It's 4:45 on a weekday late in the season. A second-year accountant in your practice has a client's rental property schedule in front of her. Eleven properties, three years of expenses, a spreadsheet the client built himself with merged cells and colour coding only he understands.
She copies the whole thing into ChatGPT and asks it to tidy it up and flag anything that looks like a capital item.
It does a remarkable job in about forty seconds. She checks it, it's right, and she goes home on time for the first time in a fortnight.
That's a composite, but I doubt there's a practice in Melbourne where some version of it hasn't happened. And she hasn't done anything malicious. She's done something efficient. Whether she's also done something the Tax Practitioners Board would have a view on depends on details she almost certainly didn't check.
What the TPB has actually said
In 2026 the Tax Practitioners Board finalised its guidance on AI, TPB(GS) 55/2026, The use of Artificial Intelligence and the Code of Professional Conduct. It doesn't create new rules. It explains how the existing Code applies when AI is involved.
The one that matters most here is Code item 6. Unless you have a legal duty to, you can't disclose information about a client's affairs to a third party without the client's permission. The TPB's guidance is explicit that entering client information into an AI tool can be a disclosure to a third party, depending on how the tool is configured and used, and that permission should be obtained first.
The guidance also covers competence, reasonable care and record keeping. Read: you are responsible for the output, you have to apply your own judgement, and AI does not change who signs the return.
Separately, the OAIC's guidance on commercially available AI products recommends, as best practice, that organisations don't enter personal information, especially sensitive information, into publicly available generative AI tools.
None of that puts ChatGPT for accountants off the table, and I want to be clear about that before the corrections start. It does mean four beliefs I hear regularly do not survive contact with the guidance.
"We turned off training, so it's fine"
The kernel of truth: turning off model training in an AI tool is a genuinely good step, and many business accounts do it by default. I'd rather a practice had that setting on than off.
The correction: it answers a different question. Code item 6 is about whether you've disclosed client information to a third party without permission. Whether the third party then trains a model on it is a separate matter. A setting in a tool doesn't substitute for the client's permission, and the TPB's guidance points you at the permission, not the setting.
"We're a small practice, so the privacy rules don't bite"
The kernel of truth: many small practices sit under the Privacy Act's small business exemption for most of their work.
The correction: the TPB guidance points practitioners back to the Privacy Act anyway, and it flags the Tax File Number Rule separately, which applies to anyone handling TFNs. And if your practice provides AML/CTF designated services, you've been covered by the Privacy Act for that work since 1 July 2026.
"Our practice software vendor handles all that"
The kernel of truth: AI built into the platforms you already use is often better controlled than a staff member's personal ChatGPT account.
The correction: it's still a third party, and AI features in practice software have been arriving quietly through updates. The professional bodies have pushed the TPB for clearer guidance on exactly this, because practitioners often can't see what the embedded features do. That's a reasonable complaint. It doesn't change who's responsible for the client relationship.
Beware: The most common exposure isn't the AI tool your practice chose. It's the free account on a staff member's phone, on mobile data, which no firm setting and no web filter will ever touch.
"So the safe answer is to ban it"
The kernel of truth: a ban is simple, and it's defensible on paper.
The correction: the TPB has gone out of its way to say it wants practitioners to use AI with confidence. And bans tend to push use onto personal phones rather than stop it, which is the worst of both worlds. I've written about that pattern in whether ChatGPT is safe for work use, and it applies to tax practices more than most.
The valet with your client's keys
Here's how I'd think about it.
Handing client information to an AI tool is like handing a client's car keys to a valet. Sometimes that's completely fine. The hotel's valet works for the hotel, the car stays in the hotel's garage, and the client agreed to valet parking when they booked. Other times, it's a stranger in a vest at the kerb who says he's with the restaurant, and you've no idea where the car's going.
What matters is knowing which valet you handed the keys to, and whether the owner of the car said you could. Everything else is detail.
For a practice, that means three things. Know which AI tools are in use and how each one is configured, including where the data is processed and what the provider can do with it. Make sure your engagement letter and client communications deal with AI in a way your advisers are comfortable with. And give staff an approved tool good enough that they don't reach for their phone. Personal devices are a separate headache, and the basics of securing hybrid work still apply.
Our older piece on using ChatGPT ethically was written in 2023, well before the TPB's guidance. Its instincts were right. The rules are now much clearer.
Tip: Pull out your current engagement letter template this week and search it for "artificial intelligence", "AI" and "third party". If nothing comes up, that's your first conversation with your professional adviser.
The wording is rarely the hard part. Agreeing what the practice actually does, before anyone writes it down, is where the time goes.
You're not behind
You trained as an accountant, not as someone who reads AI vendor terms of service. Nobody expects you to know where a chatbot processes its data any more than they expect you to service the photocopier. What matters is that the practice knows, and that someone has written it down.
We can't write your engagement letter, that's for you and your advisers. What we can do is tell you exactly which AI tools are running in your practice, where each one sends client information and how it's configured, in writing, so that the letter can say something true.
Where these numbers come from
- The use of artificial intelligence and the Code of Professional Conduct (fact sheet), TPB(GS) 55/2026, Tax Practitioners Board
- Guidance on privacy and the use of commercially available AI products, OAIC
Yener
