Let's talk about the newest hire in your office. AI reads faster than you, drafts faster than you, never calls in sick and never asks for a raise. On paper, it sounds perfect. There is just one small problem: it never signed your confidentiality agreement.
And with Halloween coming up, I'll say it: the scariest thing in accounting this month is not IFTA. It's a client's Social Security number sitting in somebody's chat history.
I'm a CFO. I love AI, I use it every single day, and I want every bookkeeper and accountant I know using it too. But the way we use it matters. So here are the five rules we follow in our own practice, plus my favorite tips at the end. They work with any LLM (ChatGPT, Claude, Gemini, Copilot), because they are about your habits, not the brand.
No pitch today. Just the rules and the tips. Print them, share them with your team, and tape them next to your monitor. I won't be offended if you cut my name off.
Rule 1: Identifiers never go in. Ever.
In our office, SSN stands for Seriously, Stop Now. These never go into an AI tool, no matter how good the tool is:
- Social Security numbers and EINs
- Bank account, routing and credit card numbers
- Dates of birth and driver's license numbers
- Home addresses and personal phone numbers
- Passwords, logins and portal credentials (yes, people do this)
Here's the good news: AI doesn't need any of them. A bank reconciliation needs dates, amounts and descriptions, not the account number. A 1099 checklist needs to know which vendors you paid, not their tax IDs. If you wouldn't write it on a postcard, don't put it in a prompt.
Rule 2: Use client IDs, not client names
Before you paste anything, swap names for a code you keep on your side: Client 0142, Vendor V-17, Employee E-03. Your list of who is who stays in your own files. The AI sees a puzzle, not a person. And don't worry, Client 0142 doesn't mind being a number. The IRS has called them worse.
Instead of this:
"Reconcile March for Maria Lopez, Lopez Family Dental, SSN ending 4417, account 000123456789."
Try this:
"Reconcile March for Client 0142, a dental practice. Here are the bank lines and the ledger lines (dates, amounts, descriptions). List every unmatched item and the likely reason."
Same answer. None of the risk. Maria would approve.
Rule 3: Share only what the task needs
This is the rule most people skip. Before you paste, ask yourself one question: what does this task actually need? A cash flow forecast needs totals by week, not every transaction with every payee. A variance explanation needs the lines that moved, not the whole general ledger.
Think of it like handing someone your junk drawer when they asked for a pen. Less in means less exposure, and usually a better answer, because the AI isn't digging through rubber bands and old receipts to find what matters.
Rule 4: Know your tool before it touches client work
Not every AI tool handles your data the same way, and the settings matter more than the logo. Before any tool gets near client work, check these four things:
- Training: can what you type be used to train the model, and can you turn that off?
- Retention: how long are your chats and files kept, and can you delete them?
- Plan type: business and team plans often come with stronger data terms than free personal accounts.
- Access: who in your firm can see shared chats, projects and files?
Our rule is simple: client data never goes into a tool we haven't vetted. If you can't answer those four questions, it's a personal-use tool. Great for planning your Thanksgiving menu. Not for your client's payroll.
Rule 5: Keep health info out, and review everything
Some information is sensitive even without a name on it. Health details (medical expenses, diagnoses, HSA or insurance specifics) stay out of AI entirely in our practice. If a task touches them, summarize to totals or do that part by hand. Some things are still worth doing the old-fashioned way.
And the second half of this rule: AI drafts, you decide. Every number, every adjustment and every client email gets your eyes before it goes anywhere. Your name is on the engagement letter. ChatGPT's is not.
How to talk to your AI intern
Lately everyone is sharing how they talk to ChatGPT, Claude, Gemini and Copilot, and I love it. Here's how I do it: talk to it like a sharp new hire on day one, not like a search box. You wouldn't hand a new hire a client's whole file and say "fix it." You'd tell them who they are, what they're working on, what you want back and the house rules. AI works the same way:
- Who it is: "You are a bookkeeper closing the month for a small dental practice."
- What it's working on: the coded, trimmed facts. Client 0142, the bank lines, the ledger lines.
- What you want back: "A table of unmatched items with the likely reason for each."
- House rules: "Don't guess. If something is missing, ask me first. Never ask for account numbers or Social Security numbers."
That last line is my favorite. You're telling the intern, in writing, what it's never allowed to ask for. Good interns follow the rules. Great ones remind you of them.
Yvonne's tips: how to actually do this on a busy Tuesday
Rules are great. Here's how we make them easy:
- Make a client code sheet. One spreadsheet: client name in column A, code in column B. Keep it on your computer, never in AI. It takes 15 minutes and you'll use it every day.
- Find and Replace before you paste. In Excel or Google Sheets, replace the client's name with their code in one click. Do the same for vendor and employee names.
- Delete columns, not just values. Before you upload an export, delete the account number, address, tax ID and phone columns. Most tasks need date, amount, description and category. That's it.
- Crop your screenshots. A screenshot is the office gossip: it tells everything it saw. The browser tabs, the client name in the corner, the email preview. Crop to just the numbers you need.
- Label accounts your way. Instead of account numbers, use names like Operating, Payroll or Savings. The AI only needs to know which is which.
- Practice with a pretend client. Build a fake company (we like Sunny Side Bakery) and learn on that. Mistakes on Sunny Side cost nothing.
- Put a sticky note on your monitor. Before every paste: Name? Number? Health? Do I need it? Four questions, three seconds.
- Clean up when you're done. If your tool lets you delete chats or files, delete client work once it's finished and saved where it belongs.
- Add one sentence to your engagement letter. Something like: "We use approved AI tools to help draft and organize work. We never enter Social Security numbers or other personal identifiers, and every result is reviewed by our team." Clients love hearing that.
- Hold a 10-minute team huddle. Walk through the five rules, hand out the sticky note, done. The rules only work if everyone follows them, including the person who started Monday.
Bonus: put it in writing
If you prepare tax returns, you're already expected to have a written information security plan (the IRS calls it a WISP). Add a short AI section to it: which tools are approved, what never goes in, and who reviews the output. Clients don't expect you to avoid AI. They expect you to be careful with it. Be the firm that can explain how.
Quick questions I get
If I remove the name, is everything else fine to paste?
Not automatically. A rare job title, a small town and an unusual dollar amount can point to someone all by themselves. Strip what the task doesn't need (Rule 3).
Is a paid AI plan automatically safe?
No plan is automatically safe. Paid business plans often come with better data terms, but you still check the settings (Rule 4).
Can I upload a client's whole QuickBooks export?
Only after removing identifiers and anything the task doesn't need. Most tasks need a few columns, not the whole file (Tip 3).
Does this apply to every AI tool?
Yes. ChatGPT, Claude, Gemini, Copilot or whatever comes out next month. The rules are about your habits, not the brand.
Use the intern. Just don't hand it the filing cabinet. And happy almost-Halloween. May your only scares be costumes, not chat histories.
Yvonne
FREE things to keep learning
- FREE AI Skills Black Belt for accountants and bookkeepers (extended through Oct 31, yours for life once you sign up): https://humansplusagents.ai/legacy-sbc
- FREE AI Skills Black Belt for every other business: https://humansplusagents.ai/legacy-sbc-aia
- Claim a FREE AI agent: https://aiaccounting.legacysbc.com/claim-agent
- Join our FREE community: https://www.facebook.com/groups/1024923770013348
- Questions about setting this up in your practice? Book 15 minutes with me: https://calendly.com/legacysbcllc/15min





