Compliance for chartered accountants: GDPR & AI Act

Why the 'Chartered Accountants' sector is concerned

The firm simultaneously occupies two roles within the meaning of the GDPR, which is the primary source of confusion and errors. It acts as data controller for its own data: staff management, business development and billing. It acts as data processor for virtually all processing carried out on behalf of its clients: payroll preparation, bookkeeping, and social and tax filings. Each role entails distinct obligations, and the same file may fall under both.

The sensitivity of the data raises the stakes further. Payroll data reveals information about remuneration, and sometimes about health (sick leave) or family circumstances. A breach does not merely expose the firm to a sanction: it strikes at the very foundation of the relationship — trust. The accounting sector is also a prime target for ransomware and CEO fraud, given its access to the financial flows of hundreds of businesses.

Finally, the rapid adoption of AI tools adds a regulatory layer that is still largely overlooked. As soon as accounting or forecasting software incorporates AI, the firm becomes a "deployer" within the meaning of the AI Act and inherits transparency and oversight obligations.

GDPR applied to the accounting firm

As both controller and processor, the firm must maintain a record of processing activities (Article 30 of the GDPR), secure access to files, govern each of its service providers through a compliant data processing agreement (Article 28), and be in a position to respond to data subjects' rights requests (access, rectification, erasure, and objection).

Appointing a Data Protection Officer (DPO) is not a legal automaticity, but the regular and large-scale processing of employee data — the core activity of a consultancy — makes it strongly recommended, and indeed expected by clients. In practice, an outsourced DPO is often the most rational solution.

Key obligations

• Processing register maintained for both controller and processor roles.
• Data Processing Agreements (DPA) signed with each software provider and host.
• Proportionate security measures (encryption, access management, logging).
• Defined retention periods and purging of expired data.

The AI Act applied to the accounting firm

The AI Act classifies AI systems by risk level. The vast majority of tools used by an accounting firm — OCR, bank reconciliation, drafting assistance — fall under limited risk, whose primary obligation is transparency: informing individuals when AI is involved. The firm acts as a deployer (user) rather than a provider, which significantly reduces its obligations compared to those of the software vendor.

Certain uses may, however, shift into the high-risk category — notably the automated assessment or profiling of individuals (for example, a creditworthiness score produced for a customer). In such cases, enhanced obligations apply: documented human oversight, log-keeping, and information provided to the individuals concerned.

Key obligations

• Inventory (register) of AI systems in use and their risk level.
• Informing customers and individuals when AI is involved in a decision.
• Effective human oversight of AI outputs.
• Retention of compliance documentation provided by the publisher.

Comparative overview of regulations

How these regulations interact

The real blind spot lies at the intersection of the two texts. As soon as an AI tool is trained, configured or simply fed with the firm's client data, both regulations overlap: a GDPR legal basis is required for that use of the data, and the tool must comply with the AI Act (transparency, human oversight, documentation).

In practice, a firm deploying a 'learning' cash-flow forecasting engine trained on its clients' historical data must verify three things: that the data processing agreement authorises this secondary use of the data; that clients are informed of it; and that the vendor provides the expected AI Act documentation. This three-part check is what most firms currently overlook.

Application timeline

• 1GDPR. In force since 25 May 2018; fully applicable, regular CNIL audits.
• 2AI Act. Prohibitions: Prohibited AI practices applicable from 2 February 2025.
• 3AI Act. general-purpose models: Obligations applicable from 2 August 2025.
• 4AI Act. High-risk systems: Main obligations applicable from 2 August 2026 (and 2027 for certain systems embedded in products).

Applicable penalties

GDPR provides for two tiers of administrative fines: up to €10M or 2% of global turnover for 'organisational' infringements (records, security, sub-processing), and up to €20M or 4% for infringements of principles and data subject rights. The higher amount applies. The CNIL may also issue formal notices, injunctions with periodic penalty payments, and non-monetary sanctions (reprimands, processing restrictions).

On the AI Act side, the thresholds are higher: up to €35M or 7% of turnover for prohibited practices, €15M or 3% for failures to meet high-risk system obligations, and €7.5M or 1% for providing inaccurate information to authorities.

Compliance roadmap

• 1Map. Map all processing activities and tools, distinguishing controller and processor roles and identifying embedded AI components.
• 2Document. Build the GDPR register and the AI systems register, including the risk level of each tool.
• 3Contractualise. Audit and regularise data processing agreements (DPAs) with software vendors and hosting providers; verify clauses relating to AI data usage.
• 4Secure. Formalise the security policy, retention periods, and the 72-hour breach notification procedure.
• 5Steer. Appoint a DPO (internal or outsourced), train staff, and establish a periodic compliance review.

How Data Comply One supports the sector

Data Comply One combines a compliance management platform (GDPR register, AI tool mapping, DPA tracking, rights request management) and a dedicated outsourced DPO for the firm. The 'platform + expert' model covers both GDPR and the AI Act without requiring a full-time internal resource.

More than 1,000 clients use DCO, including numerous accounting firms, enabling the standardisation of profession-specific templates (standard DPA for payroll software publishers, AI usage policy, AI systems register).

Frequently asked questions