AI Transcription Tools Now Hold Client Contracts and Payroll Files

Breaches involving unsanctioned AI tools cost organisations an average of $5.39 million in 2026, against $4.99 million for all breaches, and those tools now hold client contracts, payroll files and draft financial statements. That makes client AI tools a practice risk for the accounting firms that serve those businesses.

The exposure arrives through a routine expense claim. A staff member buys a transcription service or document assistant on a company card, is reimbursed, and nobody in finance treats it as a matter for the auditors.

The cost is rising. IBM’s Cost of a Data Breach Report 2026 found that 43% of breached organisations reported a security incident involving shadow AI, up from 20% a year earlier. The global average for all breaches reached a record $4.99 million, a 12% increase.

Zylo, a software management company, found in its 2026 SaaS Management Index that expense-based software spend rose 267% in a single year. Each charge sits below an approval threshold, so no one reads the vendor’s terms.

Firms did not choose these tools. They inherit the consequences all the same, in the US, the UK and the EU alike.

Where client AI tools become a practice risk

A firm is not answerable for every subscription a client’s staff take out. Its professional duties cover what the firm discloses and how its team performs its work. The line blurs in four places.

The first is the information system. Under SAS 145, codified in AU-C 315, auditors must identify the IT applications subject to risks arising from IT use. If an accounts payable clerk runs vendor invoices through an AI extraction tool and posts the output, that tool handles data on its way into the ledger whether or not anyone documented it. The AICPA’s AI audit guidance sets out the questions auditors are likely to ask about client AI use.

The second is the firm’s own work product. Draft statements, proposed adjustments and tax projections leave the firm by email. A client employee who uploads review notes to a free assistant for a quick summary has placed the firm’s work with a vendor whose terms nobody has read.

The third is conversation. Many AI notetakers join calls automatically once someone links them to a calendar. A 2025 class action in a California federal court alleges that Otter.ai recorded meetings without every participant’s consent and used the recordings to train its product. The allegations are unproven. The engagement team may nonetheless sit on a recording held by a vendor the firm never assessed.

The fourth is a breach at the client. Auditors then face questions on contingencies, subsequent events and remediation costs, and someone will ask who could see the client’s financial records.

Confidentiality rules that govern client AI tools

The professional codes were written for the firm’s own conduct, but in practice they bite when client AI tools touch information the firm supplied or holds, and the risk lands on the firm.

The AICPA Code of Professional Conduct bars members in public practice from disclosing confidential client information without the client’s specific consent, subject to listed exceptions. Interpretation 1.700.040 covers third-party service providers. Before a firm discloses confidential information to one, it should either contract with the provider to maintain confidentiality or obtain the client’s consent.

That interpretation binds the firm’s own vendors directly. It reaches client-side tools only through the firm’s conduct: a partner who pastes client data into a consumer chatbot, or who sends a draft to a client knowing it will be fed into one, has made a disclosure decision.

The International Ethics Standards Board for Accountants states the principle plainly. Its Code lists confidentiality as a fundamental principle: respecting the confidentiality of information acquired as a result of professional and business relationships. National adoptions of the Code, including Ireland’s, add that firms must take reasonable steps to ensure that personnel and advisers respect the duty.

Barry Melancon, then chief executive of AICPA & CIMA, said in a January 2024 podcast that auditors would need to consider how a client uses AI, including passive use by its employees. He added that “confidential information and the like is a really important aspect of our profession.”

Data-processing terms and GDPR exposure

Where personal data is involved, the question moves from ethics to law. Payroll files, employee contracts and customer lists are personal data, and a transcription tool that stores them is a processor.

Under Article 28 of the UK GDPR, a controller may use only processors that give sufficient guarantees of appropriate technical and organisational measures. The EU regulation carries the same article. A processor must have a binding contract that sets out the subject matter, duration, nature and purpose of the processing, the types of data and the categories of data subjects.

That contract must require the processor to act only on documented instructions and to bind authorised staff to confidentiality. It must also require Article 32 security measures, help with data subject requests, deletion or return of data when the service ends, and cooperation with audits. A processor needs prior written approval before engaging a sub-processor.

The Information Commissioner’s Office guidance on processor contracts lists the same terms. A free consumer account rarely offers them.

When a firm is itself the controller or processor for the data, the gap left by client AI tools becomes a practice risk for the firm. Harmonic Security, which studied employee AI activity in the third quarter of 2025, found that 21.81% of sensitive data went into tools that train on user inputs, including free chatbot versions. The firm’s data processing agreement checklist is a practical test of whether a client’s tool would pass.

Engagement letters and professional indemnity cover

The engagement letter is where a firm records what it expects of clients and what it will do with their data. Three additions are worth making: a clause on whether third-party tools may record or transcribe meetings with the firm’s team, a client undertaking not to upload the firm’s work product to AI tools without the firm’s agreement, and a statement of which of the firm’s own AI vendors may process client data. Firms can adapt these to their own engagement letter pack.

Professional indemnity cover is less settled. There is no standard accountants’ wording on AI. The Lloyd’s Market Association’s professional indemnity committee has said insurers are tightening terms to address AI-driven exposures, and some policies now carry AI exclusions or ask for endorsements.

Firms should put three questions to their broker in writing. Does the policy exclude losses arising from generative AI, and how does it define the term? Does a breach of confidentiality through a client’s tool fall under the professional indemnity policy, the cyber policy or neither? What must the firm notify, and when?

The answers decide whether a claim that begins with a client’s reimbursed subscription to AI tools is covered at all, which makes it a practice risk.

How to find the tools and raise them with clients

These tools will not appear in an IT asset register or a single sign-on log, because staff usually signed up with personal logins. The evidence sits in card and reimbursement data, which the client already holds.

The review is practical. Pull 12 months of line items rather than summaries, and look for small recurring charges at single-user price points. Search the merchant descriptors themselves, since many AI vendors bill under names that differ from the product. Payments through Apple or Google Play hide the vendor, so the employee who submitted the claim has to be asked. Annual plans show up as one larger charge, and claims coded to software, subscriptions or miscellaneous deserve a second look.

Free client AI tools leave no payment trail and can carry the highest practice risk. The expense list is a starting point, not a count.

The most exposed categories are meeting notetakers, document and PDF assistants, personal chat assistants, spreadsheet add-ins, writing assistants with inbox access and receipt scanners. Notetakers are the easiest to raise with an owner, because a recorded pricing discussion sitting with an unknown vendor needs no explanation.

At acceptance and at each continuance, firms can add a short set of questions:

• Which AI tools does the business pay for, including through employee reimbursements?
• Have any received financial records, contracts, payroll files or customer data?
• Are any accounts on consumer plans that allow training on user inputs?
• Who can cancel each account and ask the vendor to delete stored data?
• Do any notetakers or assistants join calls or read email automatically?
• Does the business have a written AI use policy, and when was it last reviewed?

The answers belong in the engagement file with the rest of the firm’s understanding of the entity. They also fit naturally into client onboarding.

The firm does not need to write the client’s AI policy. It offers three choices per tool: cancel it, move it to a business plan with proper terms, or keep it with a documented reason. One employee with one subscription calls for a conversation. A dozen unreviewed tools across departments is a control weakness worth recording.

What to watch next

The evidence base is still thin, and much of it comes from observation and vendor-funded research. IBM’s report and the Otter.ai litigation are the two items most likely to shape how insurers and regulators treat client-side AI.

The next practical date is the firm’s own renewal. Professional indemnity wordings are reset at renewal, and a lender, an insurer or a regulator will ask who can see the client’s records before then.