Is de-identified client data safe to put in a free chatbot?

This map says no. Removing a name is quick; removing everything that identifies a client (a niche industry, a town, a director’s surname in an email footer) is slow, and nobody does it carefully at 5pm.

Do I need client permission if the tool does not train on our data?

No-training terms reduce the risk but, on the TPB’s wording, do not settle the question. The fix is an engagement letter clause covering AI use, for new clients at onboarding and existing ones at renewal.

Where do tax office data connectors sit on the map?

Connected tools, at tier 3 at least and tier 4 wherever tax file numbers come through: read-only access, a check in writing of how the service reaches the tax office, client permission and advice on the TFN Rule before switch-on. Connecting ATO data to AI tools safely goes into the detail.

What if someone has already pasted client data into a consumer account?

Treat it as a near miss, not a disciplinary matter, or the next one gets hidden. Find out what went in, delete the history where the tool allows, and assess it under the Notifiable Data Breaches scheme, with advice if identifiers were involved.

How does this sheet relate to an AI policy?

It is the data section of one. If you have no full policy yet, the AI policy template covers approved tools, review, client disclosure and incidents; this sheet slots in as its data rules. Start with the AI policy template; the AI data safety playbook ties the two together.

Free template

AI client data rule sheet: five tiers, four kinds of tool, one page

Most firms know free chatbots are risky. What they lack is a rule a junior can apply in five seconds with a client email in front of them. This sheet sorts your data into five tiers and your tools into four kinds, decides every square of the map once, and puts it on one page the team signs. It follows the Australian rules, with pointers for UK and US firms.

Updated 10 November 2026 · Editable Word document (.docx) · Free with a firm profile

Free with a firm profile

Get the editable AI client data rule sheet

Or build it with AI

Open Claude or ChatGPT with the prompt filled in. It writes the finished document for your firm straight away, then asks a few questions to tailor it. No client data needed.

Open in Claude Open in ChatGPT

Works without client data. Don't paste client names, tax file numbers or ledgers into an AI tool your firm hasn't approved for them. AI data safety playbook.

How to use it

How to use this template

Sort your data by type, not by client

List the kinds of information your practice management system and document store hold and put each into one tier, so the rule covers tomorrow’s new client too.
Find every tool and account in use

Ask the team, including about personal subscriptions, and put each one under one of the four kinds. The terms a tool runs under matter more than its brand. Why teams should stop using personal AI logins explains the risk of accounts nobody manages.
Decide each square of the map once

Adjust the starting map to your firm, then have a partner sign it, so nobody decides it at their desk.
Check it against your rules and your letters

Make sure your engagement letter covers AI use and your privacy policy mentions it, and take the restricted row to an adviser.
Walk the team through it

One meeting, everyone signs, and the six-month review goes in the calendar before you leave the room.

The template

[Firm name]: client data and AI rule sheet

Replace everything in [square brackets].

Sheet details

Item	Detail
Firm	[Firm name]
Owner of this sheet	[Name, role]
Map signed by	[Partner name, date]
Version	[Date]
Next review	[Date, no more than six months away]

1. Our five data tiers

Tier	What it covers	Our examples
0 Public	Legislation, tax office rulings, our own published content.	[Examples]
1 Internal	Templates, procedures, checklists, job ads. Nothing about a client.	[Examples]
2 De-identified	Client facts with the identity stripped out: "a dental practice with two locations", not the practice’s name.	[Examples]
3 Identified client data	Names, ledgers, financial statements, payroll, correspondence, tax office account and lodgment data.	[Examples]
4 Restricted	Tax file numbers and other government identifiers, bank account and card numbers, login credentials, health and other sensitive information, anything privileged or in dispute.	[Examples]

2. Our four kinds of tool

Kind	What it means	Our tools and accounts
Consumer chat app	Free or personal paid accounts of Claude, ChatGPT and the like, including a partner’s own subscription.	Anything not listed below.
Business plan	A firm-managed workspace (for example Claude Team or Enterprise, ChatGPT Business or Enterprise, Microsoft Copilot under our Microsoft 365 tenant) where the vendor’s terms exclude our data from model training and an admin controls the accounts.	[List accounts]
Connected tool	A business plan with a connector or MCP server reaching into Xero, Xero Practice Manager, email or tax office data. It can read client data nobody pasted.	[List connectors; each read-only unless [name] approves write access in writing]
Local tool	A model running on a machine the firm controls, with nothing sent to an outside service.	[List, or "none"]

Paid does not mean safe. Check the plan’s data terms, and record where and when you read them.

