FRC Generative and Agentic AI Guidance for audit firms

Summary

On March 30, 2026 the FRC published guidance for audit firms on using generative and agentic AI tools in audit engagements, its second guidance on AI in audit. The FRC says it codifies good practice and does not respond to identified quality deficiencies. It states that regulatory accountability for deploying AI tools and for audit output quality is unchanged and that the human auditor is always accountable. The guidance defines agentic AI systems as systems that can orchestrate and execute multiple tasks toward a goal with some degree of autonomy. It notes a cybersecurity risk when audited-entity data is input into cloud-based AI applications but limits itself to risks to audit quality, and it describes scope and authority boundary rules among design mitigations.

Key dates

1. March 30, 2026Key date
2. October 16, 2026Checked against sources

Developments are added when the record is reviewed. Next review: January 12, 2027.

Evidence

Each passage is quoted from its source. The quoted passages are re-checked against the live pages every month.

1. Published: 30 March 2026 The Financial Reporting Council (FRC) has today published guidance for audit firms on using generative and agentic AI tools in audit engagements.

   Supports: Published March 30, 2026; guidance for audit firms on generative and agentic AI

   the second the FRC has issued on the use of AI in audit. It is not a response to identified quality deficiencies, rather it codifies good practice

   Supports: Second FRC guidance on AI in audit; codifies good practice

   regulatory accountability for the deployment of AI tools and the quality of audit outputs remains unchanged. As set out in auditing standards, the human auditor is always accountable

   Supports: Accountability unchanged; human auditor accountable

   Innovative new guidance supports audit firm adoption of emerging AI technologies (news release) Financial Reporting Council (FRC) Primary source

2. Agentic AI systems are artificial intelligence systems that can orchestrate and execute multiple components and/or tasks toward a goal, with some degree of autonomy.

   Supports: Definition of agentic AI systems

   cybersecurity risk, if audited entity data is input into cloud-based AI applications; or financial risk, if the cost to develop and run the technology exceeds the returns. In this guidance, however, we limit our attention to risks to audit quality

   Supports: Cybersecurity risk noted; scope limited to audit quality

   Scope and authority boundary rules. These are rules that define what actions the system can or cannot perform, including for example when it can iterate; what tools it may use and when human authorisation is required.

   Supports: Scope and authority boundary rules as a design mitigation

   Generative and Agentic AI Guidance (Risks) Financial Reporting Council (FRC) Primary source