Artificial Intelligence (AI) Use & Data Protection Policy

2. How We Use AI

We may use approved AI and machine-assisted technologies to support our professional staff in performing tasks including:

• Researching taxation legislation, accounting standards and regulatory requirements;

• Preparing, reviewing and summarising documents, reports and correspondence;

• Translating and analysing financial or business information;

• Assisting with financial calculations, reconciliations and data analysis;

• Identifying potential discrepancies, anomalies or compliance risks;

• Supporting preparation and review of tax returns, financial statements and working papers;

• Assisting with business advisory, tax planning and compliance matters;

• Supporting internal administration, workflow management and quality assurance.

AI is used to assist our professional staff and does not replace professional judgement.

​

3. Professional Responsibility and Human Oversight

PCC remains responsible for the professional services and advice provided to clients.

We apply appropriate professional review and verification to material AI-assisted work before relying on it.

Our professional staff remain responsible for:

• Assessing the accuracy and reliability of information;

• Applying relevant legislation and professional standards;

• Exercising independent professional judgement;

• Identifying potential errors or limitations in AI-generated outputs; and

• Approving final professional advice, reports and lodgements.

We do not treat AI-generated information as independently verified professional advice.

​

4. Information That May Be Processed

Depending on the nature of the engagement and the task being performed, AI Tools may process relevant information including:

• Business and financial information;

• Accounting records and transaction details;

• Taxation and compliance information;

• Business correspondence and supporting documentation;

• Information concerning companies, trusts and other entities;

• Information concerning directors, shareholders, employees and other relevant individuals;

• Professional working papers and reports.

 

Where reasonably practicable, we minimise, de-identify or remove unnecessary information before processing.

We apply additional controls to highly sensitive information, including tax file numbers, identity documents, bank account information, financial credentials and other protected information.

Such information will only be processed where necessary, appropriately authorised and permitted under applicable law, with safeguards proportionate to the sensitivity of the information.

​

5. Approved Third-Party AI Service Providers

PCC may use approved third-party AI platforms and AI-enabled business applications to support the delivery of our services.

Our approved providers may include enterprise AI platforms and AI-enabled features integrated with professional software.

Before approving an AI provider, we consider relevant matters including:
 

• Confidentiality and data protection arrangements;

• Information security measures;

• Data processing and storage locations;

• Access controls and authentication;

• Data retention and deletion arrangements;

• Whether client information may be used for AI model training;

• Contractual protections and relevant third-party subprocessors; and

• The suitability of the provider for the intended professional use.
   

A current disclosure of approved AI providers and relevant processing arrangements is provided in the AI Service Provider Disclosure section below.

We do not authorise staff to use unapproved AI tools for processing confidential client information.

​

6. Business Systems and AI Integrations

PCC may use AI features integrated with approved business systems, including:

• Business email and communication platforms;

• Document management and cloud storage systems;

• Accounting and taxation software;

• Practice management and workflow platforms.
   

These integrations may allow approved AI systems to process relevant information for authorised professional tasks.

Access is restricted according to business requirements, user permissions and applicable security controls.

We seek to limit AI access to information reasonably required for the relevant task and avoid unnecessary access to unrelated client information.
 

7. Confidentiality and Client Authorisation

PCC is committed to maintaining client confidentiality in accordance with the Tax Agent Services Act 2009, the Code of Professional Conduct and other applicable legal and professional obligations.

Where the use of a third-party AI provider involves disclosing information relating to a client's affairs, we obtain the client's permission or rely on another lawful basis for disclosure where applicable.

Client permission may be obtained through our Engagement Letter or another appropriate form of authorisation.

Our engagement arrangements identify the purposes for which AI may be used and refer clients to this Policy and our applicable provider disclosures.
 

We will not materially expand the authorised purposes or scope of third-party disclosure without obtaining further permission where required.
 

8. Data Security and Privacy Protection

PCC applies reasonable technical and organisational measures to protect client information when using AI Tools.

These measures may include:
 

• Access restricted to authorised personnel;

• Account authentication and role-based permissions;

• Data minimisation and de-identification;

• Secure transmission and storage arrangements;

• Restrictions on the use of personal or unapproved AI accounts;

• Assessment of supplier security and contractual arrangements;

• Staff training and internal AI usage policies;

• Appropriate review and monitoring of AI-enabled workflows; and

• Procedures for managing security incidents and suspected unauthorised disclosures.

