Microsoft Copilot for Tax Advisors: The UK Compliance Picture

Microsoft Copilot for Tax Advisors: The UK Compliance Picture

Two things happened in UK tax practice in the first months of 2026, and most Copilot advice for accountants ignores both. HMRC started handing Copilot licences to its own staff by the tens of thousands. Separately, the seven bodies that write Professional Conduct in Relation to Taxation published joint guidance on using AI tools in tax work at all. Neither development is about your practice directly, but together they change what "is Copilot safe for a tax adviser" actually means.

The short answer: Microsoft 365 Copilot, run through your firm's business tenant, satisfies the PCRT confidentiality principle because it stays inside your existing permissions and does not train on what you type into it. Consumer-grade Copilot and free AI chat tools do not come with that guarantee. HMRC running its own version of the same technology means the letters landing on your desk are increasingly AI-assisted on the other side too, which changes what a formulaic enquiry actually tells you about how carefully it was reviewed.

That is the whole picture compressed into two paragraphs. The detail is where the actual decisions live.

What HMRC's Own Copilot Rollout Means for Your Practice

HMRC is not a bystander in this. Reporting from April 2026 puts the department's Copilot rollout at somewhere between 28,000 and 29,000 staff, following a Cabinet Office trial across a randomly allocated sample of 3,000 employees. A later figure cited a target of 50,000 licensed staff by the end of 2026. The numbers from different outlets do not fully agree, which is itself worth noting: this is a fast-moving internal deployment, not a settled, documented system.

HMRC's own Phase 3 evaluation of the trial reported participants self-estimating a saving of around 2 to 3% of their working week, roughly an hour, mostly on drafting and summarising. The evaluators treated that self-reported figure as a generous baseline rather than a precise measurement, and flagged limits on complex and sensitive casework, which is the honest part most press coverage skips.

For a tax adviser, the practical read is this. Correspondence drafted or triaged with AI assistance on HMRC's side is likely to arrive faster and in a more standardised format, not necessarily reflecting a deeper individual review of your client's specific facts. A templated-sounding enquiry letter used to suggest a junior caseworker working to a script. It can now equally mean an experienced caseworker whose first draft came from Copilot and who had limited time to adjust it. Treat the tone of a letter as weaker evidence of how much human judgement actually sat behind it than it used to be, and respond to the substance, not the register.

The PCRT Joint AI Guidance, and What It Actually Asks Of You

On 19 January 2026 the seven PCRT bodies (ICAEW, CIOT, ATT, ACCA, ICAS, AAT, and STEP) issued joint topical guidance applying the existing PCRT fundamental principles to AI tool use in tax work specifically. This is not a Copilot review. It is a set of professional obligations that any AI tool, Copilot included, has to be checked against.

Four principles carry the weight:

Integrity. You remain accountable for advice and figures that go to a client or HMRC, whatever tool drafted the first version.

Competence and due care. The guidance names hallucination risk directly here. AI output needs checking for plausible-sounding errors before it reaches anyone, particularly on specific figures: thresholds, rates, and historical allowances are exactly where a general-purpose model is most likely to be confidently wrong.

Client confidentiality. The guidance is explicit that client-specific data should not go into public AI tools. This single line is the one that actually determines whether your Copilot setup is compliant, and it is the one most firms gloss over without checking what "public" means in practice.

Professional behaviour. Standard obligations around how you represent AI-assisted work to clients and regulators still apply unchanged.

None of this names Microsoft Copilot. It sets the bar; your licence type is what clears it or doesn't.

Public AI Tools vs Your Tenant: Where the Line Actually Sits

This is the part the guidance leaves for you to work out, and it is the part that decides whether your firm is compliant.

"Public AI tools" in the PCRT sense means consumer-facing products where your input can be used to improve the underlying model, and where there is no contractual or technical boundary around your organisation's data. Free ChatGPT, consumer Copilot tied to a personal Microsoft account, and most browser-based AI assistants fall on this side.

Microsoft 365 Copilot, licensed through your firm's Business Premium (or higher) tenant, is different in a way that matters here. It operates inside your existing Microsoft 365 permissions, your prompts are not used to train Microsoft's underlying models, and the processing happens within your organisation's data boundary under your existing Microsoft 365 agreement. That is the technical basis for treating it as compliant with the confidentiality principle, rather than a public tool.

