Confidentiality is the first question a practice should ask before using AI, and it is answered in the design, before anything is built. We start by mapping what each workflow reads, where it sends it and who can see the result, and we write that map down so it can be explained to a client, a partner or a reviewer. Then the build follows a few working rules.
- An AI step receives only the fields it needs for its task. Tax file numbers, identity documents and bank details stay out of AI steps. Any exception is a decision the firm makes against its own obligations, and it is recorded before the workflow runs.
- Workflows run on business accounts and business-grade AI services that the practice controls, never through a personal account held by a staff member. The provider’s data-use, storage and retention terms are reviewed with the firm before any client information goes in: under the TPB guidance below, how a tool is set up and used bears on whether that is a disclosure.
- Where the tool supports it, a workflow runs under its own limited role and sees no more of the client list than the staff member it works for would. Where it does not, the data map records exactly which client records the connection can reach, and the firm approves that before anything runs.
- Each use of client information is recorded: what was read, drafted or sent, by which step, and who approved it, so the firm can answer a client who asks where their information went.
These rules sit under obligations the firm already carries. Accountants who belong to a professional body have confidentiality duties under its code of ethics; for members of CA ANZ, CPA Australia and the IPA, that is APES 110, the Code of Ethics for Professional Accountants. Registered tax and BAS agents also carry them under the Code of Professional Conduct in the Tax Agent Services Act 2009, which the Tax Practitioners Board (TPB) administers, and the Privacy Act may also apply to the practice.
In July 2026 the TPB published guidance statement TPB(GS) 55/2026 on AI use and the Code. It says that putting client information into some AI tools can be a disclosure to a third party, which needs the client’s permission, depending on how the tool is set up and used. An engagement letter is one place that permission can be given. Where the Privacy Act also covers the practice, the Office of the Australian Information Commissioner (OAIC) has guidance on privacy and commercially available AI products. It approaches the same question from the privacy side: which client details go into which tool, on what terms, and what clients have been told. It belongs next to the TPB statement when the firm settles its own AI policy.
The firm decides its engagement letter wording and what it asks clients to agree to. SynergAI designs the workflow to the rules the firm sets and documents the data flows so they are easy to explain.
This is general information, not legal or professional advice.