Not without controls. Client work typed into a personal AI account sits outside the firm's control. It may be used to train the model, the firm can't search or delete it, and it can put tax agents and lawyers on the wrong side of their regulators' guidance on client confidentiality. Find out which AI tools your team actually uses before you write the policy.

Which AI tools are your staff actually using?

Lately, when I ask professional services firms which AI tools their people actually use for client work, the answer is a set of rules and no list. Nobody can say who has a personal ChatGPT account, or a free login created late one night to get a proposal out the door.

What goes wrong when client work runs through a personal AI account

The firm loses control of the work. In practice that shows up five ways:

  • Client confidentiality. The Tax Practitioners Board now says tax and BAS agents need client permission before client information goes into an AI tool (July 2026). Australian legal regulators have told lawyers they can't safely put confidential client information into public chatbots like ChatGPT (December 2024).
  • Training data. A personal ChatGPT account shares what's typed into it for model training by default, unless the user switches that off. Business accounts don't share it by default. The firm has no way to see which setting anyone chose.
  • Lost records. The conversation sits in an account the firm can't search, keep or delete, and it leaves when the staff member does.
  • Stolen logins. ChatGPT keeps chat history by default, and Group-IB found saved ChatGPT logins on more than 100,000 malware-infected devices, with Asia-Pacific the largest share (June 2023).
  • Unchecked advice. Output nobody has reviewed reaches a client under the firm's name, and the professional is still responsible for it.

Why the list comes before the policy

Your IT provider can usually see which AI services your network is reaching. My read: most firms haven't asked, and they write their AI policy backwards. They start with the rules and guess at the tools, so the policy covers the tools they hoped people were using. Find out what is in use first.

People reach for their own AI because it helps them do their job. If the firm doesn't give them something capable, they'll keep finding their own.

Try this week: ask for the list

Download the AI Tool Usage Report template and send it to your IT provider, or whoever looks after your network. It asks which AI tools are being used across the business, which AI licences you already hold, and what controls are in place. It asks about teams only, so nobody gets singled out. Sending it takes five minutes.

No IT provider? Ask your team directly, and make it safe to answer honestly.

Then make it stick

When the list comes back, go through it one tool at a time. Approve it, block it, or replace it with something safe and just as capable.

Some of the easiest AI tools to use are the hardest to govern. If the safer choice takes more learning, train everyone who gets access to it.

Then write your policy around what people actually use, and ask for the list again in six months.

Sources