AI Governance Shocks in The 2026 CPAFMA Digitally Driven Firm Survey

The 2026 CPAFMA Digitally Driven Firm Survey — 162 firms, conducted in December 2025 by Roman Kepczyk, CPA.CITP, PAFM — is one of the more useful data sets available to firm leaders right now because it measures what firms are actually doing, not what they're planning to do. And the AI governance numbers are worth sitting with.

Ninety-one percent of respondents said they're using generative AI in some form. That's a nearly universal adoption rate for a category of tools that barely registered on these surveys two years ago. But only 57% have a written AI policy that people have actually been trained on. In 2024, that number was 20%. The governance infrastructure is catching up — but it hasn't caught up.

That gap is the story.

The Tools Firms Are Using Don't Match the Governance Firms Have Built

ChatGPT (34%), Microsoft Copilot (29%), and Rightworks SPARK (13%) are the top three AI tools in use across respondents. That means the majority of firm staff are interacting with general-purpose, externally hosted AI systems — tools not built with accounting firm data protocols in mind — and just under half of those firms have no written policy governing their use.

The risk isn't theoretical. Staff are drafting client communications, summarizing meetings, and in some cases structuring technical analysis using tools that, without clear firm guidance, default to whatever the user decides to do in the moment. That's not a reason to stop using these tools. It is a reason to stop treating governance as a future agenda item.

The 47% of firms that have established a dedicated AI strategy committee with a designated representative are ahead. Not because committees solve problems, but because having a named owner means someone is actually watching what's happening and making decisions about it. Firms without that structure are implicitly delegating AI governance to individual staff judgment — which is not a governance model.

BlueJ Is the Surprise Number in the Data

One data point that warrants attention: BlueJ's adoption jumped from 3% in 2025 to 29% in 2026. That's not incremental growth — it's a category shift, and it signals that firm leaders are starting to think about AI differently in the context of tax research specifically. BlueJ is built for tax analysis, which means it's purpose-built with the kind of guardrails and context that a general-purpose model doesn't have. Its growth suggests firms are starting to distinguish between AI tools appropriate for general drafting and those appropriate for technical work. That's a more mature posture than treating all AI as interchangeable.

The Rest of the Tech Stack: A Few Things Worth Noting

The non-AI findings paint a picture of a profession still in transition on several fronts.

Managed service providers now handle infrastructure for 60% of firms, down from 77% a decade ago. Laptops have effectively won — 78% of firms are at 90%+ laptop penetration. Phishing testing and security awareness training reached 91% of respondents, a 21% jump from 2024, which tracks with the broader shift toward external managed security rather than in-house IT.

On the practice management side, the story is fragmentation moving toward consolidation. The traditional CCH/Thomson Reuters dominance is holding firm at the top, but next-generation tools like Canopy, Firm360, Karbon, and TaxDome are gaining ground specifically because they integrate document management, portal, workflow, and eSignature into a single platform. Firms that are still running four separate point solutions for those functions are paying in both dollars and friction.

One number that stood out: 27% of respondents are now using overseas staffing providers. That's no longer an outlier strategy.

What Firm Leaders Should Do With This

The governance gap is the clearest action item. If your firm is in the 91% using generative AI and not in the 57% with a written, trained-upon policy, closing that gap is a concrete near-term project — not a multi-month initiative. A workable AI policy doesn't require a committee or a consultant. It requires someone to decide which tools are approved, what client information can and can't be entered into those tools, and which review standards apply to AI-assisted work.

The AI strategy committee question is worth taking seriously even for smaller firms. A designated representative doesn't need to be a full-time role. It needs to be someone who is accountable for staying current and translating what's changing into firm decisions. Without that, AI adoption in your firm is being governed by inertia.

If your firm is among the 43% using AI without a written policy, the question isn't whether to build one. It's how quickly you can do it before a client situation forces the conversation.

Source: 2026 CPAFMA Digitally Driven Firm Survey Results, authored by Roman Kepczyk, CPA.CITP, PAFM. Survey conducted December 2025 with 162 participating firms. Data cited for informational purposes as presented in the original report.