AI Data Security in Finance

AI tools are already inside the finance function. ChatGPT, Copilot in Excel, Claude and a growing number of finance-specific AI applications are used daily by qualified finance professionals across the UK — for drafting management commentary, researching accounting standards, building financial models and summarising board papers. The productivity gains are real and the adoption is happening regardless of whether formal policies are in place. Our guide to how a Financial Controller uses AI sets out where it genuinely helps.

The data security question is the one most frequently deferred. Finance teams adopt AI tools because they are visibly useful, and later discover that no one has answered the fundamental questions: which data can go into which tools, what are the legal obligations when AI processes personal or commercially sensitive financial data, and what governance framework is required to make AI use auditable when the external auditors or the regulator asks about it. This guide provides practical answers.

The Core Problem: Consumer AI Tools and Confidential Financial Data

The most widely used AI tools — ChatGPT, Claude and Google Gemini in their standard consumer versions — are external services. When a finance professional pastes management accounts, board pack commentary, salary data or M&A projections into a consumer AI chatbot, that data is transmitted to a third-party server and processed there. Depending on the service’s terms and the user’s settings, it may be retained and may also be used to train future versions of the model.

This creates three distinct problems for finance teams.

Data confidentiality. Management accounts, board papers, M&A projections and salary data are commercially sensitive. Transmitting them to an external AI service under personal terms means they leave the organisation’s control environment. If the service suffers a data breach, or if retained data is used in ways the organisation has not agreed to, the organisation has little remedy and no visibility.

UK GDPR obligations. Where financial data contains personal information — salary records, expenses, personnel costs, customer data — processing it through an external AI service on the organisation’s behalf makes the provider a processor under the UK GDPR, which sits alongside the Data Protection Act 2018. That requires a lawful basis, a written processor contract with the provider and, if the data leaves the UK, a valid basis for the international transfer. Processing personal data through a consumer AI tool without these elements in place is a potential breach of the UK GDPR.

Professional and regulatory duties. Qualified finance professionals are subject to confidentiality obligations through their professional body — ICAEW, ACCA or CIMA. Using a consumer AI tool with confidential employer or client information may breach those duties. FCA-regulated businesses have additional obligations around confidential information handling and technology use in regulated activities.

Confidentiality and the ICAEW Code of Ethics

Confidentiality is one of the fundamental principles in the ICAEW Code of Ethics,, as do the ACCA and CIMA codes. It applies to information acquired through employment as well as through client work, and it requires members to take reasonable steps to make sure that staff and others acting for them respect it too. Pasting an employer’s unpublished results into a tool on personal terms is hard to reconcile with that duty.

Consumer vs Enterprise AI: The Distinction That Matters

The most important data security decision a finance team makes about AI is the choice between consumer-tier and enterprise-tier access. The underlying AI models are often the same. What differs is what happens to the data provided.

Consumer-tier tools (free and individual paid plans of ChatGPT, Claude and Gemini) may use conversation data to improve models unless the user opts out, operate under consumer terms that do not include a processor contract with the organisation, and offer no contractual commitments on data residency, retention or staff access. These are appropriate for tasks involving non-sensitive, non-personal information — drafting a generic explanation, researching a publicly available accounting standard, generating ideas for a presentation structure.

Enterprise-tier tools (business and enterprise plans from the same providers, Google Workspace with Gemini, Microsoft 365 Copilot via an organisational licence) typically exclude customer data from model training, include a data processing agreement intended to meet UK GDPR requirements, and set out data location, restricted staff access and contractual security commitments. These are appropriate for commercially sensitive or personal financial data, subject to the organisation’s own data classification policies and the specific terms of the agreement.

The ICO’s guidance on AI and data protection makes clear that organisations using AI tools to process personal data remain responsible for ensuring the processing meets UK GDPR requirements, regardless of whether the AI is provided by a third party.

Microsoft Copilot for Finance Teams

Microsoft 365 Copilot is widely deployed in UK finance functions, primarily because most larger businesses already operate within the Microsoft 365 environment.

When deployed through an organisational Microsoft 365 licence with appropriate configuration, Copilot operates within the Microsoft 365 service boundary: Microsoft states that prompts and responses are not used to train the underlying models, data is handled under the organisation’s existing Microsoft 365 commitments including data location, and Copilot only surfaces content the user already has permission to see. This makes properly configured Microsoft 365 Copilot generally appropriate for commercially sensitive financial data, subject to the organisation’s own data classification policies.

