Is AI Safe for Financial Data? Rules, Vendor Terms and a Vetting Checklist

Is AI safe for financial data? It can be, under three conditions: the vendor's terms say your data is not used for training and is not kept longer than you expect; your own obligations (the FTC Safeguards Rule, and IRS §7216 if you prepare tax returns) are covered by a written plan that mentions the tool; and you send the model only what the task needs, which is usually far less than the whole file. Consumer chat tools on default settings fail the first condition. Business tiers and APIs often pass it. This guide goes through the rules and the vendor terms, citing the primary sources, and ends with a checklist.

What "safe" has to mean for financial data

A bank export, a client's general ledger or a payroll file is not just confidential; parts of it may be regulated. Three questions decide whether an AI tool is safe for it:

Rule 1: IRS §7216, if you prepare tax returns

Treasury Regulation 26 CFR 301.7216-3 says that unless the statute or §301.7216-2 specifically authorises it, "a tax return preparer may not disclose or use a taxpayer's tax return information prior to obtaining a written consent from the taxpayer", and that "the consent must be knowing and voluntary."

Whether pasting return information into a third-party AI tool is a "disclosure" under this rule is not something the IRS has ruled on in a form we could find. Many tax practitioners treat it as one, which is the cautious reading: the data leaves your systems and lands on a vendor's. If you are a tax return preparer, the practical conclusion is to obtain written consent before using client return information in any outside AI tool, or to not use such tools on that data. The rule applies to preparers; a bookkeeper who only categorises transactions and never prepares returns may be outside it, but that depends on the facts and is worth confirming with counsel.

Rule 2: the FTC Safeguards Rule, for most firms handling customer financial information

16 CFR 314.4 requires financial institutions covered by the Gramm-Leach-Bliley Act (the FTC treats tax preparers and many bookkeeping and accounting practices as covered) to maintain an information security program with, among other things:

An AI vendor is a service provider that handles customer information, so it belongs in the data inventory and the risk assessment. If your written information security plan (WISP) does not mention the tool, the tool is outside your program. The IRS publishes a free template: Publication 5708, "Creating a Written Information Security Plan for your Tax & Accounting Practice" (Rev. 8-2024), 29 pages including a sample WISP and sample attachments for record retention, breach procedures and authorised-access lists.

Rule 3: professional standards and client transparency

Professional bodies have been more direct than regulators. Guidance circulated through CPA.com (the AICPA's technology arm) recommends transparency with clients about generative AI use and specific written consent before confidential client data is shared with an AI vendor, with the disclosure covering what data goes in, whether it trains the model, how long it is kept and who has access. We have seen this guidance only in summary form, so treat the wording as a paraphrase and read the original before quoting it in an engagement letter.

What the major vendors say about training and retention

The single most important distinction is consumer tier versus business or API tier. The table lists only statements we read on the vendor's own page on October 10, 2026; everything else is marked as such.

Two patterns stand out. First, every vendor's strongest commitments are on paid business or API tiers, and the strongest of all (zero data retention) is a negotiated arrangement rather than a checkbox. Second, "not used for training" and "not retained" are separate promises; a vendor can keep the first and not the second. Ask about both.

The vetting checklist

Print this and fill in one column per vendor. A blank cell is a finding.

The design question: send the whole file, or a column profile?

Most of the risk above comes from one habit: sending the entire file to the model. For cleaning tasks, the model rarely needs it. To suggest that a Date column should be parsed as US month-first, it needs the header, the detected type, the share of empty cells and a handful of sample values, with identifiers and names redacted. That is a column profile, and it is a few hundred bytes per column.

This is the approach we would hold any AI feature to, including our own if we build one: the model sees a profile, proposes a step, and a deterministic transformation applies that step to every row after you approve it. Today PipeSheets has no AI feature at all; every step is fixed and previewable, uploaded files are deleted automatically (after 7 days on the free tier, 30 days on paid), and you can delete them sooner. Nothing is sent to a model. We are describing the principle, not a shipped capability.

Can an AI tool silently change financial values?

Yes, and this is the risk nobody's terms of service cover. When you ask a chat tool to "clean" a file and it hands back a new copy, you get no diff. In our own test of a 13-row sample (described in our Excel comparison), the assistant blanked the category value "None" as if it were a null and removed a row, and told us so; on a 13,000-row file you would not have that narration, and you would not know which cells moved. Even non-AI tools make this mistake: in our testing, DuckDB 1.5.6 read the text 03/04/2026 as April 3, day-first, with no warning. Ambiguity in financial data should produce a flag, never a guess.

A practical workflow that passes the checklist

For the mechanical part of the job, cleaning a bank export so it imports cleanly, the bank statement CSV cleaner page shows the deterministic route: no model, previewable steps, and files that expire on a schedule you can see.