On a Friday afternoon, an audit manager at a firm with listed clients wants to tighten up the memo on revenue recognition. She pastes the draft into a chatbot, with the client's name, the quarterly figures and the conclusion that revenue will come in below what the market expects. The figures are due to be published in twelve days.
She has done nothing she was told not to do, because the firm never decided anything about that chatbot. That is the crux. Generative AI touches confidential financial information at six points, a business account covers only some of them and the rest is a decision the firm has to make and then show people the moment they open the tab.
What do we mean by confidential financial information?
Three kinds, each with its own framework. The first is inside information: precise, non-public information about a listed company that would be likely to affect the share price if it became known. The EU Market Abuse Regulation prohibits passing such information on outside the normal exercise of employment, profession or duties, and requires a record of who has access to it. An accountant auditing the annual figures of a listed client works with inside information until the day of publication.
The second kind is broader: unpublished figures and conclusions of an unlisted client, such as draft annual accounts, an audit opinion not yet issued or a tax position still under discussion with the tax authority. Market abuse rules do not apply here, but the professional duty of confidentiality and the engagement letter with the client do.
The third kind is information about mergers and acquisitions: an information memorandum, a due diligence file, the identity of the buyer and seller. It is protected contractually by a non-disclosure agreement, and where a listed party is involved it is inside information as well.
Exactly how the rules apply differs by client and by engagement, and that judgement lies with the firm, its compliance officer and, where needed, a lawyer. What all three have in common: the information is confidential because someone else trusts it will not leave the firm.
Where does generative AI touch that information?
In more places than the text box. The prompt is the best-known point, but not the only one.
| Point | What happens | What it means for the firm |
|---|---|---|
| Input | The text goes to the vendor and is processed under its terms | Client name, period, figure and conclusion together make the client identifiable |
| File upload | The whole document goes with it, including the pages the question did not need | An attachment contains more than the question asked for |
| Memory | Context from one conversation can resurface in a later one | Last week's client name turns up next to a different client |
| Connections | The tool can read email, calendar or file storage | What is exposed is no longer what someone pastes, but whatever the tool can access |
| Shared links | A conversation gets a public URL | Anyone with the link can read the conversation |
| Training | On a personal account, input may be used to improve the model unless that is switched off | The text becomes part of something the firm no longer controls |
Memory is the point people overlook most. Our articles on how AI memory works and the hidden risks of AI chat logs explain the mechanism and why a deleted conversation is not gone straight away. Connections are growing fastest: an assistant allowed to read the mailbox also reads the email with the draft report attached.
Why is the account type not the whole answer?
Because the account type governs what happens to the text after it has arrived. A business or enterprise account excludes input from training by default, comes with a data processing agreement and gives an admin control over memory, sharing and members. That is the minimum for client work; our comparison of free and business AI accounts sets out how it differs from a free account.
But the business account does not answer whether the audit manager should have pasted the memo. Inside information remains inside information, even at a vendor with a good contract. Whether that vendor has thereby become a recipient of inside information, and what that means for the list of who has access, is a question for the compliance officer. The answer depends on the contractual arrangements and the set-up, and it is not something an employee can work out on a Friday afternoon.
So a firm needs two layers. The first is the decision per tool: which tool, on which account, for which practice, which information may go in and which must never go in. The second is what the employee does before pasting: take out the client name, blur the period, make the amounts fictional. A question about the wording of a note survives that perfectly well. An acquisition file does not, and then the answer is: not in a general-purpose tool. Our guide to what you should and should not share with AI lists what has to come out in any case.
What should a firm put in place?
An adviser in the corporate finance practice runs a sixty-page information memorandum through a PDF summariser a colleague recommended. The buyer, the seller and the asking price are on page two. The tool was not in any inventory, and nobody had decided anything about it. That is not an incident; it is a tool in actual use without a decision, and that is exactly the list a firm starts with.
Five rules do most of the work. A decision per tool, with one of four statuses: "Allowed", "Limited use" with a one-sentence condition, "No decision yet" or "Not allowed" with a named alternative. For every allowed tool, the account type that goes with it, and no client work on a personal account. A specific list of what never goes in, worded per practice: in audit, the combination of client name and unpublished figure; in corporate finance, anything from a live transaction. The decision shown when someone opens the tool, not buried in a policy document. And figures that show whether the rules are followed, without anyone having to read what was typed.
BeeSensible supports three of those five. The extension shows which AI tools are opened in the firm, based on the domain alone, with no user ID and no content; an admin records the decision per tool and BeeSensible never makes that choice itself. When someone opens a tool that has a decision, that decision appears in the browser, with the approved alternative as the first button. And sensitive data such as names, IBANs and Dutch citizen service numbers (BSN) are highlighted as someone types, in the tools people already work in. An unpublished quarterly figure is not a data type that detection recognises; for that, the decision per tool and the notice when the tool opens remain the way to handle it. You can see how BeeSensible records this below and on the product page for See.
