Issued is not agreed: the 2026 engagement letter refresh

ICAEW revised its engagement letters helpsheet in March 2026. The page carries three change summaries — May 2022, May 2023 and March 2026 — so a practice still working from 2023-era letters is a full revision behind. What arrived: schedules for Making Tax Digital for Income Tax and for acting as an Authorised Corporate Service Provider, a new agreed-upon-procedures schedule, and Terms of Business that now refer to the use of artificial intelligence.

Redrafting is the easy half, and every proposal tool on the market will do it for you. The half this article is about is harder and almost nothing has been written on it: in three years' time, when you need to rely on your own contract, can you show which version of the terms this particular client agreed to, and when? That is not a drafting question. It is a filing question, it is answered at the moment you send, and it cannot be retrofitted.

This is UK-scoped, because ICAEW's templates are. Nothing below requires you to install anything.

What changed in the March 2026 engagement letter update?

Four things, and three of them are regulatory catch-up rather than housekeeping. ICAEW's practice-news summary describes the revisions as reflecting recent regulatory, operational and technological developments.

In Part 2, the schedules of services, the additions published by name are a personal tax schedule for individuals, sole traders and couples in MTD for Income Tax (schedule E-B); three covering work as an Authorised Corporate Service Provider — one with identity verification services, one without, and a guidance note (U A, U B and U GN); and a schedule for agreed-upon procedures (T). Part 3 carries limitation-of-liability and alternative data-protection wording. Part 4, the Terms of Business, now refers to the use of AI, and "Artificial Intelligence" is a listed topic in the separate related-guidance download.

The fourth change is the one nobody mentions, because it is a deletion. The published list of Part 2 schedules now reads, at position P, "Schedule removed". If your engagement letter incorporates schedules by reference — and the ICAEW structure invites exactly that, a letter plus schedules plus terms of business — then a letter you have not touched since 2023 can now point at a schedule that no longer exists. An engagement letter is not a signed-once artefact. It is a document that rots quietly while you are not looking at it.

Do you have to reissue engagement letters to existing clients?

Not automatically, and not all of them — but ICAEW's position is that firms should not assume engagement terms stay valid indefinitely. Its guidance is to review letters regularly, ideally annually or whenever the scope of work changes, and it names three developments that should prompt an update to the agreed terms: new regulatory requirements, the introduction of additional services, and — this is the new one — the adoption of new digital tools.

That third trigger is worth sitting with, because it converts a software decision into a client-contract event. Historically a practice changed its document system, its tax software or its portal without telling anyone outside the building. On ICAEW's 2026 reading, if that change alters who processes client data or how the work gets done, it belongs in the terms.

In practice the March 2026 update sorts your client base into three groups, and the distinction matters because the evidence you need differs for each.

The fourth row is not a free pass. "Nothing to do" still assumes you can produce the existing signed letter, with its terms, on request. For a lot of practices that assumption is the actual weak point — the letter was signed in 2021, by a partner who has retired, using an e-sign tool the firm no longer subscribes to.

Why "we sent it" is not the same as "they agreed"

An issued letter is not an agreed letter, and ICAEW's own list of common pitfalls says so directly: firms should avoid assuming terms are agreed simply because a letter has been issued, and an unsigned or partially updated engagement letter offers limited protection in a dispute.

This is the failure mode a bulk refresh produces. A firm sends 300 updated letters in a fortnight, 210 come back signed, and the remaining 90 sit in a state nobody is tracking. Twelve months later the practice believes its whole client base is on 2026 terms. Roughly a third of it is not, and the third that is not looks identical from the outside.

Cerys Freemantle, Senior Professional Consultant in ICAEW's Technical Advisory Services, is quoted on the follow-up discipline: chase the slow returns, and keep "a proper record of the version provided" while you do. Her framing of why is the sharpest line on the page — your engagement letter is your contract for services, and if you ever have to enforce it, it needs to be current enough to give you the protection you think you have. Getting a signature on it is the same job as getting a signature on anything else: the signature is worth what the surrounding record is worth.

Which terms was this client on in 2027?

This is the question the whole exercise is really for, and ICAEW anticipated it inside the template itself. Part 4 is drafted so the terms of business can be dated — provision is made, in ICAEW's words, so that "it is clear which terms of business have been applied", because they may be updated from time to time. The standard-setter built a version stamp into the document because it expects drift.

Most practices then defeat it, and they defeat it with a tool. The natural way to update an engagement letter is to open the master template, edit it, and save. Do that and the previous terms are gone — not archived, gone. The template library now describes only your current position, and the question "what did this client sign in 2024?" has no answer anywhere in the system. It is a one-line action with a three-year blast radius, and it is genuinely easy to do by accident.

The fix is a change of mental model rather than a change of software: the template is not the record. The generated, signed document is. A template is a mould, and it is meant to be replaced. The letter that came out of it, filed against one client with a date and a signature, is the only thing that can answer a question about that client three years later. So version the artefact, not the mould.

