What exactly is your team doing with AI?

It was a standard Wednesday afternoon and I had a meeting at one of my client's office, let's call them "Joe" for privacy.

Joe told me a recent story about one of their accounting staff. They recount the story to me like this...

Joe was over at JoeStaff's table and noticed that they had their ChatGPT tab opened on the browser. That's nothing unusual I mean everyone uses it nowadays. Joe's company rules at their office is simply don't use AI on client work if it's not a paid account. Joe said they noticed it was clearly a paid account, but they didn't pay for it. JoeStaff paid for it, it's their account!

They had their travel plans in there, their research on how they're planning to leave Joe's business (yup they eventually left), and lo and behold.... a chat thread about a client deal they're working on.

Joe asked them to show them the thread and what did they see? JoeStaff had been dropping in attachments like contracts and discussing over very detailed negotiations and plans about this client.

Was this a violation of the company's policy? Well technically no right? Because their paid account is private according to OpenAI's own policies, they won't use your data for training.

What I eventually found out about ALL the Big Tech AI companies' policy:

Turns out... it's not private.

1) They're logging every interaction from questions, attachments, to answers provided.
2) Paid accounts have a policy that they don't use your logged interactions for training their AI.
3) But if the AI flags something as unsafe or controversial then a HUMAN is allowed to look at that chain of conversation.
4) For most of us working on accounting that generally means it won't be flagged for human review, afterall, nothing crazy about that debit or credit. But when JoeStaff left Joe... that chat thread left with them.

Thank goodness for Joe - JoeStaff wasn't leaving for a competitor with that contract they were just moving to another city altogether.

What does this mean?

What does this mean for us in the business of accounting, tax, and bookkeeping using AI though?

It means we have to be careful about what our staff are doing out in the world. Do you have any right to ask a staff to show you their PRIVATE and PERSONAL AI account? No we don't have a right to their private chats with AI.

It means what we have been led to believe it's okay to drop client work into the chat prompt but it's not actually okay. It violates PIPEDA and we didn't even know it. Worse we've been led to believe it doesn't violate PIPEDA.

It means we have to take proactive approaches to use AI software that's actually private, like MontgomeryWP. We don't keep your data, we don't log anything.

If we don't start giving our staff tools that are safe to use, they're going to find tools on their own that are not safe.

(Want to learn more about PIPEDA compliance and AI in your practice? Register for our upcoming 1.0 Verifiable Ethics CPD Webinar here.)