Your Accounting Software Is Already Using AI — New Guidance Explains What That Means for Your Data
Xero, MYOB and Microsoft 365 now process client data through embedded AI by default. New Tax Practitioners Board guidance flags the compliance gap — and it affects every business that uses them.
If your bookkeeper uses Xero, there’s a reasonable chance your financial data is already passing through an AI model — without anyone in your business, or theirs, making an active decision to send it there. That’s the gap the Tax Practitioners Board (TPB) flagged in draft guidance released in March 2026, and it’s one the accounting industry’s own peak bodies say the guidance doesn’t yet fix.
The TPB’s exposure draft, TPB(I) D62/2026, sets out how registered tax and BAS agents must apply the Code of Professional Conduct when using AI. Most of it reads as sensible practice: check AI outputs before relying on them, keep records, don’t treat a chatbot’s answer as a substitute for professional judgement. But the National Tax and Accountants’ Association (NTAA), in its submission on the draft, pointed to a problem that has nothing to do with practitioners choosing to use AI deliberately.
AI is already running in the background of the tools your business relies on
The draft guidance assumes a practitioner actively decides to put client information into an AI tool. That’s not how AI shows up in most accounting software anymore. Xero’s AI assistant, JAX, built on Anthropic’s Claude, analyses revenue and profit performance, tracks cash flow, and flags unpaid invoices as a standard part of the platform — not as an opt-in feature. Microsoft 365’s Copilot works the same way across Outlook, Word, Excel and Teams. A staff member opens an email or reviews a client file, and AI processes it in the background.
The NTAA’s submission called this “the most significant compliance risk” many practices face, precisely because it’s invisible. Nobody signed up for it in the way the draft guidance imagines. The practitioner didn’t choose to disclose client information to a third party — the software did that as part of doing its job.
This matters to your business even if you’re not a tax agent, because the same embedded AI features are showing up in whatever software you run your operations on. If you’re using Xero, MYOB, QuickBooks or Microsoft 365 for anything beyond basic record-keeping, AI is very likely already processing that data, whether you turned it on or not.
The disclosure rule that’s harder to meet than it sounds
Under Code item 6 of the Tax Agent Services Act, tax practitioners must get client permission before disclosing client information to a third party, and the draft guidance says they should tell the client exactly who the disclosure goes to, where, and where the data will be stored. That’s a reasonable standard when a practitioner is choosing to use a specific AI tool for a specific job.
It’s a much harder standard to meet for AI embedded in a platform you didn’t build. The NTAA pointed out that a practitioner using Xero often can’t determine precisely where JAX processes client data, which third-party AI providers are involved, or how that changes as the vendor updates its features — because that information sits with the software vendor, not the practitioner, and can change without notice.
The NTAA’s proposed fix is a proportionate one: rather than requiring practitioners to chase down sub-processors and storage locations for every embedded AI feature, the finalised guidance should let them meet their disclosure obligation by naming the software platforms involved, alongside a general statement about their approach to AI use and data security. Whether the TPB adopts that approach in the final version remains to be seen — but the underlying issue applies to any business using these platforms, not just accountants.
Check what's already switched on
Open the settings in whatever accounting, CRM, or Microsoft 365 tools your business runs, and look specifically for AI features — Xero's JAX, Copilot in Microsoft 365, or equivalent assistants in MYOB or QuickBooks. Note which are enabled by default rather than opted into. If you use a bookkeeper or tax agent, ask them directly which of these tools they use on your file and whether they've reviewed the OAIC's guidance on commercially available AI products before relying on them.
Why this is a business issue, not just an accounting one
The OAIC’s guidance on commercially available AI products sets out the same underlying expectation for any business handling personal information: privacy risk has to be considered before you adopt a tool, not after, and that includes AI features bundled into software you already use for other reasons. The obligation to think about where data goes and who can access it doesn’t disappear because the AI arrived as a feature update rather than a new purchase.
For a business with no dedicated IT or compliance function, the practical response isn’t complicated. It’s finding out what’s actually switched on in your existing software, and having a straightforward conversation with anyone handling your financial or client data about what tools they’re using on your behalf. The TPB’s guidance is still in draft form, but the compliance gap it’s responding to is already live in the software most Australian small businesses use every day.