ESAI and client confidentiality at accounting firms: what data you can use and how
Updated October 27, 2026 · NouCodi
In short: an accounting firm can use AI with client data if it uses business accounts that don’t train on that data, has a data processing agreement with the vendor, limits what information goes in and keeps a record of it all. What it shouldn’t do is let each person use a free personal account and paste payroll or tax returns into it.
The real risk: informal use
The most common problem isn’t AI itself, but a team already using it on their own, with personal accounts and no rules. That data can end up stored or used to train models without the firm knowing.
5 minimum rules
- Business accounts: enterprise versions of ChatGPT, Claude, Copilot or Gemini, with training on your data contractually turned off.
- A contract with the vendor: a data processing agreement (DPA), and knowing which region the data is stored in.
- Minimize: only enter what the task needs. For many tasks, removing names and ID numbers is enough.
- A written policy: one page stating which tools may be used, with what data, and who approves it.
- Human review: nothing goes to a client or a tax authority without a professional reviewing it.
Which data, with how much care
| Type of data | With AI? |
|---|---|
| Generic text, templates, public regulations | Yes, no restriction |
| Business invoices and statements | Yes, with a business account and contract |
| Payroll, health data, individuals’ personal and tax data | Only with approved tools and minimized data |
| Passwords and logins to banks or government portals | Never |
Local rules apply on top of this. In the EU and UK, the GDPR; in the US, rules such as IRS Section 7216 restrict how tax preparers use and disclose tax return information, so check whether client consent is needed.
How to explain it to clients
Many clients will ask. A sentence in your engagement letter or on your website stating which tools you use, that they don’t train on client data and that a professional reviews everything builds trust instead of doubt.
This guide is for general information and isn’t legal advice for your jurisdiction. In our AI audits we review the firm’s cybersecurity and data use. More in AI for accounting firms.