The content on this page has been converted from PDF to HTML format using an artificial intelligence (AI) tool as part of our ongoing efforts to improve accessibility and usability of our publications. Note:
- No human verification has been conducted of the converted content.
- While we strive for accuracy errors or omissions may exist.
- This content is provided for informational purposes only and should not be relied upon as a definitive or authoritative source.
- For the official and verified version of the publication, refer to the original PDF document.
If you identify any inaccuracies or have concerns about the content, please contact us at [email protected].
Audit Tech and AI Sandbox - Terms of Engagement
The FRC does not accept any liability to any party for any loss, damage or costs howsoever arising, whether directly or indirectly, whether in contract, tort or otherwise from any action or decision taken (or not taken) as a result of any person relying on or otherwise using this document or arising from any omission from it.
© The Financial Reporting Council Limited 2026
The Financial Reporting Council Limited is a company limited by guarantee.
Registered in England number 2486368. Registered Office:
13th Floor, 1 Harbour Exchange Square, London, E14 9GE
Introduction
1The FRC, as an improvement regulator, supports innovation and the responsible adoption of technology that enhances audit quality. The Audit Tech & AI Sandbox initiative (ATAI Sandbox) aims to support audit firms looking to adopt AI, software, new products and features, or other technology to improve quality and drive better outcomes.
2The ATAI Sandbox is a safe space for collaboration with the FRC, giving participants the opportunity to explore how audit standards and guidance can be applied in practice to a technology use case. The ATAI Sandbox offers a series of dedicated engagement meetings with FRC teams; associated information sharing and review; and critical evaluation against regulatory frameworks. Through this engagement, the ATAI Sandbox also aims to increase the effectiveness and external understanding of the FRC's guidance and reports relating to AI.
3By participating in the ATAI Sandbox, participants agree to be bound by these Terms of Engagement.
4These Terms of Engagement may be varied by the FRC at any time by giving reasonable notice in writing.
Participants
5Participation in the ATAI Sandbox is open to UK-registered audit firms across the market who are looking meet our published eligibility criteria.
6Participation will be voluntary and via application form and selection. The FRC will assess an applicant's suitability for the ATAI Sandbox based on the information set out in their application against our published assessment criteria. The FRC's decision will be final.
7Where demand exceeds capacity, the FRC will consider how to allocate available places, which may include prioritising applications which enable the sandbox cohort to be more representative of the diversity of the market. We aim to accept a range of applicants to represent different parts of the audit market (e.g. in terms of firm/audit practice size) and different technologies.
8Participants are expected to engage with the ATAI Sandbox in an open, honest, transparent, and cooperative manner. Participants are also expected to respond to reasonable requests for information from the FRC in a timely manner.
9Each participant is responsible for determining which of its staff will be actively involved in the ATAI Sandbox.
10As a condition of participation, each participant must ensure that all members of its staff involved in the ATAI Sandbox are aware of, and agree to comply with, these Terms of Engagement, including, but not limited to, the obligations in respect of confidentiality.
11Participants may withdraw from the ATAI Sandbox at any time, at their discretion, by giving written notice to the FRC.
Operation of the ATAI Sandbox
12It is expected that participation will involve three individual meetings of 1.5 hours each, over a period of three to four months, with time for review between meetings. This may vary by agreement with participants.
13It is estimated that in total, the cumulative time commitment should not be more than 30 hours but, other than the meetings, it will be up to the participant how much time and resource they commit.
14In-person, virtual or hybrid meetings can be agreed and scheduled by agreement with the participants.
15A Participant may, with the FRC's approval, involve their third-party technology or service provider in the participant's engagement with the FRC in relation to the ATAI Sandbox (for example, by accompanying the participant to its meetings with the FRC). A Participant who wishes to involve their third party technology or service provider must first obtain that provider's written agreement to these terms of engagement as if the provider were a Participant, and any such provider must specifically agree to the confidentiality provisions outlined below as if the provider were a Participant for the purpose of those provisions.
16Following acceptance into the ATAI Sandbox, a plan will be developed and agreed with the participant to address specific areas of interest. Due to the nature of the ATAI Sandbox, no specific output or outcome is presumed or guaranteed. The operation of the ATAI Sandbox will be governed by the confidentiality provisions outlined below.
17The scope and depth of engagement with each participant will depend on the nature of the proposed use of technology, the stage of development, and the resources available to the FRC. Participation in the ATAI Sandbox does not guarantee that the FRC will undertake any particular form or level of engagement.
18The FRC will consider, on a case-by-case basis, how to communicate relevant findings from the ATAI Sandbox. This may or may not result in formal guidance, interpretations or amendments to standards.
19Participants acknowledge that the FRC has certain statutory exemptions from liability, including but not limited to, the exemption from liability set out in regulation 2 of the Companies (Bodies Concerned with Auditing Standards etc) (Exemption from Liability) Regulations 2016. For the avoidance of doubt, the FRC does not accept any liability to any party for any loss, damage or costs howsoever arising, whether directly or indirectly, whether in contract, tort or otherwise from any action or decision taken (or not taken) as a result of participation in the ATAI Sandbox (or otherwise from using this document, or arising from any omission from it).
