AI security guide for U.S. accounting firms
Get instant access!
What's inside
What I want you to know
One page on what I'd do in my firm today. We tackle the biggest misconceptions, and how they take away from the more relevant steps we should be taking.
What to do next
A nine step to-do list to put you in compliance with the most strict reading of the rules. Tackle this now because it includes changes to your engagement letters, your WISP, and mandatory training for your team.
What the rules say
Who’s bound by which rules, how disclosure rules fit together, when you need a signed consent, and what Circular 230, the FTC Safeguards Rule and the AICPA Code expect from your firm.
Can I use Claude/ChatGPT With Sensitive Client Data?
How generative AI uses what you type, and a rule-by-rule look at whether it’s any different from the software you already use every day.
The more important conversation
The three levels of AI access, from giving an agent a closed room to the whole computer, and how to hand your team an AI agent responsibly.
Common questions
Client privacy, whether data has to stay in the U.S., telling clients you use AI, data retention, prompt injection… every question I've gotten so far.
This guide is my reading of the rules, not legal or tax advice. Don’t take security advice from YouTubers. Use it to understand how AI works and what the rules say, then make your own decisions with the help of your own advisors.