Only when you know where the data goes, who can see it, whether it is used to train the tool, and that using it that way is consistent with what you told clients. If you cannot answer those questions from the tool’s terms and settings, do not put personal or confidential information into it. Your privacy obligations do not transfer to the software vendor.
What it depends on
Where judgement stays human: Weighing the benefit of the tool against the privacy and confidentiality risk is a judgement for the business owner — a system can flag the risk, but it cannot accept it on your behalf.
Start with the data, not the tool. What is it — personal information, financial records, something confidential under a contract? Then check the tool: where it stores and processes data, whether inputs are retained or used for training, and what controls you have over access and deletion.
Then check the promise you made. If your privacy policy and client engagement terms do not cover this use, you may need to change the process or the policy before you change the tool. The Australian Privacy Principles and the OAIC’s guidance on AI are the reference points for businesses covered by the Privacy Act.
Weighing the benefit of the tool against the privacy and confidentiality risk is a judgement for the business owner — a system can flag the risk, but it cannot accept it on your behalf.
AI Systems · general information current as at 1 September 2026. This is general information only, not personal financial, tax or legal advice.