The FRC Is the Only Audit Regulator With Published AI Guidance

The Financial Reporting Council has published guidance on using artificial intelligence in audit twice, and when it published the second of those in March 2026 it was the first of its kind from any audit regulator in the world. For UK firms that makes the FRC's position the most consequential published material on AI in audit anywhere, despite the FRC saying clearly that none of it is mandatory.

The first publication: documentation, June 2025

On 26 June 2025 the FRC published AI in audit: Illustrative example and documentation guidance. It works through the potential use case of applying AI to enhance procedures over journals, and sets out the FRC's expectations around proportionate, appropriate documentation of tools that use AI.

The FRC's own characterisation of its status is unambiguous: the guidance is not prescriptive and does not introduce new regulatory requirements. It outlines a coherent approach to implementing a hypothetical AI-enabled tool rather than mandating one.

Three features are worth noting for anyone building an internal policy. The definition of AI the FRC adopts encompasses both traditional machine learning and deep learning models, including generative AI, so a firm cannot place itself outside the guidance by arguing its tool is merely statistical. The documentation approach is explicitly aimed at proportionality and at avoiding over-documentation, which is a more useful steer than it sounds. And explainability expectations vary with context and use rather than being fixed. The guidance also addresses tools obtained from third parties, and the FRC said it was intended partly to signal its expectations to technology providers as well as to auditors.

The second publication: generative and agentic AI, March 2026

On 30 March 2026 the FRC published Generative and Agentic AI Guidance, together with a factsheet. It is aimed at audit firms using generative and agentic AI in engagements, explains how to manage audit quality risks while retaining the efficiency and quality benefits, and offers a framework for judging how much confidence to place in the outputs of an AI tool.

The FRC was explicit that this was not a response to identified quality deficiencies. The purpose is to codify good practice the regulator has observed, and to provide a conceptual foundation for its future work in the area. It was developed by the FRC's technology working group, which included representatives from eight audit firms.

The framework stops short of prescribing steps. The FRC sets out how to think about confidence in an output and leaves the specific mitigating actions to professional judgement. Its illustrative examples are concrete and recognisable: summarising board minutes, and using an AI tool to review contracts for revenue recognition testing.

The line that matters most is the simplest. The human auditor is always accountable. Firms are encouraged to consider their use of AI within their existing quality management obligations under ISQM (UK) 1, with the engagement partner's responsibilities under ISA (UK) 220.

One procedural note, and it is an unusually apt one. The FRC publishes an HTML version of the factsheet carrying a warning that it was converted from the PDF using AI, has not been human-verified and may contain errors, and that the PDF is the authoritative version. Anyone quoting the factsheet should quote the PDF. A regulator disclaiming the accuracy of its own AI-generated output, in a document about placing confidence in AI-generated output, is the clearest illustration of the point the guidance is making.

Where this sits relative to the standards

It is important not to overstate what any of this is. No auditing standard has been amended to address AI. The authoritative requirements remain ISQM 1 and ISA 220 (Revised), unamended, and in the UK ISQM (UK) 1 and ISA (UK) 220. The FRC guidance does not change them and says so.

The IAASB, for its part, has published only non-authoritative material on technology, and its AI-specific guide series on applying the quality management standards to AI-enabled tools was still in development through 2026, with the full series targeted for June 2027. Our piece on why ISA 500 (Revised) does not exist yet sets out that position and the date confusion it has produced.

The AICPA moved in the same direction in October 2026, issuing a practice aid providing a framework for understanding how AI affects the financial statement audit. It recommends firm-level planning on the intended use of AI in specific engagements and outlines engagement partners' responsibilities to understand the tools they are using, and it reaches the same conclusion: the auditor remains responsible for the audit and the audit opinion.

Three bodies, three different jurisdictions, one message. The human remains accountable, and AI use sits inside existing quality management obligations rather than creating a new regime.

Why non-mandatory guidance still binds in practice

It would be a mistake to file the FRC material under optional. Audit quality review inspections assess the exercise of professional judgement, and published regulator guidance is the benchmark against which that judgement is assessed. A firm that has adopted an AI tool without reference to guidance the regulator published eighteen months earlier is in a weaker position than one that documented its reasoning against it, whatever the guidance's formal status.

That is a familiar pattern. The same gap between what a rule requires and what guidance recommends runs through the internal audit standards, where the mandatory requirements and the non-mandatory considerations are frequently quoted interchangeably, as our analysis of design versus operating effectiveness in the IIA Standards shows.

Practical steps for a firm

Map each AI-enabled tool to the ISQM 1 quality objective it affects, rather than treating AI as a separate policy area. Document the basis for the confidence placed in each tool's output, using the FRC's categories as a structure. Keep the documentation proportionate, which the FRC explicitly prefers to exhaustive. Address third-party tools specifically, since that is where a firm has least visibility and the FRC has most to say. And record who exercised judgement, because accountability sitting with the human auditor is the one proposition every body agrees on.

Both publications are listed on the FRC's AI in audit library page. For the wider regulatory picture outside audit, including why the finance function itself is not caught by the high-risk regime, see our piece on AI in finance and the EU AI Act.