BRONZE
Establish the foundations of responsible AI use
AIGAS™ Bronze is the baseline assurance level for accounting firms that want to demonstrate that they understand how AI is being used within the firm and have put sensible, proportionate controls around it. It is designed particularly with smaller firms and firms at an earlier stage of AI adoption in mind.
Bronze is not about building a complex management system. It is about answering some fundamental questions.
If those foundations are in place — and you can demonstrate them — your firm is beginning to govern AI rather than simply allowing it to happen.
Six areas. Foundational depth.
AIGAS is structured across six areas of AI governance. Bronze looks at the foundations within each of them, without expecting smaller firms to create unnecessary layers of bureaucracy. The Standard itself is designed to be proportionate, allowing firms to establish foundational controls and mature them as their use of AI develops.
Understanding your AI
Do you know what your firm is actually using — and why?
Good AI governance starts with visibility. Bronze looks at whether your firm has identified the AI-enabled tools being used and whether there is an understood purpose for their use.
That includes obvious AI services as well as AI functionality increasingly embedded within accounting software, productivity platforms and other systems. The Standard applies to standalone tools, integrated professional software, web services and AI embedded within productivity tools.
Because it is very difficult to manage the risks of AI that nobody knows is being used. Bronze therefore starts with a simple principle: you cannot govern what you cannot see.
Understanding the risks
Has your firm considered what could go wrong?
AI can be extremely useful, but it can also create new risks. For an accounting firm these can include incorrect outputs, inappropriate reliance on AI, exposure of confidential information and other professional or regulatory issues. These are among the risks identified in the AIGAS Standard itself.
Bronze does not expect every firm to operate a sophisticated enterprise risk-management programme. It does expect the firm to understand the principal risks associated with its use of AI and to demonstrate that these have been considered.
The objective is not to discourage AI use. It is to make sure AI is being adopted deliberately rather than without awareness of the consequences.
Protecting confidential information
Are there appropriate boundaries around data?
Accounting firms routinely work with sensitive financial and personal information. Bronze looks at whether appropriate restrictions are in place around the use of confidential client information with AI systems and whether the firm understands who is supplying the AI tools it uses.
An AI tool may be easy for a member of staff to access, but that does not automatically make it appropriate for every type of information. People need to understand where the boundaries are.
Responsibility and acceptable use
Who is responsible for AI governance?
Bronze looks for clear ownership. Someone within the organisation should have responsibility for overseeing AI governance, and staff should have clear guidance about acceptable use. The Standard also expects staff to be aware of the firm’s AI governance policies.
This does not necessarily require creating an entirely new job. In a smaller firm, responsibility may form part of an existing senior role. What matters is that responsibility is defined rather than assumed.
If everybody is responsible, it is very easy for nobody to be responsible.
Human judgement and staff awareness
Is AI assisting professionals rather than replacing professional judgement?
Bronze considers how AI-generated outputs are handled before they are used in professional work. The Standard requires professional outputs produced using AI to be reviewed by a competent individual and includes expectations around responding to errors and staff awareness training.
AI can assist with drafting, research, analysis and automation. It does not remove the firm’s professional responsibility for the work ultimately provided to a client. Human oversight remains an important part of responsible AI use.
Keeping governance current
Will your controls still be relevant next year?
AI use does not stand still. New tools appear, existing software gains AI capabilities and working practices change. Bronze therefore isn’t simply about passing an assessment once and forgetting about it. The Standard requires AI usage to be reviewed and AIGAS assurance to be revalidated annually.
AI governance should develop alongside the technology being governed.
What will our firm need to demonstrate?
Bronze is evidence-based. Your firm will be guided through the Bronze requirements and asked to demonstrate that the relevant foundations are genuinely in place.
The intention is not to produce documents merely for the sake of certification. The evidence should demonstrate that the controls are actually relevant to the way your firm works.
What Bronze is not
- Bronze does not mean that AIGAS is guaranteeing that AI can never go wrong.
- It does not replace professional judgement, legal or regulatory obligations, or the responsibilities that already apply to an accounting firm.
- AIGAS is an independent governance assurance framework rather than an ISO standard or a substitute for regulatory obligations.
Bronze may be particularly appropriate for
AIGAS applies across sole practitioners, bookkeeping and payroll bureaux, SMEs, outsourced finance teams and multi-partner accounting practices.
How long does Bronze last?
AIGAS assurance is valid for 12 months. Your firm’s governance should continue to evolve during that period, including maintaining its AI Tool Register and responding to changes in the AI systems it uses. At renewal, the assurance is revalidated.
For some firms, Bronze may be the appropriate level for their current AI use. Others may later decide that they need stronger assurance as their use of AI becomes more extensive. Bronze provides a foundation from which the firm can progress towards:
Silver introduces more structured governance, including formal risk management, defined governance arrangements, documented operational controls and ongoing monitoring.
And for organisations that ultimately want to pursue an internationally recognised AI management system, AIGAS has been structured with a pathway towards ISO/IEC 42001 principles, while remaining distinct from ISO certification.