AI and statutory audit: what the Big 4 have deployed, and five moves for a UK firm

In February 2026, the Financial Times found a line in KPMG International's Companies House filings. The fee paid to Grant Thornton UK, its own auditor, had fallen from $416,000 to $357,000 in a year. Fourteen per cent, in dollar terms, exchange effects included.

The argument KPMG's group finance director put during the negotiation was short: AI makes audit work cheaper, so share the saving. With the possibility of appointing someone else sitting quietly in the background.

Your clients will reach the same conclusion, a year or two behind. So the question is no longer whether AI changes statutory audit. It is which of you turns up first with the number.

Your regulator got there before Brussels

The regulatory position is widely misunderstood on both sides of the Channel, so it is worth setting out.

The UK has no cross-cutting AI statute. The House of Commons Library put it plainly in June 2026: there is no AI-specific legislation covering AI as a technology. Policy leaves it to existing regulators applying existing powers at the point of use. For audit, that regulator is the FRC, and the FRC has already written.

The EU AI Act may still reach you, but only on a specific test. Article 2(1) catches deployers established outside the Union where the output produced by the AI system is used in the Union, and it catches any group entity established in a member state. A purely domestic UK audit sits outside. An audit of the UK subsidiary of a German group probably does not. That distinction is worth ten minutes of a partner's time, and almost nobody has run it.

On electronic invoicing, the British timetable is nothing like the French one. Government confirmed in November 2025 that the UK will mandate e-invoicing for all VAT invoices, business to business and business to government, from April 2029, with Peppol as the core interoperability network, and a roadmap of milestones due at Budget 2026. That is a long runway. Anyone selling you urgency on it is selling you something.

What the FRC has done matters more, and it all happened in the last eighteen months. In June 2025 it published a thematic review of automated tools and techniques across six firms: BDO, Deloitte, EY, Forvis Mazars, KPMG and PwC. In March 2026 it published Generative and Agentic AI Guidance, which it describes as the first from any audit regulator globally. In June 2026 it opened an audit technology sandbox, explicitly open to firms of all sizes. And in July 2026 its Annual Review of Audit Quality noted that a gap between the largest and smallest firms persists, particularly on investment in systems of quality management.

Read that last point again if you run a firm outside the top six. Your regulator has said in print that the smaller end of the market is falling behind on systems. AI will widen that gap or close it, depending on what you do in the next twelve months.

What the Big 4 have actually put into service

A note on the figures below. Those marked [firm-stated] come from the firms themselves and have been checked by nobody. The rest come from a primary source: an official announcement, a regulatory text, a regulator's publication, or filed accounts.

A note on vocabulary too. The press routinely conflates consulting platforms (Zora AI at Deloitte, Workbench at KPMG) with audit platforms. Only the second kind concerns us here. Those are the ones that end up in the audit file.

KPMG embedded agents in Clara from April 2025. The tasks it hands them are revealingly ordinary: vouching expenditure, searching for unrecorded liabilities and accruals, analysing provisions and estimates, working through disclosure checklists. Its AI Transaction Scoring tool, built with MindBridge, scores 100% of transactions using 32 simultaneous control points.

EY brought a multi-agent framework into EY Canvas in April 2026, running on Microsoft Azure. The firm reports more than 1.4 trillion lines of journal entry data processed a year [firm-stated] and expects its agents to support all end-to-end audit activities by 2028. An expectation, not a committed number.

Deloitte gave Omnia an agent network in June 2026. One detail should interest whoever runs your training: some agents operate in tutor mode and deliver micro-training in the flow of the work itself, rather than in a classroom.

So much for the shop window. The other side is worth remembering. In October 2025 Deloitte Australia refunded part of a A$440,000 public contract, after a report delivered to the employment department turned out to contain more than a dozen fabricated academic references and to cite a Federal Court decision with paragraphs that did not exist and the wrong judge named.

Nobody is measuring what any of it does

Back to that FRC thematic review of June 2025. Its finding fits in one sentence: none of the six firms carried out formal monitoring to quantify the audit quality impact of using automated tools, and the one firm that had indicators tracked usage rates rather than outcomes. Sixteen months on, no impact data has been published by anyone.

That is where your advantage sits, and it costs nothing beyond the discipline of keeping a spreadsheet for six months.

Your direct competitors have already moved

The comfortable assumption is that this is a Big 4 problem funded by Big 4 money. The UK mid-tier has spent the past eighteen months proving otherwise.

Grant Thornton UK committed £500m in January 2026 to rebuilding its operating model across audit, tax and advisory [firm-stated]. In June 2026 it launched GT Augment, its AI governance and implementation framework, and began rolling Anthropic's Claude out to every partner and employee. Chief executive Malcolm Gomersall's line is worth borrowing: clients don't pay for process, they pay for judgement.

BDO UK partnered with MindBridge in June 2026 to extend AI-driven general ledger analysis across its audit practice, in time for the coming year ends. RSM UK announced a partnership with the AI consultancy IntellixCore in July 2025, including a dedicated AI lab. Forvis Mazars in the UK reported audit and assurance growth of 21% for its year to August 2025 and describes targeted investment in AI-enabled tools, without naming a platform or a figure.

None of these firms is your size. None of them is Deloitte either. And the direction of travel is identical in every case: buy the capability, do not build it.

The people question is not the one being asked

The talent shortage story is loud. The UK data says something more specific.

The Institute of Student Employers found graduate recruitment down 8% between 2023/24 and 2024/25, the weakest year since 2021. Within finance and professional services, graduate hiring fell 8% while school and college leaver hiring rose 24%. Among employers recruiting both, the ratio of graduates to school leavers moved from 3.4:1 to 2.5:1. High Fliers puts the three-year decline at the UK's top employers at 24.5%.

