Thursday afternoon in the accounts preparation team of an accountancy firm. A junior accountant has exported a client's general ledger and sees a run of postings on the suspense account that do not fit anywhere. He opens ChatGPT, types "what probably happened here?" and pastes four hundred lines. In them: the client's name, the IBANs of suppliers and customers, the payroll journal with salaries, and, in one description, a citizen service number someone once typed in for an attachment of earnings.
The rule of thumb is short: the task is fine, the client is not. Explaining a run of entries, rewriting the notes, tidying a client email: a chatbot can do all of that. What has to come out before you paste is everything that points to the client: the name, the Chamber of Commerce number, the IBANs, the salaries and citizen service numbers, as well as figures not yet adopted. Whether it is allowed on this account at all depends on what the firm has decided about the tool.
Why is a prompt different from a question to the colleague next to you?
A question to the colleague next to you stays inside the firm, under the same duty of confidentiality you have. A prompt goes to a vendor. What happens to it then depends on the account. On a free or personal account the input can be stored and used to improve the model unless you have switched that off yourself, and there is no data processing agreement (DPA) behind it. On a firm account with an agreement, different terms apply, and the firm knows them. What happens to a prompt on each type of ChatGPT account is covered in ChatGPT and work data.
Two frameworks meet here. Confidentiality is one of the fundamental principles in the VGBA, the Dutch professional rules for accountants, and that duty covers everything a client entrusts to the firm, including figures with no person in them. Once a person is involved, such as the director-shareholder or an employee in the payroll journal, the GDPR applies, and a prompt is processing, not a notepad. The Dutch Data Protection Authority reported several data breach notifications in which employees had put personal data into an AI chatbot. The general list of what never belongs in a prompt is in what you can and cannot share with AI. This piece is about the three tasks that come up most often in a firm.
Three tasks, and what comes out
| Task | What stays in | What comes out before you paste |
|---|---|---|
| Explain ledger entries | The accounts, the dates, the amounts, the patterns | The client name, the counterparties and their IBANs, the payroll lines, anything in a description that points to a person |
| Rewrite the notes to the financial statements | The structure of the notes, the accounting policies, the wording | The company name, the amounts, events after the balance sheet date that are not yet public |
| Tidy a client email or advisory memo | The question, the structure, the tone | Name, family relationships, valuations, tax positions, health as the reason for a transfer |
The first row is the awkward one, because a ledger looks harmless. It is just numbers. But the descriptions are free text, and after ten years of bookkeeping they hold all sorts: names, number plates, a citizen service number next to an attachment of earnings. Paste the ledger and you paste that column with it.
Why is removing the client name not enough?
Because a client is often identifiable by its figures. Revenue of 2.4 million, with one customer accounting for sixty per cent of it, points to one company in a small sector for anyone who knows the sector. A Chamber of Commerce number is public and leads straight back. A counterparty with a recognisable name in the descriptions does the same. And in a family business, "the daughter taking over the firm", with the town added, already identifies a person. Why combinations of innocent fields point to someone is explained in why "just remove the names" is not enough.
For the ledger, that means stripping the descriptions and the counterparties as well as the name column. For the notes: round or replace amounts, and put the figures back yourself after the rewrite. More techniques for stripping a prompt without losing the task are in the prompt redaction guide. If you are working from a PDF, such as financial statements or a contract, redact the PDF first.
What does a business account change, and what does it not?
A business environment changes the vendor's terms: input is excluded from training by default, a DPA is in place and the firm manages the settings. That is a real difference, and it is why the type of account matters more than the name of the tool.
Three things do not change. Your duty of confidentiality stays yours; the DPA governs what the vendor may do, not what you may share. Identifiability remains: a client is just as identifiable by its revenue in a business account as in a free one. And the decision stays with the firm: the fact that a business environment exists does not mean every piece of client data may go into it. The firm's AI policy is where the firm sets that out.
What if the firm has not decided on the tool yet?
Then the instruction that goes with "No decision yet" applies: public information only, and report the tool to whoever is responsible, usually the compliance officer or IT. That is neither a ban nor an approval. It is the honest state of affairs, and it saves you guessing. A policy only works if it reaches you when you open the tool, not in last year's manual.
This is what that can look like. BeeSensible shows the firm's decision when you open an AI tool in the browser, with the approved alternative as the first button, and highlights sensitive data, such as a citizen service number or an IBAN, as you type in the supported apps. You choose what happens to it (mask it, remove it or leave it), unless the firm has set masking on paste or on send to "Always on". BeeSensible does not block anything of its own accord; the only exception is a tool that is not allowed, where the firm may have set things up so that you cannot continue. What you type is not stored.
