On a Friday afternoon, an audit manager at a firm with listed clients wants the memo on revenue recognition to read more tightly. She pastes the draft into a chatbot, with the client's name, the quarterly figures and the conclusion that revenue will come in below what the market expects. The figures go public in twelve days.
She has done nothing she was told not to do, because nothing was ever decided about that chatbot in the firm. That is the point. Generative AI touches confidential financial information at six moments, a business account covers only some of them, and the rest is a decision the firm has to make and has to show at the moment someone opens the tab.
What do we mean by confidential financial information?
Three kinds, each with its own framework. The first is inside information: precise, non-public information about a listed company that would be likely to affect the share price if it became known. The European market abuse regulation prohibits passing such information on outside the normal exercise of employment, profession or duties, and requires a record of who has access to it. An accountant auditing the annual figures of a listed client works with inside information until the day of publication.
The second kind is broader: figures and conclusions not yet published at a client that is not listed. Draft annual accounts, an opinion not yet issued, a tax position still under discussion with the tax authority. There is no market abuse framework here, but there is the professional duty of confidentiality and the engagement letter with the client.
The third kind is information about mergers and acquisitions: an information memorandum, a due diligence file, the identity of buyer and seller. That information is fenced off contractually with a non-disclosure agreement, and where a listed party is involved it is inside information on top of all that.
How the rules apply precisely differs per client and per engagement, and that judgement sits with the firm, its compliance officer and, where needed, a lawyer. What holds for all three: the information is confidential because someone else trusts that it will not leave the firm.
Where does generative AI touch that information?
In more places than the text box. The prompt is the best-known moment, but not the only one.
| Moment | What happens | What it means for the firm |
|---|---|---|
| Input | The text goes to the vendor and is processed under its terms | Client name, period, figure and conclusion together make the text traceable |
| File upload | The whole document goes along, including the pages the question did not need | An attachment contains more than the question asked for |
| Memory | Context from one conversation can resurface in a later one | Last week's client name turns up next to a different client |
| Connections | The tool reads along in email, calendar or storage | The reach is no longer what someone pastes, but what the tool may access |
| Shared links | A conversation gets a public URL | Whoever has the link reads the conversation |
| Training | On a personal account, input can improve the model unless switched off | The text becomes part of something the firm no longer controls |
Memory is the moment that is counted least. How it works, and why a deleted conversation is not gone straight away, is in how AI memory works and the hidden risks of AI chat logs. Connections are the moment that grows fastest: an assistant allowed to read the mailbox also reads the email with the draft report attached.
Why is the account type not the whole answer?
Because the account type governs what happens to the text after it has arrived. A business or enterprise account excludes input from training by default, comes with a data processing agreement and gives an admin control over memory, sharing and members. That is the minimum condition for client work, and the difference from a free account is set out in free versus business AI accounts.
But the business account does not answer whether the audit manager should have pasted the memo. Inside information stays inside information, even at a vendor with a good agreement. Whether that vendor has thereby become a recipient of inside information, and what that means for the list of who has access, is a question for the compliance officer. The answer depends on the contractual arrangements and the setup, and it is not a question an employee can answer on a Friday afternoon.
That is why a firm needs two layers. The first is the decision per tool: which tool, on which account, for which practice, with which information in and which never. The second is what the employee does before pasting: the client name out, the period vague, the amounts fictional. A question about the wording of a note survives that fine. An acquisition file does not, and then the answer is: not in a general-purpose tool. What has to come out in any case is in what you should and should not share with AI.
What does a firm put in place?
An adviser in the corporate finance practice has a sixty-page information memorandum summarised in a PDF summariser a colleague recommended. Buyer, seller and the asking price are on page two. The tool appeared in no overview, and nobody had decided anything about it. That is not an incident; it is a tool without a decision that is actually being used, and that is exactly the list a firm starts with.
Five agreements do most of the work. A decision per tool, in four states: allowed, limited use with a condition in one sentence, no decision yet, not allowed with an alternative named. For every allowed tool the account type that goes with it, and no client work on a personal account. A concrete list of what never goes in, phrased per practice: in audit the combination of client name and unpublished figure, in corporate finance anything from a live transaction. The decision visible at the moment someone opens the tool, not in a policy document. And figures that show whether the agreement is followed, without anyone having to read what was typed.
BeeSensible supports three of those five. The extension shows which AI tools are opened in the firm, only the domain, with no user id and no content; an admin records the decision per tool and BeeSensible never chooses itself. When someone opens a tool a decision exists for, that decision appears in the browser, with the approved alternative as the first button. And sensitive data such as names, IBANs and citizen service numbers get a marking while someone types, in the tools people already work in. An unpublished quarterly figure is not a data type that detection recognises; for that, the decision per tool and the notice on opening remain the instrument. How the AI tools module records this is shown below.
