Air-gapped AI for chartered accountancy firms in India
Your clients' books, in an AI, in your office. Nothing goes out.
No consent conversation with the client. No third party in the chain of custody of somebody else's financials. No paragraph to write for a peer reviewer explaining where the working papers went.
The problem is not the technology. It is the custody.
You hold your clients' data in trust. That obligation is not delegable to a vendor's privacy policy, and it does not have an exception for software that is useful.
The Code of Ethics is unambiguous about confidentiality of client information, and it does not distinguish between disclosing information to a person and routing it through a service. Under the DPDP Act your firm is handling personal data on behalf of clients, with the obligations that follow — purpose limitation, security safeguards, breach notification, and the restrictions that apply to transfers outside India. Meanwhile your clients' own engagement terms increasingly prohibit third-party processing outright, and their auditors ask about it.
None of that is an argument against using AI. It is an argument about where the machine sits.
Not legal advice. This page describes professional and statutory obligations in general terms so that a partner can place them against an architecture. It is not a legal opinion, it is not a substitute for your own reading, and where the amounts are large it is not a substitute for counsel. Reviewed by external counsel. Last reviewed 31 July 2026, and re-checked when the rules change.
The part nobody says out loud
Your staff are already doing it.
Not maliciously. An article assistant with four hundred pages of a client's ledgers, a deadline, and a phone in their pocket is not being reckless — they are being effective. You suspect it, you cannot prove it, and a firm-wide instruction not to has never once stopped it anywhere.
The reliable fix is not a policy. It is an internal tool that is better on your firm's own material than the one on their phone, because it has read every file your firm holds and their phone has not. A firm that bans AI has more leakage than a firm that provides it.
What a CA firm actually does with it
Not a product tour. The five things partners ask for first.
Every prior year, searchable
Thirty years of working papers, notes to accounts, management representations and audit files, retrievable by question rather than by folder. "What was the depreciation policy we accepted for this client in FY19, and what did the partner note say about it." Answers cite the source page, so you verify in one click.
Audit-season document work
Bank statements, ledgers, GST returns, Form 26AS, TDS reconciliations and the client's own inconsistent Excel — read, extracted and cross-checked against each other, with the disagreements flagged rather than silently resolved. The machine does the first pass; your senior does the judgement.
Drafting against your own precedent
Notes to accounts, qualifications, management letters and reports drafted in your firm's house style, because it was built on your firm's previous work rather than on the internet's.
Statute and standard recall
Your own annotated library — the Act, the standards, circulars and internal memoranda as your firm holds them — queried in plain language. Not a substitute for a technical partner's reading; a very fast way to find what to read.
Recorded meetings and vernacular material
Board meetings, management interviews and client calls transcribed on the same machine, including Hindi, Kannada, Tamil and Marathi, with nothing sent to a transcription service.
The honest limits
Financial tables are where current document models are weakest. Their text recognition is strong; their table and formatting fidelity is not, and for a firm reading balance sheets and Form 26AS that gap is exactly where an error becomes expensive.
We engineer around it rather than talk around it. Retrieval runs on the page image, so finding the right document never depends on character recognition. Extraction of tabular financial data uses a vision-language model rather than a plain OCR model. We run two extractors and flag the disagreements for a human instead of quietly picking one. Every figure the system presents links back to the source page image, and it never presents a financial figure as authoritative without that link. That is a hard product rule and it is written into the contract.
It is still a very fast, very well-read article assistant that must be checked. We train your people to treat it as exactly that.
Sizing, for a firm your size
Illustrative configurationA 22-partner practice, 90 staff, four offices with one server location.
Sentinel
A workstation-class machine with 192GB of GPU memory in a locked cabinet in the Bengaluru office, on a dedicated 16A circuit with twenty-four-hour cooling. Eight models: a flagship reasoning model, a faster one for routine work, the multimodal retriever and reranker, the document model, real-time and Indic speech-to-text, and speech synthesis. Your corpus onboarded up to two and a half lakh pages across five document sources, with a citation-linked interface and an evaluation harness built on your own files. Two days of training on site for up to twenty-five staff, and an administrator's runbook.
One capital figure, then an annual service figure. Both are published on the pricing page.
Both exclude GST, which you recover as input credit. The annual figure covers four on-site visits — two of them full model upgrades — phone support for two named administrators, monthly health reporting, quarterly filter and thermal service, return-to-base hardware replacement with a loaner, and an annual air-gap integrity audit with a written attestation. The first year is mandatory; we do not install a system we are not maintaining.
