AI and the NVKM: how AI use fits into your quality system

On 1 January 2027 the transitional arrangement of the NVKM expires. From that date, practices without a Wta licence, including the typical compilation practice, will also work with a quality system based on the Further Regulations on Quality Management. That makes 2026 the implementation year: the year in which objectives, risks and control measures have to be put on paper.

At the same time, AI is knocking on the door of that same practice. Many firms wonder whether they need to arrange this in their quality system already. The answer is yes. The good news is that AI use fits surprisingly neatly into the system you are building anyway.

What has to be in place on 1 January 2027

The NVKM replaces the NVKS and brings the international ISQM approach to every firm. The core is this: you set quality objectives, you identify and assess quality risks, you put control measures in place and you monitor the whole thing, with remedial measures where needed. On top of that comes an annual evaluation of the effectiveness; the first follows after the financial year in which your system is running.

There is no longer a lighter regime for small firms, but the system is scalable. You take into account the nature and size of your firm and your engagements. A compilation firm need not describe anything about assurance, and the NBA stresses that you do not have to buy software: working it out in Word or Excel is enough. Start with your core risks instead of writing down eighty risks.

For small firms the NBA also published a step-by-step plan in March 2026 with eight steps, from appointing a project leader to setting up monitoring. So anyone starting in the second half of 2026 has a concrete roadmap.

Give AI a place in the same system

Since June 2026 there has been a clear answer to the question of whether AI belongs in your quality system. In their joint guidance on applying AI, the NBA and NOREA write that an audit organisation must include the requirements for AI use in the quality management system, with an explicit risk analysis for each AI application.

In NVKM terms this is familiar territory. AI tooling falls under the resources component, and you follow the same route as for any other resource: what do I want to achieve with it, what can go wrong, which measure do I put against it? The guidance names the risks you should cover in any case: a black box you cannot account for, AI output used in itself as audit evidence, and client data ending up in the free versions of public chatbots.

We believe this means you do not have to treat AI as a threat. A risk that you name, assess and cover is exactly what the NVKM asks of you; the difference between responsible and irresponsible AI use lies not in the technology, but in whether you control it. Also keep an eye on the EU AI Regulation, which is due to be largely in force from August 2027. You can read what it asks of smaller organisations in our article on the EU AI Regulation.

From risk to measure: this is what you record

If you work with an AI connector on your accounting package, the control measures almost write themselves.

Who uses the connector, and with which permissions. Record which employees have access and what they are allowed to do. With Exact AI Connect you set write permissions per role, put employees on read-only if you wish and limit the number of changes per day. You can read how to set this up in our article on setting permissions.

A confirmation step before every change. The AI never carries anything out unasked. Every creation or change is first a proposal that an employee explicitly confirms. That is a control measure as the NVKM intends it, and it sits in the system itself rather than in an instruction that someone might forget.

A supplier assessment. Treat the AI connector like any service organisation you work with. Ask about ISO 27001 certification and an independent pentest; Exact AI Connect has both. Also ask further about data storage. With Essentials no financial data is stored: every question goes straight to the accounting package. With Analytics the large analyses run on a secured copy of the administration within the EU, which is deleted as soon as you stop.

Recording of usage. The guidance wants it to be traceable how AI outcomes have been assessed and used: which prompts, which verification steps, which conclusion. Start practically, with a fixed set of control questions that the office has validated. That way the prompt catalogue the guidance calls for grows on its own, and every employee knows which questions fall within the policy.

Turn it around: AI as an ally of your monitoring

The same guidance describes AI not only as a risk to be controlled, but also as an aid in quality control itself. AI may flag file documentation for inconsistencies and missing substantiation, as long as the application only makes suggestions and adjusts nothing on its own. And the NBA roadmap stresses that monitoring may be scalable, suited to the size and risks of your office.

There is a practical advantage that is rarely mentioned. AI use through a connector with fixed permissions and a confirmation step is reproducible behaviour, and reproducible behaviour you can describe, test and evaluate. Loose cut-and-paste sessions in a free chatbot you cannot. The office that channels its AI use has more to show at the annual evaluation with less work.

Example prompts for your prompt catalogue

Validated control questions are the first building block of controlled AI use. They fit into almost any compilation file:

Are there any entries in this administration on the suspense account?

Which general ledger accounts deviate more than 25 percent from last year this year?

Which debtors have been outstanding for longer than 60 days?

List the reconciliation checks for the file: VAT categories, intermediate accounts, debtor/creditor ageing.

Want to try it yourself? Start for free with Exact AI Connect →