Using AI in an Accounting Firm Without Exposing Client Data

Can an accounting firm use AI without exposing client data? Office rules on public tools, approved tools, share links and mistakes, from ICAEW and IRS guidance.

Written by Miriad with AI assistance and checked against the sources at the end. Office rules for small accounting and bookkeeping firms, not legal advice: your professional body, your regulator and your security plan decide.

TL;DR: Yes, an accounting firm can use AI without exposing client data, if it splits the work by data. Public AI tools get public material only: rules, guidance, your own notes and marketing text. Client data goes only into tools the firm has approved inside its security plan, with clients told in writing. Share links count as publishing. A mistake is reported the same day.

Asked as a yes-or-no question, "Can we use AI or not?", this has the wrong shape. A bookkeeper asking a public chatbot to explain a new reporting rule is doing something very different from a bookkeeper pasting a client's bank statement into the same chatbot to "tidy it up". The first is research. The second is very likely a breach.

This article turns that difference into office rules you can print. It is part of our guide to accounting firm marketing strategies, which checks every channel against client confidentiality.

Can an accounting firm use AI without exposing client data?

Yes, by keeping client data out of public AI tools and putting it only into tools the firm has vetted and approved. The professional guidance does not ban AI. ICAEW says that client data in AI inputs is very likely a confidentiality breach, and that output needs a trainee-level review. Both rules can be followed every day.

The two ICAEW sources, side by side:

  • Regulatory News, February 2024: if AI inputs include client data, it is "very likely that this will breach client confidentiality"; review AI output as you would a trainee's work (ICAEW, 2024).
  • Generative AI ethics guidance: confidentiality means not loading confidential information into public GenAI tools, and GenAI tools "do not make up for a lack" of professional knowledge (ICAEW, accessed 2026).

Small US firms describe a similar line in practice. The Journal of Accountancy's August 2026 report on small firms' AI use describes firms that avoid putting client data into public AI platforms and use enterprise versions instead (Journal of Accountancy, 2026).

What counts as client data in an accounting office?

Client data is anything that identifies a client or comes from their affairs: names and tax identifiers, bank and card statements, ledger and payroll exports, tax organizer answers, emails and letters, and any description of a situation someone could recognise. In an accounting office, most of the files on the shared drive fall into this group.

The list is longer than in most professions, because the work is the client's financial life. A practical red list for a small firm:

  • Names, addresses, dates of birth, Social Security and other tax identification numbers, anything from a filed return.
  • Bank reconciliation files, bank and card statements, accounts payable and accounts receivable ledgers.
  • Payroll files: employee names, pay, tax codes.
  • Chart of accounts exports and trial balances with the client's name or figures.
  • Tax organizer answers, engagement letters, correspondence with the tax authority.
  • "Anonymised" summaries with enough detail to recognise the client: business type, town, size, year, problem.

The last point catches people out. "A three-site bakery in our town with a VAT problem" identifies a client as surely as a name, if there is one such bakery.

Which AI tools may hold client data?

Only tools the firm has approved in writing, after checking what they store, who can see it and what the contract commits them to. In the US this sits inside the Written Information Security Plan the firm must already keep. Under the AICPA Code, clients should also be told, preferably in writing, before their information goes to a third-party provider.

The IRS guidance on the plan names the steps that apply to any new tool: designate a qualified individual, assess risks, test safeguards, and choose service providers whose contracts require them to maintain safeguards (IRS Publication 5708, 2024). The same publication notes that tax and accounting professionals are treated as financial institutions under the FTC Safeguards Rule "regardless of size". An AI tool is a service provider like any other.

On telling clients, AICPA 1.150.040 says that before disclosing confidential client information to a third-party service provider, a member should inform the client, preferably in writing; this is not required for administrative support such as software application hosting or record storage (AICPA Code, 2024). Whether a given AI feature is "hosting" or a third party processing the data is a judgement call. When unsure, tell the client.

A four-question approval check for each tool:

  1. Does it keep our inputs, and for how long?
  2. Does it use our inputs to train its models, and can we switch that off?
  3. Who at the provider can access our data, and what does the contract say?
  4. Who in our office may use it, for which data?

