Starter course

Career · Accounting & bookkeeping practices

Safe Hands: client confidentiality and AI, a firm’s checklist

Six lessons on keeping client information confidential when your firm uses AI. Compare the rules in Australia, the US and the UK, tell consumer and business accounts apart, run a vendor checklist, minimize what goes into prompts, tell clients, and respond when something goes wrong.

What you'll cover

Know when AI use is a disclosureConfidentiality and privacy rules for Australia, the US and the UK, side by side.
Tell consumer, business and enterprise accounts apartTraining defaults, feedback, permissions and data location for OpenAI, Microsoft and Xero.
Run the vendor due-diligence checklistTwelve questions in four sections, a worked example on a sample tool, and data classes.
Minimize and de-identify before you promptRewrite prompts so they carry only what the task needs, and know the limits of anonymising.
Tell clients: notice and consent wordingNotice versus permission, with wording for Australian, UK and US clients.
Respond when client data goes where it shouldn’tFirst steps, and the breach-notification clocks in Australia, the UK and the US.

General information, not legal, tax or professional-standards advice. Check your regulator and professional body for your obligations, and get advice on specific disclosures.

trainyourselfCourse guide · step-by-step lessons

Welcome0% complete

About this course

Client confidentiality and AI: an accounting firm’s checklist.

Starter · About 1 hour of learning · 6 lessons · 12 quick checks · 2 downloads

Who it's for
Everyone in an accounting or bookkeeping firm who handles client information, in Australia, the UK, the US and elsewhere.
How it works
6 guided lessons in your browser, with worked examples, exercises and a quick check after each lesson. Progress is saved in this browser only, and you can restart at any time. You start with just your first name and email, and you can take one whole course that way. After that, a free account lets you continue past lesson 1.
Sources we rely on
27 published sources, mostly regulators and official bodies, listed below so you can check the original guidance yourself.

By the end you can

Explain when AI use is a disclosure that needs permission, consent or a contract in your country
Tell consumer, business and enterprise AI accounts apart and check the settings that matter
Run a vendor due-diligence checklist and approve tools by data class
Rewrite prompts so they carry only the information the task needs
Adapt client notice wording and take the first steps after an incident

Downloads

AI vendor due-diligence checklist .docxTwelve questions in four sections, an evidence column and a decision by data class.
Client AI-use notice and permission wording .docxEngagement-letter and website wording with Australian, UK and US notes.

Rules by country

Australia: TPB Code item 6 and TPB(GS) 55/2026 (client permission), APES 110 confidentiality, OAIC AI guidance, NDB scheme including TFN information.
United Kingdom: ICAEW Code of Ethics and PCRT AI guidance (consent before public AI tools), UK GDPR processor contracts, 72-hour breach reporting.
United States: AICPA ET 1.700.001 and 1.700.040, §7216 consent rules (offshore and SSN limits), FTC Safeguards Rule, IRS Pub 4557 reporting.

Learning time

About 1 hour of learning. May count towards your CPD or professional development; check your professional body's rules. Estimated from reading time, exercises, quick checks and downloads.

Sources

Check the originals.

How these courses are made. Spotted an error or out-of-date rule? Send a correction.

General information and training only. Courses may count towards your CPD or professional development; check your professional body's rules.

Confidentiality of client information (Code item 6) · Tax Practitioners Board (Australia)
TPB(GS) 55/2026: The use of artificial intelligence and the Code of Professional Conduct · Tax Practitioners Board (Australia)
Technology-related revisions to APES 110 Code of Ethics (effective 1 January 2025) · APESB (Australia)
Guidance on privacy and the use of commercially available AI products · Office of the Australian Information Commissioner
Small business and the Privacy Act · Office of the Australian Information Commissioner
The Privacy (Tax File Number) Rule 2015 and the protection of tax file number information · Office of the Australian Information Commissioner
Part 4: Notifiable Data Breach (NDB) scheme · Office of the Australian Information Commissioner
Notifiable Data Breaches scheme: information for tax practitioners · Tax Practitioners Board (Australia)
AICPA Code of Professional Conduct (ET 1.700.001 and 1.700.040) · AICPA (US)
26 U.S.C. § 7216: Disclosure or use of information by preparers of returns · Legal Information Institute, Cornell Law School
26 CFR § 301.7216-3: Disclosure or use permitted only with the taxpayer’s consent · eCFR (US Government)
26 CFR § 301.7216-3: Disclosure or use permitted only with the taxpayer’s consent (backup copy) · Legal Information Institute, Cornell Law School
Rev. Proc. 2013-14: format and content of taxpayer consents (Form 1040 series) · Internal Revenue Service (US)
Section 7216 information center · Internal Revenue Service (US)
FTC Safeguards Rule: What your business needs to know · Federal Trade Commission (US)
Publication 4557: Safeguarding taxpayer data (Rev. 6-2024) · Internal Revenue Service (US)
ICAEW Code of Ethics: the impact of technology · ICAEW (UK)
Topical guidance: applying PCRT to the ethical use of AI tools (19 January 2026) · ICAEW (UK)
When is a contract needed and why is it important? · Information Commissioner’s Office (UK)
What needs to be included in the contract? · Information Commissioner’s Office (UK)
Personal data breaches: a guide · Information Commissioner’s Office (UK)
Pseudonymisation · Information Commissioner’s Office (UK)
Information Commission succeeds the ICO as UK’s data protection regulator (30 September 2026) · GOV.UK
How your data is used to improve model performance · OpenAI Help Center
Enterprise privacy at OpenAI · OpenAI
Data, privacy and security for Microsoft Copilot · Microsoft Learn
JAX: your AI business companion (plans and FAQs) · Xero (Australia)

Publisher

Who publishes this course.

Published by trainyourself.org, a trading name of Combine TRS Pty Ltd (ABN 42 112 983 678), Brisbane, Australia.

How it's made: researched from published official, regulator, professional-body and vendor guidance, then run through automated quality checks against our course depth standard and automated source checks that match each rule to its official source, listed above. Read how these courses are made.

Last updated: 1 November 2026

General information, not tax, accounting, legal or professional advice. Spotted an error or an out-of-date rule? Send us a correction.

Keep going

Pick a course and start today.

Every open course starts with just your first name and email. Want to go further? Premium courses are open for enrollment now.

Find a course

Safe Hands: client confidentiality and AI, a firm’s checklist

Client confidentiality and AI: an accounting firm’s checklist.

Who it's for

How it works

Sources we rely on