AI strategy gap [What It Changes]

TL;DR

• The AI strategy gap is the spread between people already using AI on real work and the firm still having no written strategy, approved-tool list, review rule, or pricing change for that work.

• According to IT-Online's write-up of a 2026 Gartner webinar poll of 743 audit professionals, 93% of audit leaders report some AI use while only 38% have an AI strategy.

• According to Clio's 2025 Legal Trends Report, 79% of legal professionals use AI, and more than half say their firm has no AI policy or they are unaware of one.

• A 2-truck HVAC shop, a 10-person marketing agency, a solo clinic, and a four-person CPA firm all hit the same operational failure: staff finish the job faster, the invoice still prices hours, and nobody can show a reviewer which model touched which file.

Key Takeaways

• Use without strategy is now the default in audit, legal, tax, and finance, not a lagging-firm problem.

• The gap shows up in three places a partner can audit this week: which tools are allowed, who reviews the output, and whether the invoice still sells time the model just deleted.

• Gartner's audit poll, summarized by IT-Online, shows AI clustered in drafting (60%) far more than in testing (30%) or quality-assurance reviews (12%).

• Clio's 2026 solo and small-firm report frames the same pattern as an efficiency paradox: faster work can shrink revenue if the firm still bills by the hour.

• As of June 2026, IRS Office of Professional Responsibility guidance told tax practitioners that Circular 230 duties did not move: AI may assist, the practitioner still signs, and unconscionable fees include billing for time the tool did not spend.

• Closing the gap is a workflow job: approved tools, logged prompts, human sign-off, and a price that matches the new cycle time.

What an AI strategy gap is

The AI strategy gap is the distance between unofficial AI use on live client work and a firm-level plan that names the tools, the data rules, the reviewer, and the way the firm charges for the faster cycle.

That is not an enterprise-only story. A 2-truck HVAC shop already has a dispatcher pasting invoices into a chatbot to chase past-due balances, while the owner still quotes jobs as if every estimate takes 45 minutes. A 10-person marketing agency already drafts client recaps in a consumer model, then bills retainers that assume the old write-up time. A solo clinic already summarizes visit notes after hours, with no written rule about what PHI may never leave the EHR. The same split now sits inside accounting and law: the staff member finishes the binder, the partner still sells the hour, and the file has no record of which model touched it.

US Tech Automations readers in tax and CAS already feel this in the stack they own. The comparison that matters is not "AI versus no AI." It is "AI with a review gate and a price" versus "AI as a private tab." Firms shopping practice-management software or tax engines such as Drake, ProConnect, and UltraTax still have to answer the same three questions those tools cannot answer for them: what is allowed, who signs, and how the invoice changed.

What the surveys actually measured

Gartner ran a 2026 webinar poll of 743 audit professionals. IT-Online reported the results on 13 August 2026: 93% of audit leaders reported some AI use, and 38% had an AI strategy. James Bourke, a director analyst in Gartner's Risk & Audit practice, said current GenAI use in internal audit concentrates on isolated tasks such as engagement preplanning, drafting audit issues, and reviewing drafts, not on transforming audit processes or delivering better strategic insights.

The same poll broke use by task. Less than a third used AI for audit testing (30%). Only 12% applied it to quality-assurance reviews. In reporting, 60% used it to draft audit issues, ratings, or reports; 41% used it to review drafts; and 35% used it to prepare stakeholder communications. Thirty-seven percent used it for general productivity such as email or translation. At the department level, 35% used it for risk assessment and audit planning, and 26% used it for knowledge management. Gartner analysts told IT-Online that pointing only at adoption or productivity underrepresents, and can miss, AI's effect on audit outcomes.

Legal practice shows the same split with different numbers. According to Clio's 2025 Legal Trends Report, 79% of legal professionals use artificial intelligence in their firms. Clio surveyed 1,702 U.S. legal professionals and analyzed aggregated data from tens of thousands of practitioners. Growing firms (revenues up more than 20% over four years) used AI in Clio twice as much as stable and shrinking firms. Thirty-six percent of legal professionals said AI had a positive influence on revenues; among wide adopters that share jumped to 69%. Clio's hub and the 2025 solo and small-firm cut both treat billing and policy as the lag, not awareness of the tools.

| Audit AI use case (Gartner 2026 poll) | Share of respondents |
| Draft audit issues, ratings, or reports | 60% |
| Review drafts | 41% |
| General productivity (email, translation) | 37% |
| Stakeholder communications | 35% |
| Risk assessment and audit planning | 35% |
| Audit testing | 30% |
| Knowledge management | 26% |
| Quality-assurance reviews | 12% |

Sources: IT-Online summarizing Gartner's 2026 webinar poll of 743 audit professionals.

