Mastering AI Security and Privacy: 7 Best Practices for Accountants

If you're an accountant running an accounting firm and you're using AI in your firm, then you really must be careful about client confidentiality, privacy, security, because you could soon get into serious trouble. In this video, I'm going to share with you seven best practice things that you can do to make sure you don't get on the wrong side of the regulations and the professional ethics. So let's get into that video. Let me share the seven best practice tips.

Okay, so I'm Mark Wickersham, chartered accountant. I used to run my own accounting firm. Now I help accountants around the world to master both value pricing and AI and ChatGPT. And one of the things that is a really big issue is the whole area of privacy and security. So you need to be aware that firstly, we have the professional ethics to be careful of and essentially, as professionals we have a fundamental ethical duty. Now, I don't know whereabouts you are in the world right now and every country is different. And so I'm going to give you some general ideas, but you would need to, I recommend you, you consult, you check with your professional body what their specific recommendations are. But for example, in the us, the aicpa, if you go to their code of professional Conduct, they prohibit disclosing any client information. I'm a chartered accountant from the uk, I'm a member of the icaew, that's the Institute of Chartered Accountants in England and Wales. And they say that we have to be very careful with AI and confidentiality. And if you read this, it goes on to say our advice is to approach with caution. If any of the information you are considering inputting into AI tools includes client data, then it's very likely that this will breach client confidentiality. So we have to be really, really careful when we're using tools like ChatGPT, not to for foul of those, the various rules and professional conduct. But not just that, there's other laws we have to be careful of. There's gdpr, there's the data protection laws in the uk, there's the UK Data Protection act in California, the ccpa. There are all sorts of laws, regulations around protecting data. And without client consent, sharing data with an AI tool could be a violation. So we have to be really careful. And if you're in the EU, for example, or the UK, UK and you're using an AI tool, that's where the data is held in the US. Take for example, OpenAI, ChatGPT, then there's international data transfer taking place. You have to be aware of that. And another issue to be careful of is something called the right to be forgotten. Clients have the right to request deletion of personal data and that's really, really problematical if we are putting their data into ChatGPT and other AI tools, large language models. So what can we do about this? That sounds really, really scary, but there are things that we can do and I'm going to share seven steps with you that you need to consider. So number one, and I guess it's the most obvious one, is you should never input real client data into a public AI system.

So just make sure that you're not disclosing details of your clients, their names, their addresses, their dates of birth. Any personal information about a client should not be put into a public AI system. Number two, consider using anonymized data or synthetic data. So anonymized data is where you input some data, but you delete from it all reference to a client. And synthetic data is where you create some data. For example, an Excel spreadsheet that is similar, has similar trends to the client's data, but it's not the client's data. So that's number two. Number three, consider adopting secure versions of AI. So if we think about large language models, there are lots of different tools that we can use. There's OpenAI's ChatGPT, there's Google's Gemini, there's Claude by Anthropic and many, many more. And they all are aware of this issue. And if you use their business editions, then you have extra layers of protection. So for example, with ChatGPT, the best model to use would be the enterprise model. Unfortunately that's for large firms and for most accounting firms that's just not applicable. So the next best step would be the teams platform. It's the one that we use in our business because with Teams 1, the default is that it does not use your chats to train its models. So with any AI tool you need to be making sure you're using a secure one if you're going to be use it where you might use it with clients information.

Also, and this is really important, you need to make sure that in your firm you implement an AI usage policy. You should have a policy in your firm that's really important in this day and age.

Then the next thing we need to do as far as best practice is you need to have some employee training. If you've got a team of people in your business, then you need to make sure that you explain to them your AI usage policy, what is your policy and you need to be teaching them, training them on how to use it, so they are aware, for example, of what they can use it for and what they can't use it for, the things they can't put in. Like, as I said earlier, client information like names, addresses, dates of birth and so on, make sure your team are aware. And that might also include things like making sure that if you're using a team's account and they have a personal account, they shouldn't be using their personal account, where there's a risk of client data being shared. Next, we need to make sure that we are compliant with GDPR and institute guidelines. So, as I said at the outset, I don't know what institute or professional bodies you are governed by, but one of the things you should do is go to their website and look for their guidance around AI. Certainly the ICAEW in the UK has AI guidance, as does in the US for CPAs. So go and check your professional body to see what they say. And number seven, last but certainly not least, is you need to maintain human oversight, and this should be specified in your AI usage policy. What that means is that everybody in your business needs to be aware that you cannot rely on the output. The way I think of it is I treat ChatGPT and other large language models, I treat them as if it's a junior assistant. It's a tool to help us, a tool to help us save huge amounts of time to get better results. But as you probably know, it's not always accurate and sometimes it hallucinates. Hallucination is this term that is used in the AI world. That means that if an AI model doesn't know what the answer is, it has a tendency to make something up in a highly convincing way. And so we must maintain human oversight. And that means that when we use AI as a tool, perhaps to create a report for our clients, perhaps it's for tax planning or something, we should definitely have somebody who's appropriately qualified to go through that, read that report before it goes out to the client. Never have anything go to a client generated by AI without a human in the loop, as it's often now referred to. If you want to learn more about AI, then I have a community that's completely free that you can join if you are interested. It's. It's called ChatGPT for accountants, and this is a great place to go and get help from the rest of the community to ask questions and so on. And if you've got your smartphone to hand, you can hold it up to the QR code, I'll put the link below the video as well. What you'll also find in the community is I've done training videos, tutorial videos to help you get more out of AI and if you want to go even further still, I have created a a training course on how to be completely compliant around privacy, security, client confidentiality. It includes a 35 page guide that you can access and if you want access to my training course and the guide and other resources like a ready to use AI privacy policy for example, then join my AI Academy. It's a small, tiny monthly investment and you get access to to the community in the academy. And also there are many more videos in this one so you have two options. Certainly join the free community, there's some great stuff there. But if you want to go deeper and particularly if you want to get access to my Training and the 35 page workbook on AI privacy, security and client confidentiality, then you'll have everything you need in that course inside the AI Academy. Thank you so much for watching. If you found today's video valuable, please give it a thumbs up and please tell me below your comments. Have you got a policy in place in your firm? What are you currently doing around AI? Are you using it in your firm? Let me know in the comments. I would love to know. Okay, see you on another video. Bye for now.