Using AI with client data: seven questions for a UK practice to ask first

AI tools are now built into the software practices already use, and offered by a growing number of new suppliers. Some of them are useful. All of them raise the same question for a practice: what happens to our clients’ data when we use this?

Your practice is the controller of its clients’ personal data. That responsibility doesn’t move to a supplier because the supplier’s tool did the work. These are the questions worth asking before any AI tool touches client records. They are the same questions we expect practices to ask us.

1. Is the supplier acting as our processor, and will they sign a contract that says so?

If a supplier processes client data on your behalf, UK GDPR requires a written contract with specific terms: that they act only on your instructions, keep the data confidential and secure, use sub-processors only with your permission, help you meet your obligations, and delete or return the data at the end. The ICO’s guidance on controllers and processors sets out what the contract must contain.

A supplier who can’t give you a data processing agreement, or whose terms say they can use your data for their own purposes, is not acting purely as your processor.

2. Where is the data stored and processed, including by the AI model?

Ask where the data is stored, where it is backed up, and where the AI model actually runs. These can be three different places. A tool can store files in the UK and still send their contents to a model hosted elsewhere. If data leaves the UK, you need to know where it goes and what safeguards cover the transfer.

3. Is our data used to train models?

Ask directly, and ask for it in writing. Some providers say clearly that customer inputs are not used for training. Amazon, for example, states that Bedrock doesn’t use prompts and responses to train any AWS models and doesn’t distribute them to third parties. Others reserve the right in their terms. “We take privacy seriously” is not an answer.

4. Who approves what the AI produces before it reaches a client?

For anything sent to a client in your name, a person at your firm should approve it, at least until you have seen enough to trust a narrower check. Also ask whether the AI decides anything about a client or only drafts and suggests. UK law on automated decision-making changed with the Data (Use and Access) Act 2025, and the ICO consulted on new guidance in 2026. Tools where a person makes the decisions, and the AI only drafts, sit well clear of those rules.

5. What is logged, and can we see it?

If a client says “you never asked me for that”, can you show what was sent, when, and who approved it? A log of every action, which can’t be edited afterwards, protects the practice. It also shows you what the tool is actually doing.

6. Who at the supplier can see our clients’ data?

Ask who has access to live data, where they are, and why. A good answer is a short list of named roles with a reason for each, and developers working on test data rather than real client records.

7. Have we told clients?

ICAEW’s updated engagement letter templates from March 2026 include terms on the use of AI and other software tools: whether they will be used, their limitations, and responsibilities for data protection, confidentiality and due diligence on technology providers. Check that your engagement letter and privacy notice describe the tools you actually use.

Write the answers down

For a new tool that processes client data in a new way, a data protection impact assessment is the natural place to record these answers and the risks you have accepted. Even where one isn’t strictly required, a one-page note of what you asked, what the supplier said, and why you went ahead is worth having if a client or your supervisor ever asks.

How Forenax answers these questions

We publish our own answers on our security and data page: a data processing agreement before any client data is touched, client data hosted in the UK, the AI model called only in Amazon’s London region and not used for training, a person at your firm approving messages, an append-only log of every action, and developers working on made-up data. If you have a question we haven’t answered there, ask us.