The mechanism, in plain language

Staff reach for a model because it is faster than a blank page. Partners still run the firm on hours, because hours are how utilization, realization, and lockup are tracked. IT still treats the model as a personal productivity app, because nobody filed a purchase order. The file still has to survive a reviewer, a peer-reviewer, a regulator, and, in tax, Circular 230. Those four clocks do not share a calendar, so the work product moves while the control environment stays still.

That is why the gap is not "we need more AI." The Gartner poll already shows high use. The missing objects are a named owner, an approved-tool list, a data-handling rule, a review step that is actually performed, and a price that does not pretend the hour is unchanged. Journal of Accountancy risk writing in July 2026 put the same list in CPA-firm language: define the tools, limit them to vetted systems, keep confidential data out of consumer models, verify citations against primary sources, and document prompts and review in the file.

CPA.com's 2025 AI in Accounting Report described firms automating more than 80% of individual tax-return preparation with AI-assisted tools, and cutting document-analysis time in audit and advisory by 50% or more. Vendors in that report claimed time savings of 30–70% on reconciliations, coding, and close. Those cycle-time cuts are the mechanism that breaks hourly billing. If the return that used to take four hours now takes forty minutes of human review, a firm that still invoices four hours is either overcharging or hiding the model. IRS OPR told practitioners as of June 2026 to "fairly credit to the client's account any cost reductions" and warned that charging for time not spent can raise an unconscionable-fee issue under Circular 230.

Why the constraint broke now

Three clocks lined up in 2025–2026. First, consumer models became good enough at first drafts that staff stopped waiting for a firm license. Second, clients started arriving with their own drafts, which Clio recorded in lawyer interviews and in the finding that 82% of legal professionals expect to use AI more in the next 12 months. Third, regulators stopped treating AI as a future topic. The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and became applicable on 2 August 2026, with transparency rules also timed to August 2026 and high-risk system obligations later (2 December 2027 on the Commission's current timeline). artificialintelligenceact.eu tracks the same text for small businesses that sell into the EU.

Inside the firm, the 2025 Microsoft Work Trend Index measured a capacity gap: 53% of leaders said productivity must increase, and 80% of the global workforce said they lacked enough time or energy. Microsoft surveyed 31,000 workers across 31 countries. 82% of leaders called it a pivotal year to rethink operations. Eighty-one percent expected agents to be moderately or extensively integrated into company AI strategy within 12–18 months, while only 24% said they had already deployed AI organization-wide and 12% remained in pilot. That is the same shape as the audit poll: intent and unofficial use run ahead of a governed rollout.

McKinsey's State of AI 2026 survey, published 25 August 2026, found the enterprise version of the same stall. Nearly nine in ten respondents reported regular AI use in at least one function, and 44% said AI was scaling across the enterprise, up from 38% a year earlier. According to McKinsey, 37% of respondents attribute at least some EBIT impact to AI use, unchanged from the prior year, while 80% said AI improved their own productivity. Forty percent of respondents at organizations with more than $1 billion in revenue reported scaling AI agents, versus 22% at smaller organizations, which stayed flat. About 20% said AI operating costs constrained use. Gartner's newsroom listed a 1 September 2026 survey headline that only 22% of organizations had successfully scaled AI across multiple business units.

Who wrote the control language

The strategy documents already exist. Firms that skip them are not waiting for a standard; they are leaving the binder empty.

NIST's AI Risk Management Framework (AI RMF 1.0), released 26 January 2023 as NIST.AI.100-1, is voluntary and organizes work into four functions: Govern, Map, Measure, and Manage. NIST published a generative-AI profile, NIST AI 600-1, in July 2024. On 7 April 2026 NIST posted a concept note for an AI RMF profile on trustworthy AI in critical infrastructure. ISO/IEC 42001:2023 is the management-system standard for an Artificial Intelligence Management System; ISO published it in December 2023 (51 pages). The OECD AI Principles, adopted in May 2019 and updated in May 2024, now have 47 adherents and supply the AI-system definition used in several statutes.