Note what the ISE itself concludes: AI has not directly caused the fall in volumes. The substitution running through the numbers is graduates for school leavers and apprentices, not people for machines.

The Big 4 intakes tell the blunter version. The Telegraph reported in June 2025 that 2024 UK graduate intakes had fallen against 2023 at all four: KPMG from 1,399 to 942, Deloitte 1,700 to 1,400, EY 1,800 to 1,600, PwC 1,600 to 1,500.

Yet the counter-evidence is real and recent. PwC UK reported 60,000 applications for 2,000 places in February 2026, up 35% year on year, and says it has deliberately kept some manual work in place for junior development. Grant Thornton UK increased graduate and school leaver recruitment by 30% in 2026. Nobody in the UK profession is behaving as though the entry level has closed.

Which brings us to the question I have not seen properly asked. Researchers have lodged a registered study with the US audit regulator testing a specific hypothesis: that junior auditors build professional judgement by performing precisely the tasks AI automates first. It has no results yet, and that needs saying. But a 2026 paper in the Journal of Accounting Research, drawing on 277 accountants and transaction data from 79 SMEs, already finds that experienced accountants selectively intervene when the machine's confidence is low. Expertise and AI are complements, in that study. It does not tell us how the next generation acquires the expertise.

Five moves worth making

1. Write the policy your regulator will ask to see

Three pieces cover it: an AI usage policy, a named owner, and a documented training plan.

You are not starting from nothing, though you will have to assemble it. The FRC's Generative and Agentic AI Guidance sets out three audit quality risk categories and four mitigation areas. The CCAB launched an AI Hub in July 2026 with a draft ethics statement and six case studies, one on AI in audit evidence collection, still at exposure draft stage. The nearest thing to a fill-in template is Irish: CCAB-I Technical Alert 01/2025, honest enough to call itself pointers rather than a silver bullet. The ICAEW's Ethics and AI guide covers governance and vendor due diligence, and states outright that it provides no template.

One thing worth knowing: the technology-related revisions to the IESBA Code, covering professional competence, automation bias and the assessment of technology outputs, have been binding since December 2024. That is not guidance you might adopt. It already applies to you.

2. Run the AI Act scoping test once, and write down the answer

Ten minutes, one page, and it stops the question recurring at every partner meeting.

Two questions decide it. Do you have a group entity established in an EU member state? And does output from any AI system you deploy get used in the Union, in a memo or a deliverable that reaches an EU parent or an EU-based client? If either answer is yes, Article 4 on AI literacy applies to you, and has done since February 2025, with national supervision live since August 2026.

The obligation is lighter than the headlines suggest. It was rewritten in July 2026 to require firms to support the development of AI literacy rather than guarantee a level of it, which makes a documented training plan sufficient. But you need to know which side of the line you are on, in writing.

3. Move one cycle to full population testing

This is the most tangible methodological change AI brings to audit, and you rent it rather than build it. The Big 4 are customers of this software layer themselves. KPMG runs on MindBridge; all four use DataSnipper; BDO UK signed with MindBridge in June 2026 for exactly this.

Pick one cycle, purchases and payables for instance, one client, one year. Measure before and after: hours spent, anomalies raised, anomalies confirmed after human review.

4. Measure the audit quality effect, because nobody else is

Then publish the result internally, including when it disappoints.

This is not a stylistic flourish. Not one of the six largest UK firms could produce that measurement when their regulator asked for it. If you have it, you have something scarce, and it will read well in your next inspection.

5. Price the effect before your client does it for you

Back to KPMG and Grant Thornton. What that negotiation tells you is that the argument arrives from the client's side, and it arrives with a number attached.

You can take that conversation or you can start it. Starting it means knowing, file by file, which hours the tools genuinely removed and which they simply shifted into review. Without that split, the fee discussion gets settled on instinct, and rarely in your favour.

Take three representative files, rebuild the hours budget before and after, and sort it into three buckets: what disappeared, what moved into review and judgement, what did not shift at all. The third is your floor, the second is your value proposition, the first is your negotiating room. US survey evidence, incidentally, shows audit fees broadly stable alongside what its authors call a value perception gap: faster processing without a matching increase in insight. That gap is where your pricing conversation lives.

A word on sustainability

The UK position is easy to misread because it looks like the EU one and is not. UK Sustainability Reporting Standards S1 and S2 were published in final form in February 2026, and they are voluntary. Assurance follows the same pattern: government decided in January 2026 on a voluntary, profession-agnostic registration regime run by the FRC, with statutory underpinning waiting on amendments to the Companies Act.

So this is not a compliance deadline. It is a market access credential, available early, to firms that build the capability before anyone asks for it.

Separately, if you audit UK groups with European operations, the revised EU regime now catches third country groups only above €450m of EU turnover with a subsidiary or branch above €200m, for financial years beginning on or after 1 January 2027. Both thresholds, not either.

Where to start

None of these five moves needs Big 4 money. All of them need a decision and a name against each line.

There is a structural fact worth ending on. There were 3,760 registered statutory audit firms in the UK in 2024, down 6.9% in a year and roughly a quarter since 2020. The market is consolidating whatever happens next. The firms that come through it will be the ones that can say what their technology actually does, and charge accordingly.

If you want to place your own firm before committing to anything, the readiness assessment takes about twenty minutes and gives you a scored starting point rather than a brochure.

Take the Free Readiness Assessment