CPA Ontario 2
Log in
Member Support Centre
CPA Ontario Insights
Thought Leadership, Research & CPA Spotlights

The Responsible Use of AI in Professional Practice

Regulatory Standard Edition: June 2026 | Published: June 29, 2026

New technology does not replace professional judgment and ethical responsibilities. As CPAs incorporate Artificial Intelligence (AI) tools into their work, the CPA Code of Professional Conduct, and the protection of the public remains the lens through which CPAs must evaluate how those tools are deployed and used.

When performing professional services, accountability ultimately rests with CPAs. The quality, accuracy and appropriateness of AI prompts must be carefully considered, and all applicable data protection and confidentiality requirements must be strictly observed. Every AI-generated output must be thoroughly reviewed, verified, and fully understood before it is used, including confirming that the information is accurate and free from “AI hallucinations” or unsupported assumptions. Relying on AI without rigorous oversight poses a risk to the organization, the public interest and the reputation of the profession.

CPAs must ensure their use of AI and automated systems comply with professional obligations including, but not limited to:

  • Professional Competence (Rule 203): Members must possess adequate knowledge of the AI tools they deploy. This includes performing due diligence on a tool’s capabilities and limitations, as well as critically validating all outputs for accuracy.
  • Integrity, Due Care, and Objectivity (Rule 202): Members must apply professional skepticism. You are responsible for ensuring that reliance on AI does not lead to biased, misunderstood or unverified conclusions.
  • False or Misleading Documents and Oral Representations (Rule 205): Members are responsible for ensuring that no AI-generated content in a deliverable, communication, or filing is false or misleading. Hallucinations or errors must be identified and corrected during the professional review process.
  • Confidentiality of Information (Rule 208): Protecting client data is paramount. Members must ensure that no confidential, restricted, or personally identifiable information is entered into AI tools unless the environment is verified as secure and compliant with all privacy and professional obligations.