Audit standard-setters moved in the same window. On 5 August 2026 the IAASB proposed revisions to ISA 330, ISA 500, and ISA 520 to address audit evidence, responses to assessed risks, and technology, with comments due 15 December 2026 (consultation page; news release). The board said it chose a principles-based approach rather than naming specific tools. The PCAOB still oversees audits of U.S. public companies and SEC-registered brokers and dealers, which is why a public-company audit team's unofficial chatbot use is not a private productivity choice. IESBA released a 15 July 2026 staff publication on ethical considerations for accountants using emerging technologies, covering AI among other tools. AICPA & CIMA keeps an AI resource landing page and an audit and assurance hub. CPA.com's AI page packages build-versus-buy, due diligence, and a GenAI toolkit for firms that do not have a research desk.

Enforcement is not hypothetical. On 25 September 2024 the FTC announced Operation AI Comply, including a proposed order requiring DoNotPay to pay $193,000 after claims that an "AI Lawyer" could substitute for a human lawyer. For a CPA or attorney, the lesson is narrower than that case: do not sell a model as a licensed professional, and do not let a marketing page outrun what the tool was tested to do. CISA's risk-management overview still defines the basic loop: identify, analyze, assess, communicate, then accept, avoid, transfer, or mitigate. An AI strategy that skips that loop is a slogan.

| Survey | Adoption figure | Strategy, policy, or impact figure |
| Gartner internal audit poll, 2026 (n=743) | 93% some AI use | 38% have an AI strategy |
| Clio Legal Trends Report, 2025 | 79% of legal professionals use AI | More than half: no policy or unaware |
| McKinsey State of AI, 2026 | ~90% regular use in ≥1 function | 37% report some EBIT impact |
| Microsoft Work Trend Index, 2025 | 24% org-wide AI deployment | 12% still in pilot |
| SANS AI Survey via Journal of Accountancy, 2026 | 78% active AI use in cybersecurity (up from 50%) | 27% labeled the deployment mature |

Sources: IT-Online; Clio 2025 Legal Trends Report; McKinsey State of AI 2026; Microsoft WTI 2025; Journal of Accountancy on SANS.

USTA analysis: a 55-point spread, and a drafting skew

USTA analysis. This block uses only figures already cited above. It is arithmetic, not a new survey.

Input A, from the Gartner poll as reported by IT-Online: 93% of audit leaders report some AI use. Input B, same poll: 38% have an AI strategy. 93 − 38 = 55. The poll therefore shows a 55-percentage-point spread between "we use AI" and "we have an AI strategy." We do not treat the 55 points as a headcount of non-compliant firms. We treat it as the width of the named gap in one 743-person audit sample.

Input C, same poll: 60% draft issues, ratings, or reports with AI. Input D: 30% use AI for audit testing. Input E: 12% use AI for quality-assurance reviews. 60 ÷ 30 = 2. 60 ÷ 12 = 5. In that sample, AI is twice as common in drafting as in testing, and five times as common in drafting as in QA review. A strategy that only counts "adoption" will grade a team that drafts findings with a chatbot and never tests or reviews with AI as a success. That is the operational content of the gap.

A 10-person shop already routing bank recs and workpapers through US Tech Automations can treat a new model as a swap behind an existing review gate. The analysis above is why that gate has to sit on testing and QA, not only on the first draft.

What it changes for billing, policy, and the file

Clio estimated that as much as 74% of billable work could be automated with AI, and reported that 70% of partial-adopters had made no pricing changes, while 45% of wide adopters had. In 2024, 41% of firms billed exclusively by the hour, 54% billed both hourly and flat fees, and 59% billed flat fees exclusively or in addition to hourly. According to Clio, 70% of partial-adopters have not changed pricing at all. The 2026 solo and small-firm report states the business consequence in one line: if you still bill by the hour, AI can shrink revenue. Solo lawyers comparing Clio alternatives, Smokeball versus Clio Manage, or MyCase versus Clio Manage still have to pick a pricing rule those products will not pick for them.

| Legal billing and AI (Clio 2025 LTR unless noted) | Figure |
| Legal professionals using AI | 79% |
| Wide adopters reporting positive revenue influence | 69% |
| All legal professionals reporting positive revenue influence | 36% |
| Partial-adopters with no pricing change | 70% |
| Wide adopters who adjusted pricing | 45% |
| Firms billing exclusively hourly (2024) | 41% |
| Firms billing flat fees exclusive or plus hourly (2024) | 59% |
| Estimated billable work that could be automated | 74% |
| Expect to use AI more in the next 12 months | 82% |

Sources: Clio 2025 Legal Trends Report; Clio 2026 solo and small-firm report for the hourly-revenue warning.