Eleven to fourteen weeks from assessment to handover, subject to GPU lead times.
Why a partnership finds this easier to approve than a subscription
It is capital expenditure, and for a partnership that is a feature rather than a shape of bill.
A per-seat subscription charges you more the more successful the rollout is, renews under someone else's terms, and arrives with an annual increase letter from a counterparty in another country. This is a depreciable asset with a three-to-five year life that the partners own. The thirtieth user costs nothing. There is no renewal negotiation.
There is a second comparison worth putting in front of the partners, stated once and without embellishment. A firm of your size already spends a meaningful annual sum on frontier subscriptions — and cannot put its clients' books, its working papers or anything under an engagement letter into them. You are paying for capability you are professionally barred from using on most of your own work. The point is not that this is cheaper. It is that this applies to the eighty per cent of the material that is currently off-limits to AI entirely.
And the risk framing is the one your partnership already uses. Do not weigh this against hours saved; partners discount productivity claims by ninety per cent, correctly. Weigh it against the largest sum this firm could lose in a single afternoon — one client discovering their books were processed by a foreign service, one peer-review finding, one letter asking where the data went.
We write the one-page memo for the partners' meeting, in the register your partnership actually reads. If it helps, we will come and answer the sceptical partner's questions ourselves. That conversation goes better with us in the room than with you defending it alone.
Who should not buy this
- A firm whose work is not confidential does not need us. If your practice is largely compliance filing on data the client would happily publish, a cloud subscription is cheaper, better, and the correct answer.
- A sole practitioner or a five-person firm. The economics do not work below roughly fifteen users, and we will say so at the consultation rather than sell you something small.
- A firm that wants the very top of the capability curve for general business writing. Keep a cloud tool for that. Most of our clients run both, and we will tell you which jobs belong where.
- A firm whose premises cannot take a dedicated circuit and twenty-four-hour cooling in a lockable room. We will find that at the survey, before you have spent anything meaningful.
Questions from CA firms
Does using a cloud AI on client data breach the Code of Ethics?
That is a question for your own reading and, if the amounts are large, for counsel — we publish a long analysis and we do not sell certainty about it. What we would observe is narrower and harder to argue with: an obligation of confidentiality is easier to demonstrate to a peer reviewer, a client or a regulator when the material physically could not have gone anywhere. An architectural answer does not require anyone to interpret a clause.
Will this make my firm DPDP compliant?
No, and any vendor who says it will is selling you a certificate they cannot issue. Compliance is a set of obligations about consent, purpose, retention, security and notification, and most of them are about how your firm operates. What this changes is the hardest one to discharge and the easiest one to fail: where the data goes. It supports your obligations. It does not satisfy them.
We are unreachable from August to September.
We know. Audit deadlines run through late September and quarterly filings take January. The productive months for a CA firm to look at this are November and December, and a deployment contracted then is live and trained before the next season. We plan around your calendar rather than ours.
Our data is a mess. We are not ready.
Almost nobody is, and it matters less than it seems — a large part of what we build is the retrieval layer that makes disorganised material usable without reorganising it first. What we do need to know is where things live and who should see what, and establishing that is most of the assessment. If it turns out you genuinely are not ready, we will tell you and hand the work back. We would rather have a client in eighteen months than a poor deployment now.
Can different teams be walled off from each other?
Yes, and for most firms that is the first thing configured. Access is defined by group and by client, mirroring the arrangements you already run for conflicts and for statutory audit independence. The access model is a written deliverable of the assessment, agreed before anything is installed.
Can it read Kannada and Hindi documents, and scanned files?
Mostly, and the assessment tells you exactly where the edges are before you commit. We install Indian-built, permissively licensed models for Indic language work alongside the main model, and dedicated speech and document models for recordings and scanned material. Legacy document systems vary — some integrate cleanly, some need a nightly export, some are not worth touching. We will show you which of yours is which, in writing, at assessment stage.
Start with the ICAI and DPDP analysis.
If you have got this far, the useful next thing is not a call. It is the analysis of whether client data can go into a cloud AI at all — around four thousand words, reviewed by external counsel, and free of any attempt to sell you something. The firm AI-use policy template is there too, for the partner who has to write one this month.
When you want to talk: a forty-five minute consultation, no charge, mutual non-disclosure agreement pre-signed and attached to the invitation. Then a paid assessment, credited in full.
Physics, not promises.