Every CPA seems to be posting about AI right now.
We see the LinkedIn posts every day across firms and finance teams in industry. Automation, efficiency, better workflows, faster research, fewer admin hours : all of it sounds promising and to be fair a lot of it is.
At RSSL Mergers, we do not usually engage with non-technical AI commentary. There is already enough noise in the market and most firm owners do not need another generic post telling them AI is going to “transform accounting.”
But we do think this conversation needs a more practical view.
Because AI adoption inside a CPA firm is not just about saving time. It is about how much data you are feeding into these tools, what they can access, who is reviewing the output and who is responsible if something goes wrong.
AI can be incredibly useful. It can summarize documents, support research, draft internal notes, organize workflows and reduce repetitive admin work. But once AI starts touching client files, firm systems, tax documents, financial statements, emails or internal databases, it stops being a simple productivity tool.
It becomes an operational risk that needs to be managed properly.
AI usage has a cost and it is not always obvious
Most firms think AI costs whatever appears on the monthly subscription invoice.
That is only the visible cost.
Once AI becomes part of a workflow, the economics start to change. Many AI tools are usage-based, especially when firms move beyond basic subscriptions and start using agent workflows, document processing, custom tools or automation.
This is where tokens matter.
In plain English, tokens are the small pieces of text that AI reads and writes. Every prompt you type uses tokens. Every answer you receive uses tokens. The longer the file, the bigger the prompt, the more detailed the output and the more usage you create.
Asking AI to draft a short email is one thing.
Asking it to read a long client file, summarize tax planning notes, compare financial statements or review a diligence folder is something else entirely.
Firm owners need to understand that AI is not free once it becomes operational. The more your firm asks AI to read, process, summarize and produce, the more infrastructure and usage cost sits behind the scenes.
Are you budgeting for AI adoption?
The subscription is usually the smallest part of the conversation.
The real cost is everything around it: implementation, staff training, access controls, data security, review standards, vendor risk and client confidentiality.
For many firms, that may mean bringing in technical help, working with cybersecurity or data security professionals and reading the fine print before client information enters any AI tool.
For a small CPA firm testing AI in a controlled way, early adoption may start around $500 to $1,000 per month for a few subscriptions, light usage and basic internal testing. That does not include proper data security or cybersecurity support around the software.
For a mid-sized firm using AI for document review, workflow automation, research, client communication or internal knowledge tools, the cost can move closer to $2,000 to $5,000+ per month once usage, implementation support and staff training are included. If the firm also needs AI governance, vendor review, access controls and cybersecurity support, the actual cost can move higher.
That is why AI budgeting should not only ask what the tool costs. It should ask what it costs to use the tool safely with client data.
For CPA firms, client confidentiality is not a nice-to-have feature.
It is the business.
Most firms do not have AI guardrails yet
This is where we think many firms are exposed.
One person uses it to draft emails. Another uses it to summarize meeting notes. Someone uploads a document to save time. A partner tests a tool. A manager signs up for an AI plug-in.
Nobody is trying to create risk but very quickly the firm has several people using several tools in several different ways.
That is how shadow AI enters the workflow.
The problem is that “be careful” is not a policy.
A CPA firm needs basic guardrails around what AI is allowed to touch, especially when the information involves client names, tax returns, payroll records, audit files, financial statements, shareholder information, M&A documents or internal pricing notes.
Most firms do not need a complicated 50-page AI policy on day one. But they do need clear rules around approved tools, prohibited data, review standards, access permissions and accountability.
Without those rules, AI adoption becomes inconsistent. And inconsistent adoption is where small mistakes can become firm-level problems.
Giving AI too much control until it is too late
The next phase of AI is not just chatbots.
It is agents.
AI tools can now connect to systems, read files, write code, update records, move information and take actions across your software. That is powerful but it also changes the risk profile completely.
In April 2026, PocketOS’s founder said a Claude-powered AI agent deleted the company’s entire production database and backups in nine seconds. The company provided software for car rental businesses. Reservations, payments, vehicle assignments and customer records were all deleted, leaving businesses with no access to information they needed to operate.
That was a software company, not a CPA firm.
But the lesson applies in every industry.
The issue is no longer only whether AI gives a good answer. The issue is what AI has permission to do in your firm.
If AI can only help draft a note, the risk is one thing. If AI can access systems, edit records, move files, delete information or send communications, the risk is much higher.
This is where firms need to slow down before they connect AI to live systems.
Who is responsible if AI gets it wrong?
This is the question managing partners should be thinking about now.
Deloitte has already faced scrutiny over AI-related citation issues in government work. In April 2024, Deloitte faced significant scrutiny over a healthcare report prepared for the Newfoundland and Labrador government. The report, which was intended to help modernize the province's health system, was found to contain fabricated citations which is a classic "hallucination" where the AI generates professional-sounding references to papers and studies that simply do not exist.
The point is not that large firms should avoid AI. The point is that even sophisticated firms can get the AI review layer wrong.
If AI drafts a memo and the technical conclusion is incorrect, the firm is still responsible. If AI summarizes a client file and misses something important, the firm is still responsible. The client will not care whether the issue came from a junior staff member, a vendor, a plug-in or an AI model.
They will look to the firm.
That means firms need internal ownership around AI. Someone needs to be responsible for the policy, the review process, data protection and quality control. Excitement about AI is not enough if no one owns the risk.
What managing partners should do before adopting AI
AI adoption does not need to be overcomplicated but it does need to be intentional.
Before rolling AI applications across a CPA firm, managing partners should have a clear answer to a few basic questions:
- Which AI tools are approved?
- What client data is off-limits?
- Can staff use personal AI accounts?
- Who reviews AI-generated work?
- Can AI access internal systems?
- Can AI edit, delete, send or move information?
- Who owns the AI policy inside the firm?
The goal is not to slow innovation down. The goal is to make sure the firm is not creating new risk while trying to become more efficient.
At RSSL Mergers, we are not anti-AI. We are building an AI layer into our own work across market data, succession scoring, workflow design and CPA M&A intelligence.
But that is exactly why we think the conversation needs to be more practical.
AI will likely become part of how CPA firms operate. The firms that benefit most will be the ones that bring it into the business carefully, with clean data, approved tools, documented workflows and proper review standards.
Before your CPA firm uses AI, the question is not simply which tool to buy. The better question is what AI is being allowed to touch, who is responsible for the output and whether the firm has protected the client trust that makes the business valuable in the first place.
Because in accounting, the real asset is not the software.
It is the trust behind the numbers.
