Your outside firms may already be putting your files through AI: four questions to ask them

Ask every outside firm that holds your data how it uses AI on your files. Get the answer in writing.

Most small businesses send their most sensitive information to a few outside firms: the bookkeeper, the accountant, the payroll provider, IT support, the marketing agency. Those firms are adopting AI tools faster than they write rules for them. This blog has covered what your team can paste into an AI tool, how an AI partner should get access to your systems and what to tell customers about your own AI use. This post covers the other direction.

The work comes back looking the same, only faster¶

You cannot see this from your side. The monthly report arrives on time. It reads well. Nothing on the invoice or in the report says a tool touched it.

An 8-person electrical contractor sends its monthly job-cost and payroll files to an outside bookkeeping firm. A junior bookkeeper pastes each month's ledger into a free public AI tool to draft the monthly commentary. The bookkeeper uses the same chat for several clients. The owner finds out when one month's commentary names a supplier the contractor has never used. By then, twelve months of payroll and job costing have gone through a tool nobody approved.

Nobody at the firm meant harm. Nobody at the firm checked either.

Start with the firms that hold your money, payroll and customer records¶

You do not need to ask everyone at once. Rank your outside firms by one test: what would it cost you if this firm's copy of your information leaked or got mixed up with another client's?

Firms that hold financial records, payroll, customer lists or signed contracts go first. For most owners, that means the bookkeeper, the accountant and the payroll provider. IT support and the marketing agency come next.

Four plain questions to ask each firm¶

Keep it short. A phone call or an email is enough.

1. Use: Do you use AI tools on client files?
2. Scope: For which kinds of work?
3. Location: Does our information stay in tools your firm controls, or does it go into free public ones?
4. Check: Who checks the output before it reaches us?

What a good answer sounds like, and what to do with a vague one¶

A good answer is specific. "We use one tool on our firm account for drafting summaries. Client files do not go into free tools. A senior accountant reviews every report before it goes out." You know the tool is the firm's choice, the work it does, and the named person who checks it.

A vague answer sounds like "We're careful" or "Everyone uses it a bit." That is not a no. It is an answer nobody has written down yet.

When you get a vague answer, ask for it in writing. Many firms have simply never been asked, and the request makes them decide. If the answer stays vague after that, move your most sensitive work, such as payroll, to a firm that can answer. One loose answer is a reason to ask again, not a reason to leave.

One line per firm on the list you already keep¶

The answers belong on the same list you keep for your team's own AI rules. Add one line per firm: the firm's name, whether it uses AI on your files, where your data goes, and who checks the output.

Check each line once a year. Check it again when the firm's staff changes, because a new junior hire can change the answer overnight. This does not catch a change the firm makes the day after you ask. It does make sure you have asked at least once.

Your data is only as careful as the least careful firm that holds it.

Keep exploring¶

If you want help adding outside firms to the AI rules your team already follows, contact FIT.