Named reviewerDraft beside source figuresReview before release
20 sample client files sit behind a closed access gate.
One file and one task are approved. Six account totals go to a draft.
A request to change the ledger is blocked. Reads pass; writes do not.
Approve the task before the access: one file, six totals, no ledger writes and a named reviewer.
Illustrative figures, not client data.
In short
Map every recipient before client information enters an AI tool.
Separate client permission, software permissions and professional review.
Start with narrow read access and a tested way to disconnect.
Connecting a client file creates a data-access decision for the practice owner.
I would settle that decision before choosing the model. A draft needs an authorised purpose, limited data and a reviewer. A subscription label does not answer those questions.
Exhibit 2
The sample task opens 1 of 20 client files, uses 6 totals and writes nothing
Narrow
1 of 20
Client files opened
One approved file, not all 20.
Limited
6
Account totals sent to the draft
Narratives, payroll and identifiers left out unless the task requires them.
Blocked
0
Ledger writes allowed
Read access only. A request to change the ledger is blocked.
Person
1
Named reviewer before release
The draft sits beside its source figures.
Illustrative figures, not client data.
Draw the whole data flow
Exhibit 3
Each recipient belongs on the access map
01Client Xero file
For the sample task, account totals only, for one authorised entity.
02Approved connector and permissions
Read access stops changes but still lets information leave the ledger.
03AI provider and approved storage
Record where the data goes, who can access it and for how long.
04Draft with source references
Every figure in the draft points back to its source.
05Practice reviewer
A named person checks the draft before anything is released.
Also record logs and support access, check onward disclosure through search and other tools, and make no ledger writes in the sample. An illustrative architecture.
Read access stops changes but not disclosure, so limit the data as well
01
Read access stops changes
Read access prevents the permitted connection changing records.
02
It still lets data leave
Information can still leave the ledger, so test both boundaries.
03
Limit the data
Use six account totals from one approved file. Leave out narratives, payroll and identifiers unless the task requires them.
Illustrative figures, not client data.
The OAIC’s AI guidance asks organisations to examine data flows and third-party access.
Keep the permissions separate
Exhibit 5
Three permissions answer different questions
Decision
Evidence to retain
Client permits the disclosure
Applicable engagement terms or recorded permission
Connection permits the task
Approved entity, data scope and read/write settings
Practitioner accepts the output
Named reviewer, source checks and release decision
An illustrative control framework, informed by the Tax Practitioners Board’s guidance and Xero’s developer FAQ, read 31 October 2026.
Exhibit 6
Client permission and software consent are separate, and each needs its own control
Client permission
Needed before third-party disclosure, unless a legal duty applies
Explain the recipient, storage and AI use
Existing engagement terms may cover it; assess what they actually say
Software consent
Xero’s Remote MCP V1 tools do not request confirmation before changes
Build an enforceable approval step for writes
Do not rely on a prompt alone
Informed by TPB(GS) 55/2026 and Xero’s developer FAQ, read 31 October 2026.
TPB(GS) 55/2026 says tax practitioners need client permission before third-party disclosure, unless a legal duty applies. It recommends explaining the recipient, storage and AI use. Existing engagement terms may provide permission; assess what they actually cover.
Software consent is a separate control. Xero’s developer FAQ says its Remote MCP V1 tools do not request confirmation before changes. Build an enforceable approval step for writes. Do not rely on a prompt alone.
The TPB guidance also identifies additional TFN obligations. Get advice on the proposed use.
Check the contract and the review
Exhibit 7
A training exclusion leaves other checks open
Check
Required answer before use
Training and feedback
Exact plan terms and enabled settings
Storage and deletion
Retention period, backups and deletion route
Other recipients
Support access, subprocessors and countries
Controls
Access removal, incident contact and review record
An illustrative vendor checklist, informed by the OAIC’s guidance and Anthropic’s data-use page, read 31 October 2026.
Check the actual product and account terms. Anthropic says commercial inputs and outputs are not used for training by default. Feedback or explicit permission can change that.
Ask separately about retention, support access, subprocessors and overseas handling. OAIC guidance addresses cross-border disclosure and reasonable security measures, including retention exceptions.
CPA Australia recommends checking AI research against primary sources. Xero says its developer logs record API calls, not prompts or tool calls. Keep your own proportionate review record. The partner checks the conclusion before its release.
What to do first
Exhibit 8
Prove the boundary with sample data
01Owner: approve purpose and recipients
Name the task, the data and every recipient.
02Adviser: confirm obligations and permission
Get advice on client permission, overseas disclosure and TFNs.
03Builder: restrict and test access
Read access only. Test a refusal when a different file or a ledger change is requested.
04Reviewer: reconcile draft to sources
Check the entity, period and source figures on every draft.
05Owner: approve use and review date
Decide whether to go on, and when to review again.
An illustrative method. It does not establish legal compliance on its own.
I would begin with a sample reporting task. Require the correct entity, period and source figures on every draft. Test refusal when a different file or a ledger change is requested.
This is general information, not privacy or legal advice. Check whether the Privacy Act applies to your practice; the small business exemption has exceptions. Obtain advice on client permission, overseas disclosure and TFNs before using real records where the position is unclear.
Common questions
Can accountants use AI with client data?
The answer depends on the purpose, data and controls. Assess confidentiality and privacy obligations before sending client information to a provider, using the OAIC and Tax Practitioners Board guidance.
Do I need client consent to use AI?
For tax services, TPB guidance requires permission for third-party disclosure unless a legal duty applies. Whether the proposed AI use involves disclosure depends on its configuration and use. Check privacy obligations separately.
Does a business AI account keep data out of training?
Check the provider’s terms for the exact product. Anthropic’s commercial default excludes training, but feedback and explicit permission are exceptions. That default does not settle retention or access.
Chartered Accountant (CA ANZ) and finance executive, based in Canberra. Practical AI and automation for SMEs, and adviser to owners, CEOs and boards on integration and finance.
If your team is connecting tools without an agreed data boundary, I help define the controls and first workflow. Start with the Diagnostic.
Renzo Demartini