We recognise that AI systems may present risks, including inaccurate outputs, unintended disclosure, unauthorised access and other information security concerns.
 

9. AI Model Training and Data Retention

PCC assesses the data usage and retention arrangements of approved AI providers.

Our policy is not to authorise the use of confidential client information for training publicly available or general-purpose AI models unless specifically authorised and permitted by applicable law.

We use enterprise or business arrangements that restrict the use of customer information for general model training.
 

Data may be retained by approved providers for service delivery, security, compliance, backup or other purposes permitted under their applicable contractual terms.

Retention periods and deletion arrangements vary between providers and services.

Further information is provided in our AI Service Provider Disclosure.
 

10. Overseas Data Processing

Some approved AI providers may process, store or permit access to information outside Australia.

This may include processing by overseas service providers or their authorised subprocessors.

Where applicable, we assess relevant privacy, confidentiality, security and cross-border data handling requirements before using such services.

We seek to inform clients of relevant overseas processing arrangements through our Engagement Terms and provider disclosures.

We do not guarantee that all information processed through AI Tools remains stored or processed exclusively within Australia.
 

11. Record Keeping and Professional Compliance

PCC maintains records appropriate to the nature and risk of the AI-assisted work undertaken.

These may include records of:
 

• Approved AI tools and their authorised uses;

• Client permissions and disclosures;

• Material AI-assisted calculations, analysis or work products;

• Professional review and verification;

• Relevant supplier assessments; and

• Security or compliance matters requiring follow-up.

We maintain records in accordance with applicable legal, professional and business requirements.
 

12. Changes to This Policy

We may update this Policy to reflect changes in technology, approved service providers, legal requirements or our business operations.

The latest version will be published on our website, together with the relevant effective date.

Where a proposed change materially affects the purposes for which client information is disclosed, the recipients of that information or other matters requiring renewed permission, we will obtain any additional authorisation required before implementing that change.

Earlier versions of this Policy may be retained for reference and compliance purposes.
 

13. Questions and Further Information

If you have questions or concerns about our use of AI or the handling of your information, please contact our office.

Platinum Cloud Consulting Pty Ltd
Website: https://cloudaccountant.net.au
 

 

 

 

​

AI Service Provider Disclosure

PCC uses approved third-party AI platforms to support the delivery of our professional services, including research, document preparation, financial analysis, data processing and professional review.

Our approved AI service providers currently include:

​

OpenAI – ChatGPT Business

Used for professional research, document analysis, drafting, financial calculations, data processing and quality assurance. This may include processing relevant information through authorised integrations with business email and other approved systems.
 

Anthropic – Claude Business

Used for document preparation, research, financial analysis, drafting and other professional and administrative tasks performed by authorised PCC personnel.

 

Karbon – Practice Management

Karbon is our practice management platform and includes AI-powered functionality to support client management, workflow administration and professional communications.

​

Xero – Accounting Software

Xero is a cloud-based accounting platform incorporating AI-powered features to assist with accounting, financial reporting and business administration.

​

Data Processing and Protection

Depending on the service and task, approved AI providers may process relevant client information, including confidential business, financial and taxation information.

Some information may be processed, stored or accessed outside Australia through the providers' infrastructure or authorised subprocessors.

PCC takes reasonable steps to assess the security, confidentiality, data retention and processing arrangements of approved AI providers before authorising their use.

We seek to use business or enterprise AI services that provide contractual protections for customer information and restrict its use for general-purpose AI model training.

Access to client information is limited to authorised personnel and approved systems. We apply appropriate data minimisation, confidentiality and security measures, together with professional oversight of material AI-assisted work.

Where required, PCC will obtain appropriate client permission before disclosing confidential information to third-party AI providers.
 

Changes to Approved Providers

PCC may update its approved AI service providers from time to time as technology, business requirements and regulatory obligations evolve.

We will review the relevant security, privacy and confidentiality arrangements before approving new providers.

Where changes materially affect the scope of authorised disclosure or processing of client information, we will obtain additional client permission where required.