Can accountants use ChatGPT, Copilot or Claude with client data?

Yes, but not the way most people start. Client data can go into an AI assistant if it’s a business version of the tool, under a contract that keeps your data out of model training, set up by someone who knows where that data ends up, and used under a short written policy. Pasting a client’s details into a free personal account is a different matter. The tax professional bodies’ own guidance says that is probably a breach of confidentiality.

Here’s what separates the two, what UK GDPR and your professional duties ask of you, and what a sensible policy for a practice looks like.

Why this needs care in an accountancy practice

Three things make AI different for accountants than for most small businesses.

Confidentiality is a professional duty, not just good manners. It’s one of the five fundamental principles in the ethics code ICAEW and the other bodies follow. The joint guidance tax professionals work to, Professional Conduct in Relation to Taxation (PCRT), has topical guidance on AI. It says putting client data into a publicly available AI tool is probably a breach of confidentiality unless the client has agreed. It also warns that leaving the name out isn’t enough: an unusual business or set of circumstances can identify a client on its own.

You’re the data controller. Using someone else’s AI tool doesn’t hand your UK GDPR obligations to them. The ICO’s guidance on AI is clear that an organisation buying in an AI system is usually still the controller, and stays responsible for how personal data is used.

The risk usually starts with good intentions. Someone in the team finds that a chatbot drafts a client letter in seconds, and starts using their personal account to do it. Nobody decided that client data should go there; it just did. Giving people an approved tool is the most effective way to stop it.

Consumer and business versions are not the same product

The free and personal versions of these tools and the business versions often look identical. What differs is the contract behind them, and in particular whether your conversations can be used to train future models.

Tool	Personal and free versions	Business versions
ChatGPT (OpenAI)	Free, Plus and Pro conversations can be used for training unless you switch off “Improve the model for everyone”	ChatGPT Business, Enterprise and the API are not used for training by default
Claude (Anthropic)	Free, Pro and Max users choose whether chats are used for training. Opting in also means they’re kept for up to five years	Claude Team, Enterprise and the API are not used for training by default
Copilot (Microsoft)	The consumer app, signed in with a personal Microsoft account, sits under Microsoft’s consumer terms	Copilot Chat signed in with a work account gets enterprise data protection: prompts and responses stay within the Microsoft 365 service boundary and aren’t used to train the underlying models

Business plans also come with a data processing agreement, admin controls over who can use the tool and how, and logs your IT administrator can search. All three companies are American, so check that the agreement covers UK GDPR and transfers of data out of the UK. That isn’t unusual: it’s the same check you’d make of any cloud service that holds client data.

Turning off training in a personal account is better than nothing, but it doesn’t fix the underlying problem. The account still belongs to the individual, the firm has no control over it, and nothing stops the setting being switched back on.

Microsoft 365 Copilot has a catch of its own

If your practice runs on Microsoft 365, Copilot is the natural choice: it works inside the systems your team already uses, under the same sign-in and security rules. But it comes with one condition worth understanding before you switch it on.

Copilot can find anything the person using it is allowed to open. It doesn’t give anyone new access, but Microsoft itself points out that it makes years of accumulated oversharing much easier to find. A folder of payroll files shared with “everyone” in 2019 and forgotten is suddenly one question away from anyone in the firm.

So the work starts before Copilot does: review who can see what in SharePoint, OneDrive and Teams, tighten anything shared with the whole organisation, and use Microsoft’s own tools to keep sensitive sites out of Copilot’s reach where needed.

None of this needs a lawyer for a typical practice, but it does need doing.

Do a data protection impact assessment (DPIA). The ICO’s view is that in the vast majority of cases, using AI with personal data is likely to be high risk, which makes a DPIA a legal requirement. For a practice adopting a mainstream business tool, it can be short: what data goes in, why, which supplier, what the contract says, and what could go wrong.
Have a lawful basis and tell people. Update your privacy notice to say you use AI tools to help deliver your services, and how. Your engagement letter is a natural place to mention it too.
Use the supplier’s data processing terms. That means a business plan, not a personal account, and checking where the data is processed and for how long it’s kept.
Put only what’s needed in. If a task works without names, addresses or tax references, leave them out.
Remember that the output is yours. If an AI tool helps draft advice or a calculation and gets it wrong, the responsibility is still the firm’s. A qualified person checks anything that goes to a client or HMRC.

A short AI policy for your practice

A policy doesn’t need to be long to work. One page that people actually read beats a long document nobody opens. It should answer six questions:

Which tools are approved? Name them, and say that work is done only in those tools, signed in with work accounts.
What can go in them? Client personal data only in the approved business tools. Never in free or personal accounts, and never in tools nobody has checked.
How are they set up? Training off, sensible retention, access limited to the people who need it, and the Microsoft 365 sharing tidied up before Copilot goes in.
Who checks the output? A person reviews anything that goes to a client, to HMRC or into a set of accounts.
What do clients know? The privacy notice and engagement letter say that AI tools are used and how.
Who owns it? Someone keeps the policy and the DPIA up to date, makes sure new starters see it, and reviews it at least once a year, because these tools change quickly.

AI agents

Approvals

Nothing an agent writes goes to a client until a person approves it

Needs your approvalDrafted by the client email agent

Hi Sam, could you remind me what I need to pay in January?

Draft reply

Hi Rhys,

For January you’ll need to pay £2,140 by 31^st January 2027. That’s a balancing payment of £860 for 2025-26 and your first payment on account of £1,280 towards 2026-27. Pay HMRC online with your UTR followed by the letter K as the reference.

Sam

From:2025-26 tax computationPayments on account

Approve and sendEditReject

AI agents. An agent drafts the reply from your records and shows what it drew on. A person approves it before it’s sent. More of what we build Drag the edge to resize

The short version

AI can save an accountancy practice real time, and client data doesn’t have to stay out of it. It just has to go into the right version of the tool, under the right contract, set up properly, with a person checking what comes out. Most of the risk sits in the gap between what the firm has approved and what people are quietly using already, and closing that gap is mostly a matter of giving them something better.

This is how we build and run AI tools for accountancy & tax firms: AI you can trust with client data. If you’d like to know where your practice stands, including what your team is already using, a Technology Review covers it.