Two important caveats: ‘properly configured’ requires IT involvement to ensure the deployment meets the organisation’s data governance requirements, including tightening over-broad SharePoint and Teams permissions; and the Microsoft terms, not this guide, are the definitive source of the data handling commitments. Finance teams should not treat this guide as a substitute for reviewing the specific terms of their Microsoft agreement. For a side-by-side view of the main tools, see Claude vs Copilot vs ChatGPT for finance.

Classifying Financial Data for AI Use

The practical approach to AI data security in finance is data classification: defining in advance which categories of financial data can be used with which categories of AI tool.

Green — appropriate for consumer AI: Publicly available information, generic accounting concepts and standards, non-sensitive draft text without financial figures or organisational identifiers, anonymised illustrative examples.

Amber — enterprise AI tools only: Management accounts with commercially sensitive data, board papers and investor presentations, budget and forecast models, operational financial data from the organisation’s systems. These require enterprise-tier AI with a data processing agreement, and ideally AI tools integrated directly into the organisation’s systems (Copilot in Excel, Copilot in Word) rather than copy-and-paste into external chatbots.

Red — AI use not appropriate without legal review: Personal data including salary records, individual expenses and customer financial data; M&A information subject to confidentiality obligations; regulatory submissions and FCA-reportable information; data subject to legal privilege or contractual confidentiality restrictions.

UK GDPR Obligations When AI Processes Personal Data

Where AI tools process personal data as part of financial operations — analysing payroll, processing expense reports, reviewing customer financial data — the organisation must comply with the UK GDPR as data controller. The AI service provider acts as a processor, and Article 28 of the UK GDPR requires a written contract with the processor before processing begins.

That contract must specify the subject matter, duration, nature and purpose of the processing; the type of personal data and categories of data subjects; and the obligations and rights of the controller. The ICO’s guidance on controller and processor contracts lists the full set of required terms. Consumer-tier AI tools do not provide these contracts. The major enterprise providers do provide them as part of business terms, though the specific terms vary and should be reviewed by the organisation’s legal team before sensitive personal data is processed.

Where AI use involves automated decision-making with legal or similarly significant effects on individuals — using AI to inform decisions about individual pay, credit or eligibility — the UK GDPR’s automated decision-making rules apply, as amended by the Data (Use and Access) Act 2025. Safeguards including the right to meaningful human intervention remain, and the organisation’s privacy notice must explain the processing.

Data Protection Impact Assessments

A DPIA is required where processing is likely to result in a high risk to individuals, and the ICO lists innovative technology, including AI, among the factors that point towards one. Rolling out an AI tool across payroll, expenses or customer credit data will usually meet that threshold. The ICO’s DPIA guidance sets out the process: describe the processing, assess necessity and proportionality, identify risks to individuals, and record the measures that reduce them. Complete it before go-live and revisit it when the tool or its use changes.

Processor contracts and data residency

Where a provider processes data outside the UK, the transfer must rest on UK adequacy regulations or appropriate safeguards such as the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, as explained in the ICO’s international transfers guidance. Ask each provider where prompts and files are stored and processed, how long they are kept, which sub-processors are used and whether a UK or EU location can be chosen. The answers belong in the AI tool register alongside the contract.

Building an AI Data Security Framework

A practical AI data security framework for a finance function does not need to be lengthy or complex. It needs to answer four questions clearly.

Which tools are approved? A list of AI tools approved for finance team use, with the tier of approval for each. This list should be maintained by the CFO or FC in conjunction with IT and legal, and updated as new tools are adopted.

Which data can go where? The Green/Amber/Red classification above. Finance team members should be able to determine from the classification which AI tool is appropriate for any given task without consulting a policy document each time.

What review is required? The human oversight requirement: which AI outputs require human review before use, who is responsible, and what verification is needed. For financial reporting and regulatory submissions, human review of all AI-assisted output should be mandatory.

How is AI use documented? An audit trail allowing the finance function to demonstrate to auditors and regulators which elements of financial reporting involved AI assistance, what data was provided, which tool was used and who reviewed the output. A simple log in the finance function’s document management system is sufficient for most purposes.