Tax has a named regulator on the same point. The IRS OPR bulletin of 24 June 2026, covered by the Journal of Accountancy, said AI should augment professional judgment, not replace it; practitioners remain responsible for facts, citations, and calculations; public or unsecured models can violate confidentiality; and firm leaders must put in procedures for training, secure data handling, accuracy monitoring, and third-party tool vetting. Journal of Accountancy profiles of firms with fewer than 10 employees (1 August 2026) show the workable pattern: enterprise models only, no client data in public GPTs, a human making the final call, and, at Agate CPA, a rebuilt intake form that raised conversion about 25%. One Stop CPA's Brian Davis described finishing a multi-state M&A tax analysis in two hours by pairing a cited research tool with a human memo.

Finance departments are not exempt. Journal of Accountancy reported an Avalara survey of more than 1,500 CFOs and senior finance leaders: more than 90% faced moderate to significant career pressure to show agentic-AI ROI, 29% said the focus was entirely on speed, 7% said governance was prioritized over speed, 38% described ROI as "at scale," 50% as "limited," 36% had no one specifically responsible for understanding how agents work, and 23% said accountability for a significant AI error would be unclear. In six of seven processes, less than 15% let AI act autonomously with humans only on exceptions. AICPA PCPS MAP 2025 found only 16% of firms were "very confident" they could adapt to AI and automation over the next three years. ABA TechReport still publishes the legal-side companion: AI, practice management, and solo-firm tech as separate chapters, not as one strategy.

Cybersecurity is the warning label on "we already use it." SANS, via Journal of Accountancy, found active AI use in cybersecurity strategy rose from 50% to 78% in one year among 536 practitioners, while 63% reported significant AI shortcomings in threat detection and response (up from 45%), only 27% called the deployment mature, 78% of organizations had confirmed or suspected AI-enabled attacks, and only 16% had shifted to defending against AI-driven threats. Half of leaders said they had a formal AI risk program; 36% of practitioners said the same. A program the people doing the work cannot see is not governing the work.

Teams that already extract invoices on US Tech Automations data-extraction steps still need a written rule for what the model may never see. That sentence is the whole strategy for a four-person firm: a one-page allowed-tool list, a ban on pasting taxpayer data into consumer chats, a reviewer named on every AI-touched workpaper, and a fee that matches the new minutes.

| Microsoft 2025 Work Trend Index (31,000 workers, 31 countries) | Figure |
| Leaders who say this is a pivotal year to rethink operations | 82% |
| Leaders expecting agents in AI strategy within 12–18 months | 81% |
| Leaders confident they will use digital labor to expand capacity | 82% |
| Leaders who say productivity must increase | 53% |
| Workforce lacking enough time or energy | 80% |
| Already deployed AI organization-wide | 24% |
| Still in pilot | 12% |
| Employees who say work feels chaotic and fragmented | 48% |
| Leaders who say work feels chaotic and fragmented | 52% |

Source: Microsoft Work Trend Index 2025; index hub: Work Trend Index.

Honest limits

None of these surveys is a census of every CPA firm. Gartner's 743 is a webinar poll of audit professionals, not a random sample of all internal-audit shops. Clio's 1,702 includes Clio customers and a market panel. McKinsey's respondents skew toward organizations already paying attention to AI. CPA.com's "some firms" at 80% automation is a reported example, not a profession-wide rate. Microsoft's 24% org-wide deployment is a global cross-industry figure, not an accounting figure.

A written strategy does not make a model accurate. NIST AI 600-1 lists risks unique to or exacerbated by generative AI, including hallucinated content and data leakage. ISO/IEC 42001 is a management-system standard, not a model test. The IAASB proposals are exposure drafts until the board finalizes them. EU high-risk duties are not all live on 2 August 2026. A U.S. cash-basis shop with no EU customers still has Circular 230, state board rules, and the AICPA Code, which is enough.

Fathom versus Jirav versus Reach will not close the gap either. Reporting tools can show the new cycle time. They cannot write the policy, name the reviewer, or change the engagement letter.

