Technology / Malta 2026

AI in Professional Services: Who Signs Off?

From AI draft to reviewed client advice: a practical approval workflow for Malta’s accounting, tax, audit and advisory firms, illustrated through one fictional client memo.

KMFINCO Published 7 October 20266 min read

What to know before you decide

Give AI a defined role in the deliverable and name the person responsible for professional review and release.
Verify sources, dates, calculations and material omissions against independent evidence before relying on a draft.
Keep a proportionate record of checks and conclusions, and control an agent's authority to send, file or change records.
Measure total human effort and quality together when deciding whether an AI-assisted workflow is worthwhile.

AI can help a professional firm organise research, compare documents and prepare a clearer first draft. The value reaches the client when that work becomes a supported conclusion, approved by someone able to judge its substance.

For partners and managers, the central question is practical: what must happen between an AI-assisted draft and advice issued in the firm's name? Answering it makes adoption easier to manage and gives colleagues a repeatable way to use the technology.

The subject is timely in Malta. In September 2026, the Malta Institute of Accountants highlighted controlled AI use in everyday accounting workflows and the importance of governance and professional judgement. S1

This article proposes an operating framework, not a complete account of a firm's legal or professional obligations. Its examples are fictional. The FRC and ICAEW sources cited below concern UK audit practice and are used as professional references, rather than as statements of Maltese law.

Follow one client memo

Imagine a tax team preparing a memo about a client's planned transaction. An approved AI assistant organises the supplied facts, creates a list of questions and drafts an explanation with source links. The team can now spend its attention on missing evidence, competing interpretations and the client's choices.

One citation, however, comes from an archived official page. In this fictional scenario, the provision is genuine but was replaced before the relevant transaction date. Its wording has been reproduced accurately, while the resulting conclusion is wrong.

A useful workflow should catch that problem, correct the advice and preserve the basis for the correction. Four review stages make those responsibilities visible.

1. Approve the inputs and define the task

Before the file enters the tool, identify the approved environment, the client information needed and the permitted purpose. Check access, provider terms, retention arrangements and applicable confidentiality and data-protection requirements. Remove unnecessary identifying information where practical; anonymisation should be assessed carefully when remaining facts could identify the client.

For the memo, provide the transaction date, relevant jurisdictions and verified factual summary. Mark disputed or missing facts explicitly. Ask the assistant to distinguish supplied information from assumptions, identify its authorities and flag questions that require further evidence.

Keep the initial task bounded: research and prepare a working draft. An assistant does not need the client's entire archive or permission to email the client simply to help organise that work.

ICAEW's May 2026 audit guidance connects AI adoption with policies, training, oversight and protection of client information. Those themes are useful when designing a firm's own approved workflow. S2

2. Verify the substance against independent evidence

The preparer opens the cited official material, checks its current version and confirms when the relevant rule applies. That process exposes the archived provision in the fictional memo. The preparer replaces it, revises the analysis and explains why the original conclusion changed.

Source checking should ask more than whether a link opens. Does the authority cover this entity, period, transaction and jurisdiction? Does an exception alter its effect? Has the draft confused guidance with legislation or a proposal with an enacted requirement?

Recalculate material amounts using an appropriate independent method, with inputs traced to the client's records. A second AI response agreeing with the first does not by itself verify the answer.

The reviewer should also consider what is absent. A polished explanation can omit a material alternative, a missing document or an unresolved assumption. Build the review around the client's decision and the evidence it needs.

IESBA identifies technology-related considerations across competence, due care, objectivity, confidentiality and independence. That provides a professional foundation for substantive review. S3

3. Keep a useful record of the review

For the fictional memo, retain the verified facts, current authorities, material calculations, correction to the superseded provision and the final reasoning. Record who prepared and reviewed the work and how outstanding questions were resolved.

Documentation should let an appropriate colleague understand why the conclusion was accepted. Use a proportionate record of material AI involvement and the relevant tool or workflow version where available. Apply the engagement's retention requirements; avoid collecting unnecessary sensitive content merely to keep an indiscriminate prompt archive.

A short review record can cover:

Field	What it should establish
Task and scope	What AI was asked to assist with
Facts and authorities	Evidence used and date-sensitive checks
Material corrections	What changed and why
Open matters	Questions still requiring action
Review and release	Responsible people, approved version and date

The review is complete when the material questions are resolved or clearly reflected in the advice's scope. An unchecked box should never disappear simply because the draft is ready to format.

4. Authorise the outcome and control the next action

The designated approver reviews the corrected memo and authorises a particular version for a particular recipient and purpose. The releaser checks that the attachment is that version and that the accompanying message does not overstate the conclusion.

For an AI agent that coordinates several tasks, distinguish permission to research from permission to send advice, submit a return or amend client records. Define which actions require approval and enforce those limits in the workflow.

For this memo, a sensible initial arrangement allows the agent to prepare a draft email while holding external delivery for approval. If a tool reports an uncertain submission outcome, check the authoritative system before retrying an action that could create a duplicate.

The FRC's March 2026 guidance discusses review and oversight at selected control points in generative and agentic systems. The useful design question is where human judgement can detect a consequential error or control a consequential action. S4

Measure a completed deliverable

Pilot the workflow on a defined class of work with comparable scope and complexity. Track total human time, including preparation, checking, correction and approval. Record material errors caught, rework, escalations and any confidentiality or permission incidents.

Agree acceptance criteria before the pilot. If drafting becomes quicker but review becomes substantially harder, examine the source pack, task design or choice of use case. Expand only when the evidence supports both useful efficiency and acceptable quality. No universal percentage saving should be assumed.

Bring junior colleagues into verification and explain corrections. A successful pilot should strengthen their understanding of the work they will eventually review.

Frequently asked questions

Must a partner check every AI-generated sentence?

Design review proportionately to the task and the consequences of error. Name competent reviewers and an authorised approver. Material professional judgements and unresolved issues need attention at the appropriate level.

Should the firm tell clients it uses AI?

Establish the requirements arising from the engagement, applicable rules and data use. Make any explanation accurate about AI's role and the firm's review process. A generic disclosure does not make an unsuitable use appropriate.

Can an agent send or file autonomously?

Technical capability is only one consideration. Define the approved action, permitted data, authority, exceptions and recovery process. For the initial client-advice workflow here, retain an explicit release approval.

What should the firm try first?

Choose a bounded, repeatable task with accessible source material and an established review process. Compare completed work, including corrections, with the current method before extending the scope.

Make the approval process part of adoption

Choose one recurring deliverable and map the four stages: approved inputs, verified substance, recorded review and authorised release. Assign the roles, trial the workflow and use the results to improve it.

Discuss the review-and-release process through KMFINCO's Management Consulting service area.

Explanatory figure for Technology — A proposed operating workflow. The named roles, evidence and permission limits must be adapted to the firm's engagement and applicable requirements.

AI-assisted client-work review checklist

Complete for the deliverable and retain evidence proportionate to its purpose, risk and engagement requirements. This is a practical aid, not proof of compliance.

Open the checklist Print-friendly checklist

Sources and further reading

[S1] Malta Institute of Accountants: M26103 – Evolving Tools in the Accounting ProfessionCurrent Malta discussion of practical, controlled AI use in accounting workflows and governance.
[S2] ICAEW: Artificial intelligence in audit work – managing the risksAI policies, training, oversight and client-information protection in audit work.
[S3] IESBA: Technology – Ethics & Independence ConsiderationsTechnology's relationship with competence, due care, objectivity, confidentiality and independence.
[S4] FRC: Generative and Agentic AI GuidanceGenerative and agentic AI output risks, professional oversight and review at selected control points.