There’s a conversation happening in law firms and accounting practices across Australia right now. It usually goes something like this:
“Should we be using AI?”
“Someone said ChatGPT can write our letters.”
“Is that safe?”
“I don’t know.”
And then someone quietly starts using a free AI tool without anyone having properly thought through what that actually means.
Before that happens at your firm, there’s one thing every professional services practice needs to understand. It’s simple and it’s non-negotiable.
The rule
Never put client data into a public AI tool. Ever.
That’s it. That’s the whole rule.
Client names. File references. Financial details. Legal circumstances. Anything that identifies a client or their situation does not go into a free, publicly accessible AI tool.
Not ChatGPT on a free account. Not Google Gemini on a personal account. Not any tool you haven’t specifically verified has enterprise-grade data protections in place.
Never put client data into a public AI tool. Not ChatGPT on a free account. Not any tool you haven’t verified has enterprise-grade data protections in place.
Why this matters more for professional services
Most industries have some tolerance for data handling mistakes. Professional services firms do not.
You operate under strict confidentiality obligations. Lawyers have professional conduct rules. Accountants have the Tax Agent Services Act. Financial planners operate under AFSL requirements. Every one of those frameworks treats client confidentiality as foundational. Not a preference.
When you type client information into a free AI tool, that information can be used to train the model. It may be retained. It may be accessible in ways you can’t control or predict.
This isn’t theoretical. Law societies have issued guidance notes on it. The ATO has spoken about it. It’s happening, quietly, in practices across the country — staff using free AI tools in ways principals have no idea about and would be genuinely concerned by.
What you can safely use AI for
The rule on client data doesn’t stop you from getting real value from AI. It just means using it thoughtfully.
What’s safe: drafting template communications with no client-specific details in the prompt. Summarising publicly available information. Internal documents and processes. Your firm’s blog posts and marketing content. Meeting notes from internal team meetings with appropriate consent.
What needs an enterprise solution: anything involving client-specific information. If your firm is already on Microsoft 365, Copilot is the most practical option. It operates under Microsoft’s enterprise data protection framework and your data isn’t used to train the model. That distinction matters.
The conversation your firm should be having
If nobody at your firm has formally discussed AI use, now is the time. Who is using it? What are they using it for? What are the rules?
A one-page acceptable use policy is enough to start. Which tools are approved. What can and can’t go into them. Who reviews AI-assisted output before it reaches clients. That document protects your firm and gives your team clarity instead of anxiety.
DM me if you want a free template.
The opportunity inside all this
Professional services firms that navigate AI thoughtfully have a genuine opportunity right now. Your clients are confused and anxious about it. They’re reading conflicting headlines and wondering what it means for their professional relationships.
The firm that helps them understand it clearly and honestly will earn significant trust. Not by being an AI expert. Just by being one step ahead and being willing to share what you know.
The firm that helps clients understand AI clearly and honestly will earn significant trust. Not by being an expert. Just by being one step ahead.
That positioning is available to you. It starts with getting your own house in order first.
