Before You Let AI Read a Client's File

The question nobody asks first

It's easy to drag a client's statement or contract into ChatGPT, Claude, Copilot, or Siri and ask it a question. It's fast, and the answers are often good.

But "can this tool read it?" and "am I allowed to give it this?" are different questions. If you're an accountant, a bookkeeper, an insurance broker, a financial advisor, or a property manager, the second one matters more.

Start with what you promised the client

Your engagement letter, your privacy notice, your professional rules, and your industry's regulations may limit where client information can go, no matter how well the tool is built. Before a client file goes into any AI tool, ask:

• Did the client give us this for a limited purpose?
• Does our agreement say anything about third parties or cloud services?
• Does the file contain tax, financial, medical, legal, or identity information?
• Has the client asked us not to use AI?
• Would I be comfortable explaining this to the client in writing?

If any answer is unclear, stop and check the agreement, or ask your attorney or whoever handles compliance for you. A convenient tool doesn't change the obligation.

Know what the tool does with what you give it

Not every AI account treats your files the same way. Look for three things in the settings and the terms:

• Training. Some plans, especially free and personal ones, may use your conversations to improve their models unless you turn that off.
• Retention. How long your conversations and uploaded files are kept, and whether you can delete them.
• Whose account it is. A business plan your company controls isn't the same as an employee's personal login, even if the app looks identical.

Apple's Siri and Apple Intelligence features handle many requests on the device and send larger ones to Apple servers designed not to keep the data. That's a strong design, but you don't get to choose which requests stay on the device, so "it never leaves my phone" isn't a promise you can make to a client.

Sort your documents into three groups

Not every document needs the same caution. A simple rule people can remember beats a vague "be careful with AI":

• Green: public or internal material, like your marketing copy, your own checklists, and published product information. Fine to use.
• Yellow: client material. Check the agreement first, and leave out names and account numbers when the question doesn't need them.
• Red: tax IDs, passwords, payment card numbers, medical records, and anything an agreement restricts. Keep it out.

The labels don't matter much. What matters is that everyone in the office makes the same call instead of guessing.

Check the shared computer

If more than one person uses a computer under one login, they share its email, its files, and its AI conversation history. A feature that remembers what you asked yesterday becomes a way for the next person to see a client's details.

Give everyone their own account. Make sure the shared front-desk machine isn't signed in to somebody's personal account. And turn on disk encryption (FileVault on a Mac, BitLocker or Device Encryption on Windows), so a stolen laptop isn't also a stolen client list.

Write it down

One page is enough: what's allowed, what needs approval, what's off limits, which devices it covers, and what to do if someone shares something by mistake.

Then test it against the work people actually do. If it blocks harmless tasks and says nothing about the risky ones, rewrite it.

This note is general information, not legal advice.