20If a dispute arises between any participant(s) and the FRC in relation to the ATAI Sandbox the participant(s) and the FRC shall enter into discussions with the objective of resolving the dispute without undue delay.
21Participants will complete an evaluation survey on conclusion of their engagement in the ATAI Sandbox.
Regulatory Position and Non-Reliance
22While discussions in the ATAI Sandbox may consist of challenges and potential solutions for audit firms, the FRC does not 'pre-approve' specific technologies, methodologies or approaches as being compliant with standards or guidance. Nothing that is discussed within the ATAI Sandbox should therefore be considered to constitute endorsement of, or 'approval' by, the FRC of any particular AI, software, products and features, or other technology use in audit, or a formal requirement or guidance. In addition, the FRC will not undertake an examination of risk for the participant in adopting any proposed approach discussed during the ATAI Sandbox.
23The participant is not required, as a result of discussions in the ATAI Sandbox, to comply with, or implement, any proposed approach and, the participant remains responsible for their compliance with all legal and regulatory obligations.
Sandbox Webpage
24A dedicated ATAI Sandbox webpage is hosted on the FRC's website. This includes details on how to apply to participate as well as a summary of the ATAI Sandbox.
Confidentiality
25The ATAI Sandbox is intended to be a safe space to allow robust and transparent dialogue. Confidentiality is a fundamental principle for the operation of the ATAI Sandbox. Participants must therefore treat as confidential any information, data or discussions shared or generated within the ATAI Sandbox, unless explicitly advised otherwise by the FRC in writing. Information that is or comes into the public domain, other than through an unauthorised disclosure, is not confidential.
26A participant must exercise due care to protect such confidential information or prevent the unauthorised disclosure thereof, and must not, without the FRC's prior written consent, during the participant's involvement in the ATAI Sandbox or at any time thereafter:
- Disclose such confidential information to any third party that is not participating in in the ATAI Sandbox accordance with clause 15.
- Use such confidential information for the participant's own benefit (other than in the proper course of participation in the ATAI Sandbox), the benefit of any third party, or for purposes other than those of the FRC.
27Participants are not restricted from disclosing to any third party or publicly that they are participating in the ATAI Sandbox. The explicit written consent of the FRC must be sought for any more detailed disclosures.
Information Sharing
28The ATAI Sandbox will operate on the basis of a rebuttable presumption that information provided to the FRC, by participants, for the purposes of the ATAI Sandbox, will not be disclosed outside the FRC, without the participant's consent or unless the FRC is required by law to do so.
29This presumption may be rebutted where the disclosure:
- is deemed by the FRC to be in the public interest, including where issues are identified that may give rise to significant risks to audit quality or other matters of regulatory concern; or
- is required to enable the FRC to fulfil its statutory or regulatory functions, including coordination with supervisory, inspection or enforcement activities; or
- consists only of appropriately anonymised or aggregated information or themes (except that the FRC may disclose the identities of participants where agreed).
30Disclosure decisions will be made with regard to the General principles for considering the public interest in our work, published by the FRC in November 2022.
31Information may be shared within the FRC where such sharing is for the purpose of facilitating the carrying out by the FRC of any of its functions, including supervisory activities.
32The FRC may publish appropriately anonymised or aggregated information on its website about participation in the ATAI Sandbox (e.g. case studies). In the event the FRC wishes to publish information on its website about participation in the ATAI Sandbox which is not appropriately aggregated or anonymised, it will liaise with the participant(s) to whom such information concerns with a view to agreeing the content of the proposed publication.
Data Protection
33Participants and the FRC are separate and independent controllers of personal data (Data) for the purposes of UK data protection law.
34Participants and the FRC will comply with any obligations that they have under UK data protection law which arise in connection with these Terms of Engagement and will:
- process any Data only for the purposes of these Terms of Engagement or for compliance with any legal or regulatory obligation;
- not disclose the whole or any part of the Data to any third party, except to the extent reasonably necessary for the purposes of these Terms of Engagement, and/or as required under UK data protection legislation or other applicable law or regulation;
- put in place and maintain appropriate technical and organisational measures to protect the Data against unauthorised or unlawful processing and against accidental loss, alteration or destruction of, or damage to, such Data;
- not unlawfully process or permit the unlawful processing of Data;
- not perform their obligations under these Terms of Engagement in such a way as to cause the other party to breach any of their respective obligations under Data Protection Legislation;
- promptly notify the other Party of:
- any breach of the security requirements referred to in clause 32(c); and
- any complaint, request, notice or communication in relation to the Data if such breach, complaint, request, notice or other communication is relevant to the other party.
35The FRC will process personal data in accordance with its Regulatory Privacy Notice.
Financial Reporting Council
London office:
13th Floor, 1 Harbour Exchange Square,
London, E14 9GE
Birmingham office:
5th Floor, 3 Arena Central, Bridge Street,
Birmingham, B1 2AX
+44 (0)20 7492 2300
Follow us on LinkedIn