This is general information, not legal, tax or professional advice.
It’s safe to put work into ChatGPT that has no client information in it, such as general questions, your own templates and examples you made up. What isn’t safe is anything that relates to a client’s affairs, unless the client has agreed and you’ve checked how the tool stores and uses what you type.
That’s where the Tax Practitioners Board and the privacy regulator land too. Below is what each one says, a simple list of what goes in and what stays out, and the jobs I’d start with if I were setting up AI for an accounting practice.
Key takeaways
- Work with no client information in it is the safe place to start.
- The TPB says you need each client’s permission before their information goes to a third party, and that can include an AI tool.
- The OAIC recommends keeping personal information out of publicly available AI tools.
- You stay responsible for the advice, so check every AI answer before you rely on it.
What the Tax Practitioners Board says
On 22 July 2026 the TPB issued a guidance statement for registered tax agents and BAS agents, TPB(GS) 55/2026, The use of Artificial Intelligence and the Code of Professional Conduct. The parts that answer this question:
- Confidentiality. Under Code item 6, unless you have a legal duty to do so, you “must not disclose any information relating to a client’s affairs to a third party without your client’s permission.”
- AI can count as a third party. You must get permission from each client before giving their information to a third party, and the TPB says that “can include entering client information into AI models and tools”, depending on how the tools are set up and used.
- It covers more than documents. The duty covers any information that relates to a client’s affairs. It doesn’t have to belong to the client or come from them directly.
- How permission can be given. A signed engagement letter, signed consent or other communication, and a general authority may also be acceptable. The TPB recommends telling the client who the information goes to, where it will be stored and whether AI tools may be used.
- Checking the output. Practitioners are “still ultimately responsible for the tax agent services they provide to their clients”, and “should not rely on AI output as a substitute for their own analysis of a client’s circumstances.” The TPB says to check AI content at each step and to document those checks.
Tax file numbers have one more layer. The TPB notes the Privacy (Tax File Number) Rule 2015 may also apply, and says to get your own advice on whether it does.
What the privacy regulator says
The OAIC’s guidance on privacy and commercially available AI products says privacy obligations “will apply to any personal information input into an AI system”. As a matter of best practice, it recommends that organisations “do not enter personal information, and particularly sensitive information, into publicly available generative AI tools”, because the privacy risks are significant and complex.
It also warns that some commercial AI products have “terms or settings that allow the product owner to collect the data input by customers for further training”, and says to carefully review the terms and settings that will apply to your use of the product.
The accounting side says the same. An August 2025 article on CPA Australia’s InPractice site quotes Brendan O’Connell, a member of CPA Australia’s Centre of Excellence for ethics and professional standards: “uploading client data into public AI tools such as ChatGPT is not OK, as confidentiality is not guaranteed.”
What goes in, and what stays out
| Fine to put in | Keep out |
|---|---|
| General questions, such as how to explain a term to a client in plain words | Client names, contact details and tax file numbers |
| Your own templates and checklists, with no client details | Tax returns, BAS, payslips and bank statements |
| Examples you made up yourself | Emails or notes about a client’s affairs, even with the name taken out |
| Drafts of your own newsletter or website copy | Anything a client hasn’t agreed to share with an AI tool |
The last two rows are the ones people miss. The TPB’s test is whether the information relates to a client’s affairs, so I’d treat a client email with the name removed as client information too.
If you want AI to work with client data, that’s a separate setup. You need the client’s permission, a tool whose terms and settings you’ve checked, and a record of how you checked its output. The TPB says practitioners are responsible for due diligence on the AI tools they use, including commercial ones, so that client information stays secure and the Privacy Act is met.
Where I’d start
I’d start with a job that needs no client data at all: rewriting your standard reminder email in plainer words, drafting a checklist for new clients, or turning your own notes into a first draft of a newsletter. You check each draft, and nothing about a client goes in.
That’s the rule in my own business. My monthly client reports come with the email drafted for me to check, and nothing goes out until I’ve read it.
Once that works, the next step is the admin around the work: a list of which clients still owe documents, with reminders drafted, and quick replies to new enquiries. A person approves every message before it goes. That’s what the automations I set up for service firms do.
AI also shows up on the other side of the desk, when someone asks ChatGPT or Google’s AI answer which accountant to call. If you want your practice to be one of the names it gives, that’s what AI SEO for Melbourne firms covers.
If you’d like to know which admin job costs your practice the most time, the free snapshot finds it and tells you if AI can take it. For the jobs I set up for practices, see AI for accountants in Melbourne.
Frequently asked questions
Can accountants use ChatGPT?
Yes, for work with no client information in it. The TPB says tax practitioners need each client’s permission before client information goes to a third party, which can include an AI tool, and the OAIC recommends keeping personal information out of publicly available AI tools.
Can I put a client’s tax return into ChatGPT?
Only with the client’s permission and after checking the tool’s terms and settings. Even then, the OAIC’s best practice advice is to keep personal information out of publicly available generative AI tools.
Who is responsible if ChatGPT gets a tax answer wrong?
You are. The TPB’s AI guidance says tax practitioners remain responsible for the services they provide, and should check AI output before relying on it.
Sources
- Tax Practitioners Board, TPB(GS) 55/2026 The use of Artificial Intelligence and the Code of Professional Conduct (issued 22 Jul 2026, checked 9 Nov 2026)
- Tax Practitioners Board, media release on the AI guidance statement (22 Jul 2026, checked 9 Nov 2026)
- OAIC, Guidance on privacy and the use of commercially available AI products (updated 17 Jan 2025, checked 9 Nov 2026)
- CPA Australia InPractice, How far can you go with AI before you hit an ethical dilemma? (25 Aug 2025, checked 9 Nov 2026)
Related guides
These pages go deeper on the parts of this guide that need their own page.
Where this leads: Foundations and Operations
See who is taking customers nearby.
For your free Competitor snapshot, I look at who is ranking nearby for the work you sell, and send you the names that actually matter.
