Safe AI
Is AI safe for client work? An honest answer.
It can be, with the right account, the right settings and a clear rule on what goes in. Here's how we set it up, and the four questions to answer before anyone in your firm uses AI on client work.
Four questions, answered first
Where does our client data go?
It depends on the tool and the plan, so we check rather than assume.
Many business plans exclude your data from model training by default, but terms differ between providers and plans, and they change. We check the current terms for the tools you use: what's stored, for how long, where, and whether it can be used for training. Onshore storage and processing options vary too, and we'll tell you plainly what each means.
Copilot, Claude or ChatGPT?
It depends on your firm, and the permissions matter more than the brand.
Copilot feels safe because it lives in Microsoft 365, but it can surface whatever each person is able to open. Claude's Microsoft 365 connector works the same way. We fix who-can-see-what first, then pick the tool your team will actually use.
What are our staff already using?
Probably more than your policy says.
Most firms can't list the AI tools their people use for client work. Your IT provider can usually report it from data they already have. Our free one-page request asks them for exactly that.
What does our regulator expect?
More than most firms realise, and it's changing.
Tax Practitioners Board guidance issued on 22 July 2026 (TPB(GS) 55/2026) says tax practitioners need each client's permission before disclosing their information to a third party, and that this can include entering it into AI tools, depending on how the tools are configured and used. In a joint statement in December 2024, legal regulators in Victoria, NSW and WA said lawyers cannot safely enter confidential, sensitive or privileged client information into public AI chatbots. Advisers and brokers work within their licensee's rules. We build these in from the start, and check them against the current guidance.
Our rules for every engagement
AI drafts. People approve.
Nothing goes to a client without a person checking it.
Ask before acting
Email, calendar and file connections are set to ask before they send or change anything.
Client files kept apart
Firm know-how and client files are separated, and client files leave cleanly at the end.
No personal accounts
Client work happens in accounts the firm owns and can audit.
Why this matters to us
Mark worked closely with ANU's CISO team for three years on a $100m cyber program, and has 30+ years in technology and enterprise advisory. Safety comes first here because it's where he started.
About Mark →Find out what your team is already using.
One page to send your IT provider. When the report comes back, we'll walk you through it.