Two things to check this week if you run Copilot in a tax practice. First, confirm every user is on the business licence tied to the firm's tenant, not a personal Microsoft account picked up individually, since the two look similar from inside the app but sit on opposite sides of the confidentiality line. Second, review your SharePoint permissions before relying on this distinction for comfort. Copilot surfaces anything a logged-in user already has access to inside your tenant, so an over-permissioned folder structure defeats the confidentiality boundary regardless of which Copilot tier you are on.

Workflows Where Copilot Genuinely Helps a Tax Practice

Scoped to what a tax adviser specifically does, rather than general practice admin, three workflows hold up well.

Drafting first-pass responses to routine HMRC correspondence, which a qualified person then edits against the specific facts of the case. Summarising long enquiry threads or technical consultation documents before a client call, so the adviser's time goes into judgement rather than re-reading. Producing a plain-English first draft of a technical update, such as a rate change or a new HMRC manual section, to brief colleagues, with the caveat that it still needs checking against the primary source before it goes near a client.

None of these replace the adviser's read on the specific case. All three remove a drafting or summarising step that used to eat into billable time without adding judgement.

Where This Still Needs a Qualified Adviser, Not a Prompt

Specific figures are the recurring failure mode. A general-purpose model can state a 2024 rate when the 2026 figure has changed, or apply the wrong threshold to a borderline case, and it will do so with no signal that anything is wrong. This is precisely the competence and due care principle the PCRT guidance names directly, and it is non-negotiable in tax work in a way it is not in, say, drafting a marketing email.

Case-specific technical positions, anything that forms part of advice given under your firm's professional indemnity cover, and judgement calls on how a client's circumstances interact with a grey area of the rules all stay with a qualified person. Copilot can produce a competent first draft of the reasoning. It cannot take professional responsibility for it, and under PCRT, you still have to.

If your practice is weighing up a general tool like Copilot against something built around your specific client base and HMRC correspondence patterns, the trade-offs are the same ones covered in our piece on AI agents for accountants: a general tool gets you started fast with no setup cost beyond the licence; a purpose-built system knows your actual clients and deadlines but takes longer to stand up. For practices weighing whether to build that kind of system internally or bring in outside help, the agency vs in-house comparison covers the same decision from a different angle. Our broader Copilot guide for accountants covers the general practice workflows, licensing, and the Xero integration that sit outside the tax-specific compliance questions covered here.

If you want help working out whether your current Copilot setup actually clears the PCRT bar, or where a custom agent would do more than the general tool, see how we approach AI automation for UK practices. The first conversation is free and usually runs under half an hour.

Frequently asked questions

Is Microsoft Copilot compliant with PCRT guidance for tax advisers?

Microsoft 365 Copilot, licensed through your firm's business tenant, sits on the compliant side of the PCRT confidentiality principle because it runs inside your existing permissions and your prompts are not used to train Microsoft's models. Consumer Copilot and free AI chat tools do not carry the same guarantee. The guidance itself does not name Copilot specifically; it sets principles that your licence type then has to satisfy.

Is HMRC using Microsoft Copilot?

Yes. HMRC has licensed Copilot to a large share of its workforce, reported at 28,000 to 29,000 staff as of April 2026 with a stated ambition to reach 50,000 by the end of the year. The rollout followed a Cabinet Office trial in which participants self-reported modest weekly time savings, though HMRC's own evaluation flagged limits on complex, sensitive casework.

Can I put client tax data into Microsoft Copilot?

Within your firm's Microsoft 365 Business Premium tenant, Copilot respects your existing access permissions and does not train on your data, which satisfies the PCRT confidentiality bar on keeping client information out of public AI tools. You should still check your SharePoint permissions before switching it on, since Copilot surfaces anything a user already has access to, correctly or not.

What is the PCRT AI guidance for tax advisers?

In January 2026 the seven bodies behind Professional Conduct in Relation to Taxation (ICAEW, CIOT, ATT, ACCA, ICAS, AAT and STEP) published joint guidance applying the existing PCRT fundamental principles to AI tool use. It covers integrity, competence and due care including checking for hallucinated output, client confidentiality, and professional behaviour. It is a framework, not a tool-by-tool verdict, so advisers still have to work out where a specific product like Copilot lands against each principle.