs about $73,000 in year one for a 30-person firm (certbetter, Jun 2026).
No. AboveBoardAI issues a score and a verification under a private, voluntary standard. It is not an audit, review or attestation engagement under AICPA or PCAOB standards, it is not performed by a licensed CPA firm acting in that capacity, and it expresses no opinion on financial statements. It verifies that your firm's AI governance practices exist and are evidenced.
SQMS No. 1, effective December 15, 2025, does not name AI. It requires firms to identify and respond to quality risks, including risks arising from technology resources. Most firms conclude that AI tools used in engagements are such a resource. The Texas State Board (August 2026) and CAMICO (May 2026) both recommend a formal, written AI policy with approved tools, review procedures, documentation and training.
Only under terms your firm has reviewed. Consumer AI plans may retain or train on inputs, which is hard to square with client confidentiality and with IRC section 7216 limits on the use and disclosure of tax return information. Firms that pass review typically restrict client data to approved, managed enterprise tools with no-training terms, and classify what may never be entered at all.
AboveBoardAI is priced annually by headcount: $7,500 for firms of 1 to 49 people, $18,000 for 50 to 249, $42,000 for 250 to 999 and from $75,000 for 1,000 or more. Every tier includes the assessment, independent review, score, badge, registry listing, board report and Academy training. See pricing.
AboveBoard does not replace or influence AICPA peer review. What it does is force the evidence a peer reviewer or a state board investigator would ask for into one organized file: the policy, the approved-tool list, vendor terms, review sign-offs and training records, each tied to a scored control.
Yes. The Verified Firm tier exists for firms of 1 to 49 people, and the evidence expected scales with size. A 12-person firm's AI register might be one page and its training record a spreadsheet. The reviewer looks for practices that exist and are followed, not for volume.