Checklist
AI data-privacy checklist for professional firms
Free to use and print, no sign-up. Work through it before your team puts client information into any AI tool, hosted or private.
Last updated October 2026
Policy
- We have a written policy on which AI tools staff may use for work.
- The policy says what information may and may not go into each tool.
- Staff know the policy, and someone owns keeping it current.
The tool and the provider
- We know where prompts and files are processed and stored.
- We know whether our data is used to train models, and have turned that off if we can.
- We know how long data is kept, and who can change that.
- We know who at the provider can access our data, and when.
- We've read the provider's current privacy and security documentation.
Our obligations
- We've checked our professional rules and any regulator guidance on AI.
- We've checked client agreements and engagement letters for limits on sharing information.
- Our advisor has reviewed how we use AI with client information.
Access and records
- Only the right people can reach the tool and the documents it can read.
- Matters, clients or departments are kept separate where they need to be.
- We know what's logged, where, and for how long.
Using the output
- Every AI draft is reviewed by a person before it's used.
- Facts, figures and citations are checked against the source.
- Staff know how to report a problem with an answer.