Follow the Data

1Map the existing estate first

Before adding AI, the firm should describe its technology estate as it operates in practice.

A small or mid-size firm rarely uses one system. Ledgers may sit in AutoCount, SQL Accounting or Xero. Audit working papers may be in CaseWare. Tax computations, payroll, correspondence and source documents may be spread across specialist software, spreadsheets, Microsoft 365 and local servers.

Some information may be on premises. Other information may sit in a cloud service under the firm's account. This mixed estate is normal.

The useful question is therefore precise: when AI is added, where does confidential client information travel that it did not travel before?

2The moment that matters is inference

An AI model does its work, known as inference, wherever the model runs.

To answer a question about a client, a retrieval-based tool may find relevant material in the firm's authorised files and add it to the prompt. The question and retrieved content are then processed wherever the model runs.

Storage still matters. AI adds another location to assess: the point of inference. A client's trial balance may remain in its original system while its contents are transmitted to a model for processing.

The data-flow map must therefore show both storage and inference.

3Two boundaries that get confused

Two boundaries are often discussed as if they were the same.

The first is the tenant boundary. A file in the firm's Microsoft 365 account or licensed ledger package is governed by the firm's account and contract with that provider. The second is the third-party-model boundary: the point at which content is sent to a model the firm does not operate.

A file can remain within the tenant boundary for storage while its contents cross the third-party-model boundary during inference.

Knowing that a file is in SharePoint does not answer where AI processing occurs. The firm should establish which content is retrieved, which model receives it and what contractual and technical controls apply.

4Why air-gapped is the wrong product claim

A true air gap means there is no network connection to the outside world. A modern firm using email or cloud file services is not air-gapped as a whole.

That does not prevent the firm from placing a specific AI system on premises. Secure Accounting runs on premises so confidential client work can be processed within the firm's controlled environment.

This is a narrower and more useful claim. It describes where confidential client work is processed without suggesting that the firm's entire technology estate is disconnected.

Files may still live in the firm's cloud tenant, and email may still flow through Microsoft 365. The data-flow map should show those services separately from the on-premises AI processing.

5Not all of it carries the same stakes

The firm's information does not all require the same controls.

A published tax ruling and a live client's KYC pack sit at opposite ends of the sensitivity range. Classification lets the firm apply an appropriate rule to each. Some material can be used for general research. Confidential client work needs private processing. Certain material should be excluded from AI altogether.

6You cannot govern what you cannot see

Before choosing a tool or writing a policy, draw the firm's data-flow map.

List where client information lives. For every AI use, show what is retrieved, where inference occurs, who can access the result and whether any content crosses to a third-party model. This turns a general question about safety into a reviewable set of data flows and controls.

With that map, the firm can classify its information so the right rule applies to each category (C3), then choose a deployment model for each type of work (C4).