3. The map: what may go where

Data tier	Consumer chat app	Business plan	Connected tool	Local tool
0 Public	Yes	Yes	Yes	Yes
1 Internal	Yes	Yes	Yes	Yes
2 De-identified	No	Yes	Yes	Yes
3 Identified	No	Yes, with client permission	Read-only, after review, with permission	Yes, on a secured firm device
4 Restricted	No	No	Only after advice	No

De-identified data is a no for consumer apps because hurried de-identification rarely removes everything: a niche industry, a town or a surname in an email footer can still identify a client. The local column is no free pass either; a laptop of client files still needs securing.

4. The rules

Consumer tools take tier 0 and 1 only. Never client information, even with the name removed.
Tier 3 goes only into approved business, connected or local tools, and only for clients whose engagement letter covers AI.
Tier 4 never goes into any AI tool by hand. Connected tools that may carry tax file numbers are approved by [name] after advice.
No AI tool or service is given anyone’s myID, ATO online services login or other credentials.
Every AI output used in client work is checked by a qualified person, who notes the check on the job.
Pasted something into the wrong place? Tell [name] the same day. No blame for reporting; we check whether it is a notifiable breach.

Reviewed every six months, and whenever a vendor changes its terms, we add a tool or connector, or a regulator issues guidance.

5. The rules behind the map

Where	What applies
Australia: TPB	TPB(GS) 55/2026 (22 July 2026) says practitioners must get each client’s permission before divulging client information to a third party, which can include entering it into AI tools depending on how they are configured and used. It accepts a signed engagement letter as permission, and asks practitioners to verify AI output and document the checks. Where client information involves tax file numbers, the Privacy (Tax File Number) Rule 2015 applies.
Australia: Privacy Act	The OAIC recommends, as best practice, not entering personal information, particularly sensitive information, into publicly available generative AI tools. Small businesses with turnover of 3 million Australian dollars or less are generally outside the APPs unless an exception applies, but the TPB Code applies to every registered agent.
United Kingdom	Start with the ICO’s guidance on AI and data protection and your professional body’s confidentiality rules.
United States	IRS Publication 4557 and Publication 5708 help tax practices write the written information security plan the FTC Safeguards Rule expects, and IRC section 7216 governs disclosure of tax return information.

Sources of truth: the TPB guidance statement and the OAIC guidance in Australia, the ICO in the UK, the IRS in the US. Vendor terms change; check yours before you sign the map.

This template is a starting point, not legal advice. Your obligations depend on where you practise, your professional body and your clients; take advice on anything you are unsure of.

6. Team acknowledgement

I have read this sheet and I will follow it.

Name	Role	Signature	Date
Blank	Blank	Blank	Blank
Blank	Blank	Blank	Blank
Blank	Blank	Blank	Blank
Blank	Blank	Blank	Blank

Common questions

Frequently asked questions

Is de-identified client data safe to put in a free chatbot?: This map says no. Removing a name is quick; removing everything that identifies a client (a niche industry, a town, a director’s surname in an email footer) is slow, and nobody does it carefully at 5pm.
Do I need client permission if the tool does not train on our data?: No-training terms reduce the risk but, on the TPB’s wording, do not settle the question. The fix is an engagement letter clause covering AI use, for new clients at onboarding and existing ones at renewal.
Where do tax office data connectors sit on the map?: Connected tools, at tier 3 at least and tier 4 wherever tax file numbers come through: read-only access, a check in writing of how the service reaches the tax office, client permission and advice on the TFN Rule before switch-on. Connecting ATO data to AI tools safely goes into the detail.
What if someone has already pasted client data into a consumer account?: Treat it as a near miss, not a disciplinary matter, or the next one gets hidden. Find out what went in, delete the history where the tool allows, and assess it under the Notifiable Data Breaches scheme, with advice if identifiers were involved.
How does this sheet relate to an AI policy?: It is the data section of one. If you have no full policy yet, the AI policy template covers approved tools, review, client disclosure and incidents; this sheet slots in as its data rules. Start with the AI policy template; the AI data safety playbook ties the two together.

More templates

The thinking behind these: AI for accountants and bookkeepers: what actually works.