Signal vs Speculation

Signal (sourced). Audit leaders report 93% some AI use and 38% an AI strategy in Gartner's 2026 poll of 743 professionals, as published by IT-Online. Clio's 2025 report finds 79% AI use among legal professionals, more than half with no known policy, 70% of partial-adopters holding price, and an estimate that 74% of billable work could be automated (read online). McKinsey's 2026 survey finds individual productivity gains (80%) far ahead of EBIT attribution (37%) (State of AI). IRS OPR, as of June 2026, applied existing Circular 230 duties to AI use (bulletin; JofA). NIST, ISO, OECD, the EU AI Act, IAASB, IESBA, FTC, and PCAOB have published the control language cited above.

Our read (12–36 months, small and mid-size firms). If the 55-point audit spread and Clio's pricing stall both hold, the firms that stay on unmodified hourly billing will show lower realization on AI-touched work even as utilization looks "better" on the dashboard, because the clock no longer measures the value. Peer review, malpractice carriers, and IRS OPR are likelier to ask for the policy and the workpaper note than for a vendor demo. Consumer-model use on taxpayer and legal files will keep generating the easy cases: leaked data, invented citations, and invoices that cannot be defended. Agentic tools will land first on recs, coding, intake, and first drafts, matching CPA.com and McKinsey, not on signing opinions. Smaller organizations will stay flatter on agent scaling (McKinsey's 22% versus 40% at large enterprises) unless they buy a workflow with the review gate already in it. That is a forecast, not a measurement.

Glossary

• AI strategy gap: The spread between unofficial AI use on live work and a written firm plan for tools, data, review, and price.

• Approved-tool list: The named systems staff may use for firm work, including enterprise versus consumer models.

• Human-in-the-loop: A required person who checks AI output before it becomes a client deliverable or audit evidence.

• Agentic AI: Software that can carry out multi-step tasks with limited prompting, still subject to human sign-off in professional work.

• Circular 230: U.S. Treasury rules for practice before the IRS; OPR has said they already cover AI-assisted tax work.

• NIST AI RMF: Voluntary U.S. framework (NIST.AI.100-1) with Govern, Map, Measure, and Manage functions.

• ISO/IEC 42001: International AI management-system standard (ISO page).

• Professional skepticism: The auditor's duty, reinforced in IAASB proposals, not to accept a model's output as evidence without evaluation.

FAQs

What is an AI strategy gap?

It is the distance between staff already using AI on real files and the firm still lacking a written strategy, approved tools, review rule, and pricing change. Gartner's 2026 audit poll, as reported by IT-Online, is the clean numeric picture: 93% some use, 38% a strategy.

Does a four-person CPA firm need a written AI strategy?

Yes, because Circular 230, confidentiality, and the signature on the return do not scale with headcount. IRS OPR said firm leaders must implement procedures for training, secure data handling, accuracy monitoring, and vetting of third-party tools. A one-page policy plus an approved-tool list is the small-firm version.

How does the AI strategy gap change billing?

Faster cycle time without a new price either overcharges the client or starves the firm. Clio found 70% of partial-adopters had not changed pricing and estimated that 74% of billable work could be automated. IRS OPR warned that billing for time not actually spent can raise an unconscionable-fee issue.

What should an AI policy cover first?

Allowed tools, banned data (taxpayer, PHI, privileged), the reviewer, and how the use is documented in the file. Journal of Accountancy walks through scope, governance, privacy, verification against primary sources, and engagement-letter disclosure.

Is pasting a tax return into a public chatbot allowed?

OPR said practitioners must use only secure, enterprise-approved AI for client data, and that willful mishandling can bring Circular 230 discipline. Journal of Accountancy's small-firm profiles describe CPAs who keep client facts out of public models and review every output.

Do EU AI Act dates matter to a U.S. cash-basis shop?

They matter if you place AI systems on the EU market or use them on EU persons in high-risk ways; they are still useful as a risk map even if you do not. The Commission page and artificialintelligenceact.eu lay out the risk tiers and the 2 August 2026 applicability date.

What is the first workflow to fix?

Pick the work that already hits a consumer model this week: 1040 organizers, invoice coding, engagement letters, or audit-issue drafts. Put an approved tool, a reviewer, and a time-to-fee rule on that one path. CPA.com frames the same choice as build versus buy; the strategy is the review gate, not the brand of model.

If you already run client files through US Tech Automations finance and accounting workflows, the missing piece is usually the strategy document, not another chat window. Map the first three workflows on agentic workflows: one intake path, one document-extract path, and one review sign-off that a partner can defend. Get benchmarks from the tables above, then write the one-page policy before the next busy season files land in a private tab.