Client data and AI: what never goes in the prompt

The short answer

Client data goes into an AI tool only when the firm has approved that tool, on a business account, with contract terms and settings that keep the data private and out of model training. Some data stays out of every prompt regardless: passwords and access codes, full identity and account numbers, other clients' matters, and anything a client or a rule has not cleared for that use.

For law firms and accounting firms, the question comes down to confidentiality duties that already exist. AI adds a new place for confidential information to end up, and the duty follows the information there.

Why this matters for law and accounting firms

Both professions hold client information under strict duties of confidence. A prompt typed into a free chatbot on a personal account sends that information to an outside provider under consumer terms the firm never reviewed. Depending on the tool and the settings, the text may be stored, reviewed by the provider or used to improve the model.

For lawyers, ABA Formal Opinion 512 (July 2024) applies Model Rule 1.6 directly to generative AI. Before putting information relating to a representation into an AI tool, a lawyer has to weigh the risk of that information reaching people outside the firm, or people inside the firm who should not see it. For self-learning tools, the opinion says the client's informed consent is needed, and a general clause in the engagement letter is not enough. The State Bar of California's practical guidance on generative AI makes similar points for California lawyers.

For accountants and tax preparers, federal law adds a further layer. Section 7216 of the Internal Revenue Code and its regulations restrict how tax return information can be used or disclosed without the taxpayer's consent. The AICPA Code of Professional Conduct also has a confidential client information rule. A full post on Section 7216 and AI follows next week.

A simple three-bucket rule

Most firms do well with a rule staff can remember without looking it up.

Never goes in any AI tool

• Passwords, PINs, security answers, multi-factor codes and access keys
• Full Social Security numbers, bank and card numbers, and other full identifiers
• Information about one client while working on another client's matter
• Tax return information where the client has not given the consent the rules require
• Anything a client has asked the firm to keep out of AI, or a court order or protective order covers

Only in a firm-approved AI tool, on a business account

• Client names, matter or engagement details, and correspondence
• Draft contracts, pleadings, advice letters and working papers
• Financial statements, ledgers and client documents
• Anything covered by privilege or professional confidentiality

Approved means the firm has checked the contract terms, confirmed the data is not used for training, set retention to suit the firm's obligations, and turned on the right access controls. For lawyers using self-learning tools, it also means the client's informed consent is in place where Opinion 512 calls for it.

Fine in any reputable tool

• Public information: published laws, regulations, guidance and articles
• General questions with no client detail ("explain the difference between these two lease structures")
• Firm templates and text written for public use

When staff are unsure which bucket something fits, the answer is the stricter one until someone with authority says otherwise.

Safer prompting habits

• Strip the detail. Many tasks work just as well with names, numbers and identifying facts removed or replaced with placeholders such as "Client A" and "Property 1".
• Ask for the shape, then fill it in. Have the tool draft a structure or a template, and add the client detail yourself outside the tool.
• Upload less. Paste the paragraph that matters rather than the whole file.
• Check the account before you type. A personal login on a work laptop is still a personal account.
• Keep output inside the firm's systems. Save drafts to the client file, not to a chat history nobody manages.

Where it usually goes wrong

In most firms, the risk comes from habit rather than bad intent. Someone uses a personal chatbot account because it is quicker. A browser extension with AI features reads every page it touches. A trial of a new tool starts without anyone checking where the data goes. The fix is to give staff an approved tool that is easy to use, a short rule they can follow and a clear person to ask.

Our post on personal versus business AI accounts explains why the plan matters, and the shadow AI guide covers how to find tools already in use.

Five steps you can take this week

1. Write the three buckets on one page and share them with every member of staff.
2. Name the AI tools the firm has approved, and the account type for each.
3. Ask staff which other AI tools they have used for client work in the last month, without blame.
4. For lawyers, check whether any current use of self-learning tools needs client consent under Opinion 512, and how that consent is recorded.
5. For tax work, confirm with your adviser how Section 7216 consent applies before any tax return information goes near an AI tool.

How we help

Managed Safe AI keeps approved tools, settings and the client data rule in place month by month, as vendors change their terms and features. A Safe AI Setup moves staff onto business accounts with the right settings and writes the client data rule into your AI use policy. If you are not sure where client data is going today, an AI Safety Check finds out first.

For sector detail, see what ABA Formal Opinion 512 means for a small law firm and whether ChatGPT is safe for accountants.

FAQs

Can I put client names into an AI tool?

Only in a tool the firm has approved for client work, on a business account with terms and settings that keep the data private. In a personal or free account, leave names and identifying details out.

Is a business AI account enough to protect client confidentiality?

A business account is a strong start, because the contract terms and admin controls are usually better. The firm still needs the right settings, a clear rule for staff, and, for lawyers using self-learning tools, informed client consent where Opinion 512 calls for it.

Does an engagement letter clause cover AI use?

For lawyers, ABA Formal Opinion 512 says a general, boilerplate clause in an engagement letter is not enough for informed consent to use client information in a self-learning AI tool. The client needs a real explanation of the risks and benefits.

Can accountants use AI with tax return information?

Section 7216 of the Internal Revenue Code restricts the use and disclosure of tax return information without taxpayer consent. Check with your adviser how the rules apply to your tools and workflow before any tax return information goes into an AI tool.

What should staff do if they have already put client data into the wrong tool?

Tell the person responsible for AI in the firm straight away. Note what was shared, in which tool and when, delete the conversation where the tool allows it, and follow the firm's incident process. Early reporting makes the problem much easier to manage.

---

*This post is general information, not legal, tax or compliance advice. Professional rules and guidance can change, so check current requirements (we checked ABA Formal Opinion 512, the State Bar of California's generative AI guidance, Internal Revenue Code section 7216 and the AICPA confidential client information rule on 12 November 2026) and talk to your own legal or compliance adviser about your firm's situation.*