Is it safe to put client data into ChatGPT? A guide for accountants

Why accountants need to be more careful than most

Most office workers only have their employer's policy to think about. Accountants also have professional and legal duties that follow client information wherever it goes, including into an AI tool.

• The AICPA confidentiality rule. A member in public practice must not disclose confidential client information without the client's specific consent (ET 1.700.001). The interpretation on outside service providers (ET 1.700.040) says to either have a contract that keeps the information confidential, or get the client's consent, before you share it. An AI vendor is an outside provider handling your client's information, so the same questions apply. The Journal of Accountancy explains how the rule and its interpretations fit together.
• IRC §7216, for tax work. A tax return preparer who knowingly or recklessly discloses information furnished for a return, or uses it for anything other than preparing the return, commits a misdemeanor, with a fine of up to $1,000 and up to a year in prison (26 U.S.C. §7216). The regulations define disclosure as making tax return information known to any person in any manner whatever, and tax return information includes a taxpayer's name, address and identifying number (26 CFR §301.7216-1).
• Your security plan. The IRS reminds tax and accounting professionals that federal law requires them to keep a written information security plan, and that the FTC's rules include overseeing service providers (IR-2026-92). An AI tool your staff use is one of those providers. IRS Publication 5708 is a template for the plan.
• Your firm's policy and your engagement letters. If your firm has an AI policy, it's the first thing to check. Some engagement letters also say how client information will be handled.

If you work in corporate finance rather than in practice, the duties are different but the logic is the same: your company's data policy, any confidentiality agreements with customers and suppliers, and, at a public company, extra care with financial results that haven't been released.

What happens to what you type

Every AI tool has its own terms, and they change, so check the current terms for the tool you use. Here is how ChatGPT handles it, as an example of what to look for.

• Personal plans (Free, Plus and Pro). OpenAI's help center says data sharing for model training is on by default, and you can turn it off in Data Controls. Turning it off applies to new conversations.
• Business plans and the API (ChatGPT Business, Enterprise and Edu, and the API Platform). OpenAI says it doesn't train its models on what you enter in these by default.

Not being used for training isn't the same as staying private. Whatever you enter is still sent to the vendor and stored under its retention terms, and it could be exposed if the vendor has a breach. That's why the professional rules ask about agreements and consent, not just a setting.

The same goes for AI built into software you already use, such as Microsoft Copilot or the AI features in your accounting software. A business-licensed version your firm has approved may be covered by its agreements. A personal account on the same tool may not be.

Before anyone uses a tool for client work, someone at the firm should be able to answer these questions:

• Does the vendor use what we enter to train its models? Is that off by default, and on which plans?
• Is there a signed agreement that covers confidentiality and security?
• How long does the vendor keep what we enter, and can we delete it?
• Who at the vendor can see it, and when?
• Has the firm approved this tool, and for what kinds of data?

Fine, anonymize first, or never: a simple sort

Most requests fall into one of three groups. If you're unsure which, treat it as the stricter one.

How to anonymize properly

Taking the client's name off the first line is the easy part. Identifying details hide in places people forget:

• Description and memo fields in bank exports: payees who are individuals, invoice numbers, the last digits of a card.
• File names, sheet tab names and column headers, such as a client's name in the file name.
• Document properties, comments and tracked changes, which can carry names.
• Details that identify a client on their own: an unusual industry, a one-off transaction, a small town.
• Screenshots, which can show a client's name in a window title or a browser tab.

Then work through the file in this order:

1. Replace names with roles: Client A, Vendor 1, the CFO.
2. Keep the key that maps roles back to names in your own files, never in the chat.
3. Keep only the figures the task needs. If you want help with a formula, a dozen made-up rows will do. Some controllers swap in dummy numbers for this: the structure is real and the figures aren't.
4. Look at the file once more before you upload it, as if you were sending it to a stranger.
5. Put the real details back yourself, in your own files, after the AI has done its part.

If something has already gone in

• Stop, and don't add anything more to that conversation.
• Delete the conversation and any files you uploaded. Deleting may not remove copies the vendor has already kept, so don't treat it as the end of the matter.
• Tell whoever handles data incidents or compliance at your firm, and follow your firm's process. Your security plan should say what happens next.
• Leave the decision about telling the client, or anyone else, to the firm. It sometimes needs legal advice.

A short AI policy, if your firm doesn't have one

A policy doesn't need to be long to be useful. One page that answers these four questions covers most of the risk:

• Which tools are approved, and on which plans?
• What can go into each one? The three groups above are a starting point.
• Who do staff ask when they're unsure, and who do they tell when something goes wrong?
• Who checks AI output before it reaches a client or the books? The guide to checking AI's flux commentary shows what that check looks like.