The AI clause is a supplier list in disguise

The new AI guidance asks for three things: whether AI or other software tools will be used in service delivery, the limitations of those tools and their potential impact on outputs, and responsibilities for data protection, confidentiality and due diligence on technology providers.

Read that last item slowly, because it is not really an AI clause. It is a due-diligence duty on your technology providers, disclosed to your clients, and it has no natural expiry. To make a disclosure like that you need to know which suppliers touch client data, what each one does with it, and where it goes — which is a supplier register, maintained, not a paragraph written once.

And it is a moving target, including for firms who changed nothing. Xero's own stack shifted during 2026: JAX now reads source documents and pulls data into the platform, and the new Xero Workpapers is documented as requiring BGL to be given access to your clients' Xero organisations — a point covered in the article on Workpapers and your client documents. Neither change involved a decision by your practice. Both change the honest answer to "which third parties process our clients' data", and therefore what your 2026 disclosure is actually worth by 2027.

There is a small irony in the helpsheet worth exactly one sentence: given the professional judgement needed to tailor a letter to a client, ICAEW says "the use of AI software should be considered with caution". The letter now discloses your AI. ICAEW would rather you did not use AI to write the letter.

How to run the refresh without losing the audit trail

The sequence below is deliberately boring, and the order matters — steps one and two are the ones that cannot be done retrospectively.

1. Date your terms of business before you send anything. One version string, used everywhere, in the document itself.
2. Decide where a signed letter lives, once, for the whole firm — a named folder in each client's file, not wherever the sender happened to click.
3. Segment the client base by the table above, rather than sending everyone the maximal letter. A client with no MTD obligation does not need the MTD schedule, and an over-scoped letter is its own risk.
4. Generate per client, from one master, so the terms version is identical across the run and only the client-specific values differ.
5. Send for signature and track what comes back, per client, until every one is closed or explicitly written off.
6. File the signed copy against the client with the version in its name — and keep the superseded letter rather than replacing it. The old terms governed real work, and they still do for the period they covered.
7. Diarise the review. ICAEW's position is annually or on any change of scope, which for most firms means a standing item, not a project.

Step six is where most of the long-term value sits, and it is the same argument as the one about what leaving a document system costs. Superseded terms are not clutter. They are the only evidence of what was agreed for the years they were in force, and a retention policy that discards them is discarding the contract half of the records you already have to keep.

What XTK does here, and what it does not

XTK is a browser extension that adds a panel inside Xero Practice Manager, and a re-engagement run is close to the middle of what it was built for. A document template is a Word file carrying square-bracket placeholders like [CLIENT:NAME]; "Create ▾ → File from template" fills them from that client's live XPM details, you review every value, and the finished document lands in a folder you choose inside that client's own storage.

The part that matters for a schedule-by-schedule refresh is conditional blocks. The placeholder grammar includes [IF] … [ENDIF], so one master engagement letter can carry the MTD schedule and the ACSP schedules and keep or drop each per client, rather than becoming four near-identical templates that drift apart. One master means one terms version across the whole run — which is step four above, done structurally instead of by discipline.

From there, sending for signature happens in the same tab. Each request keeps an append-only event log — created, sent, resent, viewed, signed, declined, completed, voided — timestamped, with IP and user agent recorded for the recipient's own actions, and the signed PDF is written to a folder you nominate in your own Google Drive, OneDrive or SharePoint. Nothing about that record depends on XTK still being in the picture in 2029, which is the whole point of the exercise.

Now the limits, because three of them bite specifically on a mass refresh and you should plan around them rather than discover them at client 40.

• There is no multi-client send. A signature request belongs to exactly one client, so 300 clients is 300 requests generated from one template. The template does the drafting work; the sending is per client.
• XTK does not version templates. Replacing a template's file swaps it in place, and the library keeps no history of the terms it used to hold — which is precisely why the advice above is to put the version in the generated document's name rather than to rely on any tool's template library, including this one.
• There is no firm-wide "who hasn't signed yet" view. The signature list is per client. Practice-wide activity does surface in the notification tray as events happen, but that is a feed rather than a roll-up, so a 300-letter run still needs a tracker of your own.

The checklist

• Find out which version your letters are based on. If nobody knows, that is the finding.
• Read ICAEW's March 2026 summary of changes against the May 2023 one, and check whether any letter of yours references the removed Part 2 schedule at position P.
• Add the schedules your services actually need — MTD for Income Tax, ACSP with or without identity verification, agreed-upon procedures.
• Write the AI and technology paragraph from a real list of your suppliers, and keep that list somewhere it will be maintained.
• Date your terms of business, and put that date in every generated letter's filename.
• Segment the client base before sending: new letter, reissued terms, or nothing.
• Track returns to zero, and keep the superseded letters.
• Diarise the next review now.