By AIGAS
AIGAS Weekly | 1 October 2026
Research window: 24–30 September 2026; checked Wednesday morning.
AI governance is increasingly becoming part of ordinary business management. This week’s developments show that the important questions are no longer limited to which model performs best. Firms also need to consider what suppliers have promised, what an AI system is permitted to do and whether external assurance is genuinely independent.
These are practical issues covered throughout the AIGAS AI governance framework for accounting firms.
ICAEW brings ethics into the AI contract
On 28 September, ICAEW published guidance explaining how its fundamental ethical principles can be translated into AI procurement and contract terms.
The recommendations include testable supplier statements about model provenance, data rights and limitations; notification when circumstances change; audit rights; controls over model training; human oversight; incident management; and secure exit arrangements. It also recommends evaluating performance using the buyer’s representative data rather than relying solely on vendor benchmarks. Read the ICAEW guidance. ICAEW
Our view is that this moves governance to the right place: before the contract is signed. A privacy policy and a successful demonstration are not enough. Firms should establish what evidence they need, what changes the supplier must disclose and what remedies are available if an important representation proves inaccurate.
Karbon’s update shows why controls should be configurable
Karbon’s 28 September release included updated close-automation checks. Firms can now configure relevant account checks on a cash or accrual basis and apply settings through firm-level templates. This was an operational product release, not a new AI launch. Read Karbon’s release notes. Karbon
The wider lesson applies to AI-assisted workflows. A control needs to reflect the client, accounting basis and task being performed. Firm-wide defaults create consistency, but teams also need a controlled route for justified exceptions. Configuration decisions should have an owner and be reviewed when the underlying workflow changes.
NVIDIA argues that agent controls must sit outside the agent
On 28 September, NVIDIA announced its Open Agent Safety Platform. It combines an open-source runtime that records activity and enforces policies with an optional hardware-based monitor designed to quarantine agents that leave their permitted boundaries.
NVIDIA founder and CEO Jensen Huang argued that AI safety requires “full-stack engineering”. This is a supplier’s position attached to a commercial and technical announcement, rather than independent evidence. However, the underlying principle is useful: an autonomous system should not be solely responsible for policing itself. Read NVIDIA’s announcement. investor.nvidia.com
For accounting firms, agent permissions should be narrow and visible. Access to client files, email, ledgers, payment systems or filing services should increase only when monitoring, approval and interruption controls increase with it.
A voluntary safety accord raises an independence question
On 29 September, US technology executives including leaders from OpenAI, Anthropic, Meta, Google and NVIDIA agreed voluntary AI safety standards. Reuters reported that the companies committed to internal controls and work with independent auditors. The agreement is not binding law and does not create a UK requirement. Read the Reuters report. Reuters
External assessment is encouraging, but the word independent needs substance. Who appoints and pays the auditor? What access will they receive? Is the scope public, and must adverse findings be disclosed?
Accounting firms should apply the same professional scepticism when reviewing AI assurance reports supplied by vendors.
This week’s action for your firm
Choose one important AI supplier and check:
- Contract: Are its claims about data use, performance and change notification enforceable?
- Control: Are permissions proportionate, logged and capable of being withdrawn quickly?
- Assurance: Is any external review sufficiently independent, scoped and evidenced?
Use the AIGAS self-assessment to identify gaps, then record the supplier, purpose, permissions and reviewer in the free AIGAS AI Tool Register.