FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Aipedia: Payroll bureaux
No regulator has issued AI rules for payroll bureaux; their AI use is governed by HMRC agent and AML rules, data protection law and the duty of reasonable care. The 2026 agent registration changes may bring some bureaux under AML supervision for the first time.
Part of: AI in payroll bureaux
In short
Payroll has no statutory regulator. HMRC treats payroll agents as accountancy service providers for AML purposes (ECSH52725) and, from 18 November 2026, providers whose only HMRC contact is third-party payroll must register for an agent services account, with AML supervision in place first. CIPP is a voluntary body with no AI code; its April 2025 response to an AI inquiry was a temperature check. ICO guidance and UK GDPR Articles 22A to 22D, in force since 5 February 2026, are the only binding AI-relevant rules. Liability for AI errors is tested under the ordinary duty of reasonable care.
Payroll is not a regulated profession in the way audit or legal services are. Anyone can set up a bureau. What governs its AI use is a patchwork: HMRC rules on PAYE, RTI and agents, the Money Laundering Regulations 2017 (MLR 2017) where the bureau is an accountancy service provider, data protection law enforced by the ICO, and the ordinary law of contract and negligence. The Pensions Regulator supervises auto-enrolment, but the duties sit with the employer. This page sets out what each source says, and the payroll bureaux hub links to task-level guides.
HMRC's Economic Crime Supervision Handbook, ECSH52725 (manual updated 30 June 2026) states: "Accountancy Service Providers (ASPs) who provide payroll services are commonly referred to as payroll agents." HMRC is the default AML supervisor for ASPs that are not supervised by a professional body.
HMRC's ASP registration guidance (last public update 16 March 2023) lists "payroll agents that provide accountancy services or tax advice" among the businesses that must register. Two groups need not register: providers that only give software or hardware support, and those that only pay invoiced fees to self-employed people or umbrella companies.
For a supervised bureau, MLR 2017 requires a risk assessment, policies and controls, customer due diligence and staff training. Using an AI identity check or an AI risk-scoring tool does not remove any of these duties. The bureau still owns the risk assessment and must be able to explain how the tool fits within it.
HMRC's guidance on when to register as a tax adviser (last updated 3 September 2026) says that a business providing third-party payroll services with no other HMRC contact will need to register from 18 November 2026. Running payroll for your own staff does not count. Applicants have three months from the date their registration window opens, and can keep dealing with HMRC while the application is considered. Unregistered businesses may not be able to act for clients and may face sanctions if they keep trying, although HMRC says it will give a chance to correct issues first.
HMRC's registration conditions require evidence of AML supervision, by HMRC or a professional body, before applying for an agent services account. Commentators expect many payroll providers to come within the AML regime for the first time as a result. For bureaux using AI, this means onboarding checks, risk assessments and record-keeping will be examined by a supervisor, and the AI tools used in them need to be documented.
The Chartered Institute of Payroll Professionals is the professional body. Membership is voluntary and CIPP has no formal AI standard or code. CIPP responded on 14 April 2025 to a call for evidence on AI in financial services, which the page metadata names as the Treasury Committee inquiry. The response drew on a February 2025 member Think Tank, describes itself as a "temperature check", and identifies the need for "industry steer and positioning on how payroll professionals" use AI. It is useful context but creates no obligation.
Payroll data is high-risk personal data: bank details, National Insurance numbers, sickness records (health data, which is special category data), union subscriptions and attachment orders. The ICO's AI guidance applies generally, and privacy notices and data protection impact assessments (DPIAs) are expected where AI tools process this data. The bureau is typically a processor for the employer and needs Article 28 terms.
UK GDPR Articles 22A to 22D, inserted by section 80 of the Data (Use and Access) Act 2025 and in force since 5 February 2026, set safeguards for solely automated decisions with significant effects. Automated deductions or eligibility decisions without meaningful human review may fall within them. ICO final guidance on automated decision-making under the new Act had not been published as at October 2026; the consultation closed on 29 May 2026. See automated payroll decisions and UK GDPR.
A bureau run by an accountancy firm is supervised by that firm's body, such as ICAEW, ACCA, AAT or ICB, and is subject to its ethics code and PII rules. The accountants and bookkeepers payroll guides cover the professional body technology provisions that apply.
The table separates binding rules from guidance and commentary:
| Source | What it covers | Status | AI-specific? |
|---|---|---|---|
| HMRC, ECSH52725 | Treats payroll agents as accountancy service providers for AML | Internal manual explaining how HMRC applies the law | No |
| HMRC ASP registration guidance | Which payroll agents must register for AML supervision | Guidance on a legal duty under the Money Laundering Regulations 2017 | No |
| HMRC tax adviser registration | Agent services account for third-party payroll providers from 18 November 2026 | Mandatory registration, with sanctions for unregistered contact | No |
| CIPP response, 14 April 2025 | Payroll profession's view on AI | Consultation response, not a standard | Yes, but not binding |
| ICO AI guidance | Fairness, transparency and DPIAs for AI processing personal data | Regulator guidance on binding UK GDPR duties | Yes, general |
| UK GDPR Arts 22A to 22D | Solely automated significant decisions | Law, in force 5 February 2026 | Yes, automated decisions |
Because no rule tells a bureau how to use AI, the test after an error will usually be the ordinary one under section 13 of the Supply of Goods and Services Act 1982: did the bureau act with reasonable care and skill? A bureau that tested its tools, reviewed exceptions and kept records is in a stronger position than one that let a tool run unchecked.
There is no statutory PI requirement for payroll bureaux, and HMRC and CIPP say nothing on AI and PI. PI usually responds to an employer client's negligence claim, subject to the wording, but HMRC penalties and sanctions for failing to register are usually treated as uninsurable or excluded. See fines and penalties under PI and does payroll PI cover AI mistakes.
Apex arranges professional indemnity for payroll bureaux. As bureaux register with HMRC and come under AML supervision, a broker can check that your PI and any cyber cover reflect the services you actually provide, including AI-assisted work.
HMRC is the default AML supervisor for accountancy service providers, and its ECSH52725 manual says ASPs providing payroll services are commonly called payroll agents. A bureau within an accountancy practice may instead be supervised by its professional body, such as ICAEW, ACCA, AAT or ICB.
HMRC guidance says providers whose only HMRC contact is third-party payroll need to register as a tax adviser from 18 November 2026, with three months from their window opening. AML supervision must be in place before applying for an agent services account.
CIPP has no formal AI standard or code. CIPP responded in April 2025 to a call for evidence on AI in financial services, drawing on a member Think Tank, and called the response a temperature check. It is not binding on members or bureaux.
They can be. Since 5 February 2026 they set safeguards for solely automated decisions with significant effects. Automated deductions or eligibility decisions made without meaningful human review may fall within them, and the bureau, as processor, needs to support the employer in meeting them.
Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.
Start a PI quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.
