Most CPA firms do not set out to put client information into unmanaged AI tools. It happens in small decisions: an employee pastes a client email into a chatbot to make it clearer, uploads a spreadsheet to find an error, asks an AI assistant to summarize a tax-document checklist, or connects a personal account to an inbox or drive for convenience.
Those actions can move sensitive information outside the firm’s usual controls. The issue is not only whether a result is accurate. It is whether the firm knows which tool received the information, what account received it, what access that account has, how the provider handles data, and whether the action fits the firm’s obligations to clients.
Personal AI turns a convenience into a data path
“Personal AI” means an individual account or tool that the firm has not centrally approved, configured, or monitored. It could be a public chatbot, a browser extension, a transcription service, a note-taking app, or an AI feature inside a tool selected by an employee. The account may be paid for by the individual, linked to a personal email address, and outside the firm’s usual identity, access, and retention controls.
That difference matters. A firm-managed AI service can be reviewed for its intended use, user access, vendor terms, settings, data handling, and connected applications. A personal account usually has no clear owner at the firm, no defined offboarding process, and no reliable inventory of what may have been entered or connected to it.
CPA firms hold information that is especially useful to criminals and especially sensitive to clients: tax returns, Social Security numbers, account numbers, payroll information, entity details, income records, identity documents, and financial statements. Even a small extract, a screenshot, or a prompt that combines a client name with financial context can create an exposure worth reviewing.
Client data risks do not start with a full tax return
It is tempting to focus only on a full uploaded return. In practice, smaller pieces can also matter. A prompt may include a taxpayer’s name, a business entity, a revenue figure, a bank detail, a deadline, a transaction description, a legal dispute, or a note about a potential tax position. A connected mailbox or file drive may give an AI tool a far broader view than the user intended.
The IRS warns tax professionals that protecting client data is a legal requirement and directs them to Publication 4557 for data-security guidance. Its current resource page describes tax professionals as targets for efforts to steal client information and highlights the need for a security plan. [1] The operational lesson is clear: an AI tool is another place to look when mapping where client data is stored, transmitted, or made accessible.
For organizations subject to the FTC Safeguards Rule, the FTC emphasizes written information-security programs, documented risk assessment, access-control review, data inventory, application assessment, service-provider oversight, and ongoing monitoring. [2] Whether and how a rule applies depends on the firm and the work it performs, so firms should consult their advisers on their specific obligations. But the safeguards are sensible operational questions for any CPA firm handling confidential client information.
Controls a CPA firm needs before AI use grows
1. Draw a firm line between personal and approved tools
Publish a short, usable rule: personal AI accounts may not receive confidential client or firm information. Then name the approved tools, permitted use cases, and the person who can approve a new exception. The AICPA Member Insurance Programs guidance recommends prohibiting the sharing of confidential and proprietary client and firm information with generative AI tools and treating those inputs with the same care as a public posting. [3]
2. Inventory the tools already in use
Ask staff about chatbots, browser extensions, transcription apps, AI features inside accounting software, meeting tools, and automations. For each one, record its owner, the account type, the business purpose, data categories, connected applications, and whether it can act on the firm’s behalf. Start with visibility, not blame.
3. Review the data path and vendor relationship
Before authorizing a tool for client work, review its account controls, data-use terms, retention options, available administrative settings, vendor support, and connections to other systems. If a firm develops or uses an app that stores, accesses, or transmits customer information, the FTC guidance calls for procedures to evaluate the app’s security. [2]
4. Restrict connected access
An assistant that drafts a generic message may not need access to a whole mailbox. A tool that helps with a single document may not need every shared drive. Give AI only the access it needs for a defined task, avoid shared administrator accounts, and remove unused connections after pilots end.
5. Keep professional judgment in the workflow
Confidentiality is not the only concern. AI output can be incomplete, inaccurate, or wrong for the client’s facts. The same CPA-industry guidance advises human review and supervision of AI-generated work. [3] A firm should decide which tasks are safe for drafting support and where a licensed professional must verify the work before it reaches a client or affects a filing.
6. Train for real-life shortcuts
A policy that merely says “use AI safely” will not change behavior. Give concrete examples: do not paste a client email into a personal chatbot; do not upload a client spreadsheet to an unapproved tool; do not connect a personal AI account to firm mail or storage; and do not rely on an AI answer for client advice without the required review.
Six questions before a tool touches client work
- Is this a firm-approved account and workspace, not an employee’s personal AI account?
- What client or firm information could enter the tool through prompts, uploads, history, or connected systems?
- What does the provider say it will do with that information, and have the terms been reviewed for this use?
- Who can administer the account, view activity, change settings, or remove access when someone leaves?
- Does the tool need its requested access to files, email, calendars, accounting systems, or client portals?
- Who reviews output before it affects a client, a filing, a financial statement, or professional advice?
When a firm cannot answer these questions, the tool may still have a place in non-confidential work. It should not quietly become part of client delivery until the answers are documented.
If client information may already have been shared
Do not ignore the issue or try to solve it informally in a chat thread. Preserve the facts needed to assess the event: which tool and account were used, what information may have been entered, which systems were connected, and when it happened. Remove or revoke access where appropriate, then follow the firm’s security and incident-response process.
Bring the right people into the review, which may include the firm’s security lead, privacy or compliance adviser, and counsel. The goal is to understand the actual data path, decide what containment and notification obligations may exist, and prevent the same shortcut from recurring. A firm that knows what happened can make a better decision than one that only hopes a personal AI account was harmless.
Need an AI data map?