AI Compliance for Accounting Firms: What to Tell Clients

Transcript

Welcome to today's deep dive. You know, if you run a business in Australia, maybe you're a busy tradie managing a plumbing crew or heading up a small accounting firm, you are likely time poor. But today's topic is something you really can't ignore. We are looking at a July 2026 CoterieLabs Field Note on AI compliance. Yeah. And even though it's technically aimed at accounting firms, the reality is if you handle any sort of client data, this directly affects your livelihood. We are distilling the exact legal risks of AI and the practical steps you need to take like today to lock down your data. Okay, let's unpack this. Imagine printing out your client's most sensitive financial data, or I know the security specs for a massive commercial build. Right. Highly confidential stuff. Exactly. And then you just leave it on a sticky table at the local pub for anyone to read. Well, legally, as of July 2026, regulators are saying that is exactly what you are doing when you paste client data into free AI tools. What's fascinating here is that the rules of the game have shifted fundamentally. I mean, we are officially moving out of the wild west of AI and into a strictly regulated environment. And that pub table analogy, it's actually worse. Wait, how is it worse? Well, it's like leaving the invoice on the pub table and the bartender is actively memorizing the numbers to help answer questions for the very next customer who walks in. Oh, wow. Yeah, because when you use public AI, you're usually agreeing to let your client's data train their global models. Like a snippet of your client's private strategy document could theoretically surface in a competitor's query. Exactly. Which brings us to the massive precedent the Tax Practitioners Board set on the 22nd of July 2026. They formally ruled that the AI did it. Defense is just dead. Dead and buried. Right. You cannot transfer responsibility to the algorithm. You own every single output, whether a human or a model produced it. And CPA Australia's Brendan O'Connell was incredibly blunt about this. He stated that uploading client data to public AI tools breaches the APS 110 confidentiality rule. Yeah. And for those outside the accounting world, APS 110 is basically the industry's baseline professional duty. It mandates that you absolutely cannot disclose client information without proper authority. Free AI platforms simply don't guarantee that confidentiality. So if the regulators have killed the AI did it defense, that instantly turns our everyday tech stack into a massive liability. But hang on, let's play devil's advocate for a second. What if an electrician or a consultant just bans Shad GPT outright across their business? Sure. A blanket ban. Right. Surely they're off the hook. If they're paying for an enterprise license like Microsoft 365 Zero or MYOB, shouldn't that data already be ring-fenced? Why is the exposure still there? I get why you'd think that. But paying for software doesn't automatically mean your data is siloed. The biggest hidden exposure isn't a rogue apprentice pasting code into a free web browser. So what is it then? It's the AI features already embedded inside the tools you run your business on 24-7. Or those free browser extensions your staff download to write emails faster. Oh, so the software companies are rolling out updates with AI features just switched on by default. Often, yes. These tools can have AI models quietly running in the background just hoovering up data. That is sneaky. Very. If you haven't checked your settings, those features might be taking your proprietary client data and feeding it back to train the provider's larger models, completely bypassing that outright ban you thought you had in place. So what does this all mean? For a time-poor owner who just wants to get back to work, what is the grounded practical fix to stop data leaking through software we already use? There is a three-step action plan you need to knock out this quarter. First, write a one-line policy. It doesn't need to be a corporate manual. Nobody reads those anyway. Exactly. Just state no client data in public AI tools, full stop. And explicitly name the secure paid tools your staff are allowed to use. Got it. And second, you have to audit your software. Like, you need to physically log into Xero, MYOB, Microsoft 365, and hunt down the AI toggles. Yes. You need to know exactly what is switched on and where that data is going. Right. You can't just assume it's off. Precisely. And the third step is preparing for a major Privacy Act rule hitting on the 10th of December, 2026. You need to update your engagement letters and client contracts. To disclose if personal information is feeding substantially automated decisions. I should probably clarify that term. Yeah, definitely go for it. A substantially automated decision means the AI is making a call that impacts the client-like generating a tax estimate or flagging a compliance risk without a human actively reviewing the logic. Right. And if you are doing that, the law says you have to tell people how you are using AI and just as important that how you aren't. That transparency is non-negotiable moving forward. So, to lock this down, audit your everyday software toggles, write your one-line policy, and remember that you own your outputs. You just cannot outsource the blame to an algorithm. The buck absolutely stops with you. With the Privacy Act mandating that disclosure by December 2026, it leaves you with a pretty big question to mull over. Oh, absolutely. How will your long-term clients react when they realize a machine, rather than the trusted, hard-working human expert they hired, has been quietly making decisions on their files? Something to chew on while you check those software toggles. That was a Field Note brought to you by CoterieLabs. We help Australian businesses work out where AI actually pays and where it doesn't. The full write-up with every source and link is in the show notes. And if you're wondering where AI fits in your own business, there's a free two-minute scan at CoterieLabs.com.au. New Field Note every weekday.