Treat every share link as publishing the conversation, and treat chat history as a client file if client data ever entered it. Some AI tools can create a link to a conversation; whoever has the link may be able to read it. The office rule is simple: no share links from any chat that touched client work.

The rule set for chat tools:

  • Share links: never create one from a chat that contains anything on the red list. If a colleague needs the result, copy the checked output into the client file instead.
  • History: in approved tools, set retention to match your record policy. In public tools, there should be nothing to retain, because no client data went in.
  • Personal accounts: no work on personal AI accounts. The firm cannot check or delete what is stored there.
  • Browser extensions: an AI extension that reads every page you open can read your client portal. Approve extensions like tools.

What happens if client data goes into a public tool by mistake?

Report it to the responsible partner the same day, record what was pasted and where, and follow your security plan's incident steps. A slip may be small or not; the firm needs to judge each one. For larger incidents in the US, the FTC rule sets a deadline to report breaches affecting 500 or more people.

The FTC lists tax preparation firms among example financial institutions, and since May 2024 a breach of unencrypted data of at least 500 consumers must be reported to the FTC within 30 days of discovery (FTC, accessed 2026). A single client's statement pasted into a chatbot is unlikely to meet that threshold, but the same habit across a payroll file might.

An incident note needs five lines: who, when, which tool, what data, what was done (chat deleted, provider contacted, client informed where needed). Keep it with the security plan.

A one-page rule sheet for the office

One page, three columns, pinned by every screen: what may go into a public tool, what may go only into an approved tool, and what never goes into any AI tool. Add the incident line at the bottom. Staff training then means walking through the sheet with real, anonymous examples from your own work.

Example (illustrative, not a real case): A nine-person firm writes its sheet in one 90-minute meeting.

Public tool (free or paid chatbot) Approved tool only (named in the security plan) Never, in any AI tool
IRS, HMRC and state guidance text Summarising a client's tax organizer answers Client data on a personal account
Your own notes and templates Drafting a client letter from file notes Share links from client chats
Marketing copy and social posts Categorising transactions for month-end close Full payroll files without a written approval
Explaining a term for a newsletter Meeting recap, after the client agreed Tax identification numbers pasted as text

The firm adds two lines below the table: "Any AI output going to a client is checked by a qualified person" and "Client data in the wrong column: tell (partner) today". Every staff member signs that they have read it.

Training is not optional for firms in the EU. Article 4 of the AI Act says that from 2 February 2025, deployers of AI systems must take measures to ensure sufficient AI literacy of their staff (AI Act Article 4, 2024). Walking through the rule sheet, with a note of the date and attendees, is a reasonable start.

The procedures manual article shows where this sheet fits among the firm's other procedures, and the client onboarding checklist includes the written notice to new clients about outside tools.

If you want your AI tools to start from your firm's own written rules and facts, including this rule sheet, the Business Brain Starter Kit is built for that. Get notified when it launches.

FAQ

Can accountants put client data into ChatGPT?

Not into a public version. ICAEW says that if AI inputs include client data it is very likely to breach client confidentiality, and its ethics guidance says not to load confidential information into public generative AI tools. Client data belongs only in tools the firm has approved inside its security plan, with clients informed in writing where the professional code expects it.

Is anonymised client data safe to use in AI?

Often not. In an accounting office a business type, a town, a size and a problem can identify a client without any name. Treat anything a person who knows the client could recognise as client data. For questions you want to ask a public tool, describe the rule or the general situation instead, with no figures or details from the file.

Do we have to tell clients we use AI?

Under the AICPA Code, a member should inform the client, preferably in writing, before disclosing confidential client information to a third-party service provider, with an exception for administrative support such as software hosting or record storage. If an AI tool processes client data, telling the client in the engagement letter or onboarding pack is the safer course.

What should we do if someone pastes client data into a public AI tool?

Report it to the responsible partner the same day, write a short incident note (who, when, which tool, what data, what was done), delete the chat, and follow your security plan's incident steps. In the US, breaches of unencrypted data of at least 500 consumers must be reported to the FTC within 30 days, so larger slips need a fast decision.

Sources

Related articles

Products from Miriad

Business brainBusiness Brain Starter Kit

Stop explaining your business from scratch. Write it down once, with a source next to every line.

49 USD

Get notified

See all prompt packs