Review Rules for QuickBooks and Xero AI: A One-Page Policy for Your Bookkeeping Firm

QuickBooks Online and Xero now categorize, match and reconcile on their own. Most firms haven't written down what the agent is allowed to do. Karbon's 2026 survey found only 21% of accounting firms have an AI policy, and that firms with one save 17% more time than firms without (Karbon, 2026 report, vendor survey).

A policy for a small bookkeeping firm doesn't need to be long. It needs to answer five questions. Below is a one-page template you can copy, with example language. The thresholds are examples; set your own.

Why you need rules now

Three facts make this urgent rather than nice-to-have:

• The agent may already be on. A July 2026 roundup reports QuickBooks rolled its agents out to all QuickBooks Online users with no opt-out (Carly, Jul 2026, vendor). JAX is included on every US paid Xero plan (Rework, Aug 2026, vendor list).
• It is not set-and-forget. Users report weekly cleanup of miscategorized transactions, and School of Bookkeeping's advice, as quoted by the same roundup, is "trust, but verify — especially when closing books or posting in bulk" (Carly, Jul 2026).
• Data security is the top worry. 83% of Karbon's respondents said they were concerned about data security, up on the prior year (Karbon, 2026 report).

The one-page template

1. What the agent may post on its own

Example language:

The ledger agent may categorize and post a transaction without review when all of these are true: the vendor or customer has at least three prior transactions coded the same way; the amount is under $[500]; and the account is not on our "always review" list.

Xero's auto-reconciliation only acts when it is "highly confident" and offers one-click undo (Rework, Aug 2026). Your rule decides whether "highly confident" is good enough for each client.

2. What a person must always review

Example "always review" list:

• New vendors or customers.
• Anything over your dollar threshold.
• Owner draws, owner contributions, loans and transfers between accounts.
• Sales tax, payroll and payroll liabilities.
• Fixed assets and anything that might be capitalized.
• Any bulk action, and anything posted during close.
• Clearing and suspense accounts. (Blake Oliver's AI test turned up an unknown line of credit sitting in a clearing account, which is exactly where surprises hide — Blake Oliver, Jun 2026.)

3. The weekly exception routine

Example language:

Every [Tuesday], each bookkeeper spends up to [30] minutes per client group clearing: transactions the agent flagged; transactions it categorized to new accounts; uncategorized items; and reconciliation differences. Corrections are made in the ledger, and any recurring miscoding becomes a bank rule or a note in the client file.

The point is a fixed day and a fixed list. Without one, review slides to month-end, which is when the backlog is hardest to clear.

4. Which AI tools may touch client data

This is where most firms are loosest. Karbon's survey found ChatGPT was the most-used AI tool at 87% of respondents, ahead of Microsoft Copilot at 53% (IT Brief, Jan 2026). Accounting technologist Jason Staats has said firms need paid ChatGPT Business to get its data protections (CFOtech US, Jan 2026).

Example language:

Client financial data may be used only in: the ledger's own AI features; [named business AI account with data-protection terms]; and [named document tool]. Client data may never be pasted into a personal or free chat account. If in doubt, remove names and account numbers first, or ask [owner].

Write down the actual account names. "Approved tools" with no list is not a rule.

5. What you tell clients

Many clients will assume AI is involved. Some will ask. Decide your answer once.

Example engagement-letter language (have your own advisor review it):

We use the automation features built into [QuickBooks Online / Xero] and other business software to help categorize and reconcile transactions. A member of our team reviews this work under our firm's review policy before your books are closed or reports are sent.

6. When to turn a feature off

Example language:

If an AI feature miscodes the same type of transaction for the same client in two consecutive weeks after correction, we switch that feature off for that client and review it at the next monthly team meeting.

How to roll it out in a week

1. Day 1: Owner fills in the brackets above. Keep it to one page.
2. Day 2: List every AI feature turned on in each ledger plan you use, and every chat tool staff actually use (ask; don't guess).
3. Day 3: Walk the team through the page in 30 minutes. Ask where it doesn't match reality and fix it.
4. Day 4: Run the first weekly exception routine together on two clients.
5. Day 5: Add the client paragraph to your engagement letter template for new and renewing clients.

Training matters as much as the page. In the same Karbon survey, staff at firms that train saved 28% more time than staff at firms that don't, yet only 46% of firms invest in AI training (Karbon, 2026 report).

Keep it current

Both ledgers change their AI features often. Xero announced document chasing as "coming soon" in July 2026 (CPA Practice Advisor, Jul 2026), and Intuit lists several Accountant Suite features as beta or "coming soon" (Intuit Australia, May 2026, vendor). Put a quarterly reminder on the calendar to re-read your page against what's actually switched on.

For the bigger picture of what each ledger's AI does today, start with our 2026 guide.

---

If you'd like help filling this in for your firm, or a working session to train your team on it, start a free conversation. We'll look at what you have switched on and tell you plainly where the risk is.