Short answer: treat it as a confidentiality incident, not a character test. Stop the ongoing use of public tools with client data, find out what left, tell the people who need to know, and give staff a sanctioned way to finish the work. A new memo that only says "don't" will not survive October.
Most firms already know this happened. Someone was stuck on a footnote. Someone needed a letter rewritten at 9 p.m. Public ChatGPT was open. The policy skeleton is how you prevent the next one. This page is what you do about the one you just found, with close season sitting on the calendar.
Do not start with blame
Staff used the tool that was in front of them because the firm did not give them another one. That is an operations failure first. You can still be clear that client data does not go into public models. You cannot pretend the incentive was mysterious.
Year-end makes it worse: more files, more tired people, more "just this once." If you only police it in January, you will police it after the busy season has already leaked.
What to do this week
- Name the rule out loud. Client data, workpapers, returns, and client email do not go into public ChatGPT, Copilot consumer, or anything else that trains or retains by default. No exceptions for "I didn't use the name."
- Ask, privately, what already went in. You want volume and type, not a public confession. Payroll files, SSNs, and full returns are a different class than a sanitized sentence.
- Check the tool's own settings and logs where you can. Some consumer accounts keep history. Some do not let you delete what you think you deleted. Do not guess.
- Decide who else has to know. That may be internal only. It may be a client, a carrier, or counsel, depending on what left and what your engagement letters and WISP already say. This page is not legal advice. If the data is serious, call the person you already trust on privacy.
- Give staff a yes. A sanctioned draft workflow with a reviewer, or a written "you may use this internal tool for this kind of text." A vacuum is how the next paste happens.
What not to do
- Fire the first person you catch while everyone else keeps a ChatGPT tab open.
- Send a four-page policy on Friday and call the matter closed.
- Pretend a consumer account with "please don't train on this" in the prompt is a control.
- Ignore it until January because close is too busy. Close is why it will happen again tomorrow.
After the incident
Write the five-rule policy if you do not have one. Put a reviewer on anything that leaves the firm. If the firm cannot put client data in a cloud model at all, that is what on-premises is for — not as a slogan, as a deployment choice.
The firms that get through this without a circus are the ones that treat staff as the people who kept the work moving, then give them a path that does not require a secret.
If you want help putting a sanctioned, reviewed workflow in place before close — talk with us. If you need counsel or a forensic privacy review first, start there. We will not pretend we are that.
Related: An AI use policy your CPA firm can actually enforce · Will AI replace bookkeepers and staff accountants? · our approach for accounting firms.