THE IESBA CODE AND THE EU AI ACT: NORMATIVE GAPS AND GOVERNANCE IMPLICATIONS FOR ROMANIAN ACCOUNTANTS

Abstract

The IESBA Code of Ethics (2023) does not mention artificial intelligence, automation bias, or large language models. The EU AI Act (Regulation EU 2024/1689) does so, imposing binding obligations on accounting organisations deploying AI in high-risk contexts, with full implementation required by August 2026. This study maps the normative gap between these two instruments and assesses its practical consequences for Romanian accounting practitioners. The analysis combines normative comparison of the IESBA Code against the AI Act, scenario-based risk assessment calibrated to the Romanian professional market, and deductive synthesis into a governance framework, drawing on secondary empirical evidence from the Special Eurobarometer 554 (European Commission, 2024) and the AICPA & CIMA Future-Ready Finance Survey (2025). Two critical gaps have been confirmed: the objectivity principle contains no provision for automation bias, and the confidentiality principle does not address the processing of client data by third-party AI systems. Both gaps are structurally worsened in Romania, where sole practitioners are the majority, enterprise AI with contractual data protection is financially out of reach for most practices, and the fiscal legislative framework changes frequently, making LLM outputs unreliable for tax interpretation. The only point of genuine normative convergence-the human oversight requirement shared by the IESBA competence principle and AI Act Article 14-remains aspirational rather than practical, given the absence of any AI guidance from CECCAR or CAFR since August 2024. The governance framework developed in response shows that these risks can be addressed through a coordinated reading of obligations already present across the IESBA Code, the AI Act, the GDPR, and the ISA standards, without requiring new legislation.