See Human-in-the-Loop AI Controls and AI Usage Policy for Finance Teams for the detailed governance framework that sits alongside this data security foundation, and connecting AI to finance data safely for integrations with ledgers and reporting systems.

Cyber security foundations: NCSC guidance and Cyber Essentials

AI tools sit on top of the organisation’s existing security, not beside it. The NCSC’s Cyber Essentials scheme covers the basic controls — firewalls, secure configuration, user access control, malware protection and security updates — that stop an AI account becoming the weakest link. For AI specifically, the NCSC’s guidelines for secure AI system development are useful when procuring or building AI tools. For finance teams that means multi-factor authentication on every AI account, prompt removal of leavers’ access, and treating instructions hidden in uploaded invoices or emails (prompt injection) as a real risk.

What Auditors and Regulators Are Now Asking

External auditors are increasingly asking about AI use in financial reporting as part of their risk assessment; under ISA (UK) 315 they already have to understand the IT environment that produces the figures. Common questions include: which AI tools are used in the finance function; whether AI has been used in preparing financial information; what review process was applied to AI-assisted work; and whether the organisation has assessed the data security implications.

Finance teams with a documented AI data security framework — even a simple one — are better positioned in these conversations than those answering ad hoc. The documentation demonstrates that AI use is governed, not uncontrolled, and that the finance team has considered the data security implications proactively. Boards are asking similar questions, particularly where directors must report on the effectiveness of internal controls; our guide to what boards are asking about AI in finance covers them.

FCA-regulated businesses should note that the FCA’s approach to AI in financial services applies its existing rules to AI rather than creating a separate regime: the Senior Managers and Certification Regime, the Consumer Duty, systems and controls requirements and, for firms in scope, operational resilience where AI supports an important business service. Firms remain responsible for outcomes produced with AI assistance — a principle that reinforces the need for human oversight and data security governance. See What Auditors Ask About AI in Finance for the specific audit questions and how to prepare for them.

Practical Rules for Finance Teams Right Now

Without waiting for a full policy framework, three rules resolve most AI data security decisions for a finance function today.

Enterprise tools for anything with numbers or names in it. If the task involves actual financial data, salary information, or any identifiable individual, use an enterprise-tier tool with a data processing agreement. If the business does not have an enterprise AI agreement in place, the task should not use AI until it does.

Consumer tools for generic and public tasks only. Drafting generic explanations, summarising publicly available information, generating structural ideas for documents, writing from scratch using only information you type in (not paste from a financial system). No actual financial data, no organisational identifiers, no names.

Always review before filing or presenting. AI output must be reviewed by a qualified finance professional before it appears in a board pack, a statutory filing, an investor report or any communication to a regulator. The finance professional who reviewed and approved the output is accountable for its accuracy, regardless of whether AI was used to produce the first draft.

These three rules are sufficient for most finance functions at the current stage of AI adoption. The fuller framework above is the right destination — but these rules allow the finance team to use AI productively while that framework is being developed. The cases that need judgement — confidential M&A data, personal data, regulatory submissions — should be escalated to the CFO or FC before AI is used. See AI Tool Landscape for Finance Teams for the full comparison of tools and their appropriate use cases.

A control checklist for finance teams

• An approved AI tool register, owned by the FC or CFO, recording the contract, data location and data classes allowed for each tool.
• Personal AI accounts blocked or prohibited for work data; access through company single sign-on with multi-factor authentication.
• Model training on company data switched off and retention settings confirmed in writing.
• A DPIA completed for any AI use involving personal data, before go-live.
• A short log of AI-assisted work feeding the accounts or board papers, with the reviewer named.

AI Data Security: Frequently Asked Questions

Can we put management accounts into ChatGPT?

Not into a personal or free account — only into an enterprise-tier tool with a contract covering data use and training, where your classification policy allows it.

Do we need a DPIA to use AI in finance?

If it will process personal data such as payroll or expenses, a DPIA is likely to be required, before go-live.

Is Cyber Essentials enough for AI tools?

It is a sound baseline, not a complete answer: add an approved tool list, data classification and review of AI output.

Who should own AI data security in the finance function?

Usually the Financial Controller or CFO, working with IT and the data protection lead. Our guide to AI in finance covers the wider skills picture.