Research · Privacy
Is outsourcing to AI safe for client data?
Before any firm outsources work, it needs to know where client information goes and who can see it. Here is how that works with AI outsourcing, and the questions to ask any provider.
Where the information goes
To prepare the work, an AI outsourcing service has to read your client's records. That means the information is processed by the AI provider the service uses. Any provider that tells you otherwise is not being open with you.
At AnnualsAI, the work is done inside your firm's own systems using access you give us, and your clients' information is processed by our AI provider to do the work. Details are in our privacy policy and AI disclosure.
Your obligations as a firm
Your firm is still responsible for your clients' information. In New Zealand that means the Privacy Act 2020, including Information Privacy Principle 12 on sending information overseas. In Australia it means the Australian Privacy Principles, including APP 8 on cross-border disclosure. This is general information, not legal advice. Check what applies to your firm.
Questions to ask any outsourcing provider
- Who or what will see my clients' information?
- Is the work done in my systems or copied to yours?
- Which AI provider processes the information?
- What happens to access when we stop working together?
- Will you contact my clients? (We never do.)
- Is there a signed engagement letter before the first job?
Practical steps
- Give access only to the files and systems the job needs.
- Use a separate user login so access can be removed in one step.
- Update your engagement letters and tell clients that AI is used.
- Remove access as soon as a job or relationship ends.
Questions about how we handle data?
Email us and we will answer in writing.