Is It Safe for a UK Accountancy Firm to Use ChatGPT?

Short answer: no — not with the free or public version of ChatGPT and real, client-identifying data. Do that and you're risking your professional duty of confidentiality and UK GDPR, because anything you paste leaves your firm's control and, on the consumer tiers, can be fed back into training the model. But — and this is the part people miss — that doesn't mean your firm has to sit AI out. It means you need a compliant path: anonymised or synthetic data, an enterprise agreement with training switched off, or, the strongest option for real client work, a private AI model that runs inside your own data boundary. Below: the rules, what you can and can't paste, and the four safe options ranked from cheapest to strongest.

This is practical guidance for practice leaders, not formal legal advice — run any firm-wide policy past your MLRO or compliance partner before you roll it out.

Why is public ChatGPT a problem for accountants specifically?

Three separate obligations collide the second client data goes into a public AI tool.

1. Professional confidentiality. Confidentiality is one of the five fundamental principles in the ICAEW and ACCA Codes of Ethics (and the AAT and CIOT equivalents). You can't disclose client information you acquired through your work to a third party without proper authority. Paste a client's records into a public chatbot and you've just made a disclosure to a third party — OpenAI — that your client never signed off on.

2. UK GDPR. Your firm is the data controller for your clients' personal data. Send that data to a third-party AI provider and they become a processor, which means you need a lawful basis, a data-processing agreement, and actual knowledge of where the data goes and how long it's kept. On the free consumer tier you have none of that.

3. Training on your inputs. On the free tiers of ChatGPT, Claude, Gemini and Perplexity, your inputs may be used to train future models unless you've explicitly turned that off. And once client data is in a training set, there's no getting it back. This isn't hypothetical — the widely reported case of engineers pasting proprietary source code into ChatGPT is the exact same failure mode, only pointed at your clients' financial data instead.

Here's the uncomfortable bit: your team is almost certainly already doing it. Someone pastes a client email, a set of figures, or a fiddly HMRC question into ChatGPT because it genuinely gets them unstuck. A policy email banning it rarely works — it just pushes the habit underground. The only durable fix is to hand people a compliant way to get the same help.

What can and can't I put into ChatGPT?

A simple gut check: would you be fine with this exact text sitting on a third party's servers, outside your control, possibly forever?

Never paste (client-identifying):

• Client names, addresses, dates of birth, National Insurance or UTR numbers
• Bank details, account numbers, specific financial figures tied to a named client
• Engagement letters, tax correspondence, or case details that identify a client
• Anything under a confidentiality clause, or anything that could identify a client when combined with other data

Generally safe (non-identifying):

• General technical questions ("how does the VAT reverse charge work for construction?")
• Anonymised data — every identifier stripped out
• Synthetic data — realistic but fictional figures that carry the same shape as the real numbers
• Drafting help on templates, letters, and processes with no client specifics in them

One warning: anonymisation is harder than it looks. A "£"-figure plus a sector plus a region can still point straight at a client. When in doubt, treat it as identifying.

The four compliant ways to use AI in a practice (ranked)

1. Anonymise or synthesise before you paste. Cheapest, and you can do it today. Strip the identifiers, or generate synthetic data with the same structure. Great for one-off analysis — but it's fiddly and error-prone at volume, and one slip is a breach.

2. Enterprise/Team ChatGPT with training disabled + a DPA. The business tiers say they don't train on your data by default, encrypt in transit and at rest, and give you admin controls plus a data-processing agreement. Materially safer than the consumer tier. The catch that doesn't go away: your clients' data still leaves your infrastructure and lands with a US-based provider — which some engagement letters, and some clients, simply won't accept.

3. A private AI model inside your own data boundary. The strongest option for genuine client work — an assistant trained on your firm's own documents, hosted in a UK region, where client data never leaves your boundary and never touches a public AI provider. That kills the confidentiality and residency problems at the source instead of mitigating them. It's more to stand up — which is the whole reason productised offerings (like Framz Ask) exist — but for a firm handling regulated data it's the only option that lets juniors use AI on real client material without tying themselves in a compliance knot.

4. Hybrid. Public/enterprise AI for general, non-client work; private in-boundary AI for anything client-identifying. Most firms land here in the end.

What does "doing it safely" actually look like?

Three things, in this order:

1. Visibility. You can't govern what you can't see, so start by knowing what's being pasted where. Our free Shadow AI Data Leak Scanner lets anyone paste text and see the PII, credentials, and identifiers hiding in it before it goes near a public model — and the scan runs on our own hardware, so the text never reaches a third-party AI.

2. A short, clear policy. One page: what may and may not go into AI tools, which tools are approved, and who to ask. We publish a free, ready-to-adapt AI data-governance policy template for exactly this.

3. A compliant path. Give people an approved way to get AI help on real work, so the policy is something they follow rather than something they route around.

Frequently asked questions

Can I use ChatGPT if I turn off chat history?

Turning off history/training on a consumer account reduces the training risk, but it doesn't give you a data-processing agreement, data-residency guarantees, or the contractual assurances UK GDPR expects of a controller-to-processor relationship. Better than nothing — not a compliant basis for real client data.

Is ChatGPT Enterprise enough for an accountancy firm?

For plenty of internal, non-client tasks, yes. For client-identifying data the sticking point is usually data residency and the fact the data still leaves your infrastructure — check your engagement letters and your clients' expectations. When those forbid it, a private in-boundary model is the answer.

Does using AI put my ICAEW/ACCA membership at risk?

Using AI doesn't; breaching confidentiality does. The obligation is the same whether you're disclosing to a person or a chatbot. Use AI in a way that keeps client data confidential and you stay aligned with the fundamental principles.

What about HMRC guidance and Making Tax Digital?

Asking AI general questions about HMRC guidance or MTD is fine — that's public information. The only risk is ever the client data you attach to the question. A private model can index live HMRC guidance and your firm's documents without either one leaving your boundary.

Isn't a private model expensive and slow to set up?

It used to be. Productised deployments now go live in weeks on UK-region cloud, at fixed pricing. And the honest comparison isn't "free ChatGPT vs expensive build" — it's "a compliance incident vs a controlled system your team will actually use."

The bottom line

Public ChatGPT plus real client data isn't safe for a UK accountancy firm — it puts confidentiality and UK GDPR on the line. But banning AI outright just buries the problem and hands back the productivity you were trying to win. The right move is a compliant path: anonymise or synthesise for the light stuff, use enterprise AI with a DPA for internal work, and use a private, in-boundary AI model for anything touching real client data.

Framz builds exactly that — private AI document intelligence for UK accountancy firms, where client data never leaves your boundary. Want to start with the free pieces? Run the Shadow AI Data Leak Scanner, grab the governance-policy template, or book a scoping call.