Is it safe? AI, client data and a simple plan for your firm

Billie Mcloughlin, founder of AIccountancy, is a qualified accountant with thirteen years in practice and around five as a tech and AI consultant. She said she is almost always asked about AI security.

The whole setup, not just the tool

Billie said “is AI safe?” is too broad. What matters is the tool, its settings, the plan, and who is using it and how trained they are. Her analogy: a power saw has a guard, but used wrong you still lose fingers.

She gave two cautionary cases. In Hong Kong, a finance worker who suspected phishing asked for a video call, and was then told to make transactions by a deepfake of her finance director; Billie passed on security organisations’ tip of agreeing a safe phrase with team members and clients. And Deloitte had to revise a government report after an academic found a reference that didn’t exist, and refund the final instalment. Her lesson: check your sources.

Four kinds of worry

Billie said most concerns fall into four categories:

• Confidentiality: where client data goes and who can see it. She said she thought Google’s terms mention a human might review some prompts.
• Accuracy: AI that is confidently wrong. She said Claude, blocked by a CAPTCHA, has at times made up a response.
• Compliance: the Privacy Act, your professional body’s rules, and your insurer, which she suggested telling that you use AI.
• Trust: she said clients are now more concerned if you’re not using AI.

Green, amber or red

She put three scenarios to the audience:

• A notetaker on client Teams calls, client not told: amber. Fine if you know where the data goes, but tell the client first.
• A manager paying for ChatGPT Plus because the firm offers nothing: red. It’s likely on a personal email, so the client data leaves with them. She saw it as a call for support, not a disciplinary matter.
• A WhatsApp voice note that sounds exactly like a client, asking to change payroll bank details: red. Don’t act on a voice note alone; add checks or use the safe phrase.

Plans and settings

Billie called knowing whether you’re on a consumer, business or enterprise plan the 101: same brand, different data terms. Her summary, which she stressed was her own interpretation, checked the Saturday before:

• Personal Copilot in Australia trains on chats by default; switch it off under profile and privacy, and check the text and voice toggles separately.
• On Claude Team and Enterprise plans, training is off by default; the setting is called “Help improve our models”.
• Personal ChatGPT trains by default; business and enterprise plans don’t.
• Check Perplexity, which uses other models underneath.

In a Claude Team test account she showed the privacy, memory and connector settings. She said rating a response with a thumbs up or down can send that prompt for training, so give feedback in the chat instead. Each connector action can be set to always allow, ask for approval or never allow; in her Gmail example, drafting is allowed but forwarding needs her approval.

Vendor jargon

Billie explained five terms for talking to vendors:

• SOC 2 Type 2: an independent audit over six to twelve months, not a snapshot. Ask to see the report and its period.
• Subprocessors: third parties your vendor passes data to; ask who.
• Data residency: where data is stored and processed. As she understood it, the Privacy Act doesn’t require data to stay in Australia, but sending personal information overseas means taking reasonable steps to know it’s protected.
• DPA: the data processing agreement limiting use of your data to your instructions. Without one, she said, you have nothing to show the OAIC or clients.
• Prompt injection: hidden instructions in documents, emails or websites. Ask vendors what happens when their tool reads a malicious document.

When a client connects Xero to AI

Her questions for the client: which tool and plan; the Xero connector or a third-party app; read-only or able to change things; who else can reach that AI account; and whether you’re expected to rely on it. On the firm’s side: agree who checks before anyone relies on it, cover client-connected AI in the engagement letter (including billing for checking AI’s work), and don’t connect client files to your own AI without firm approval.

For EU clients, she said the EU AI Act means telling them wherever AI touches their information.

Shadow AI

Billie warned against dropping basic security, describing a breach where hackers simply phoned pretending to be IT and asked for a password. She cited a KPMG report: 58% intentionally using AI, 31% weekly or daily, and over half admitting use against company policy. Signs include personal accounts on work devices, free PDF summarisers and default-on features. To find it: an amnesty, Microsoft and Google admin usage reports, AI domains from IT, and expense claims.

Her three-step plan

1. Have a meeting. Start with the amnesty, agree approved tools, what client data can go in and a red list of what can’t.
2. Run a training session. Name an AI lead, as firms do for AML, and have a 72-hour plan for a breach.
3. Hand out a guide and a policy. Covering approved tools, data, plans, vendor checks, DPAs on file, a record of human review, and a leaver process.

She closed by saying AI doesn’t reduce or move your responsibilities, which she said is the TPB’s AI guidance: it expects evidence that someone has read, understood and checked what AI produced.