1. Purpose

This policy governs the use of artificial intelligence and AI-enabled features by I Count Beans Pty Ltd. It is designed to support responsible use of AI while maintaining client confidentiality, privacy, professional competence, reasonable care, appropriate supervision, record keeping and quality management.

AI may improve efficiency, research and drafting, but I Count Beans remains responsible for every tax agent and BAS service provided to a client. AI is a support tool and is not a substitute for professional knowledge, judgement or review.

2. Scope

This policy applies to all directors, employees, contractors and other personnel in Australia and the Philippines, and to standalone AI tools as well as AI functionality embedded in software, search engines, email, CRM, accounting, document or productivity platforms.

3. Core rules

• Use only AI tools or AI-enabled features approved by a Director for I Count Beans work.
• Treat AI output as draft assistance, not as authoritative tax, accounting, legal or regulatory advice.
• Apply professional judgement and verify material AI output before relying on it.
• Protect client confidentiality. Client information must not be disclosed to an AI provider unless client permission and the approved-provider requirements in this policy are satisfied.
• Where an AI use is otherwise permitted, use the minimum information necessary and remove direct identifiers where reasonably practicable. Removing identifiers does not by itself remove the requirement for client permission if the information still relates to an actual client’s affairs.
• Do not allow AI to send final client advice, lodge returns, make elections, approve payments or make other material client decisions without human review and authorisation.
• Keep sufficient records of material AI use so the work, verification and reviewer can be understood later.

4. Approved uses

• General research and explanation of non-client-specific concepts.
• Locating or summarising legislation, rulings, guidance or software instructions, provided material technical conclusions are checked against reliable current sources.
• Drafting or improving the wording of emails, letters, checklists, procedures and internal documents.
• Brainstorming questions, information requests, workpaper structures and review checklists.
• General software assistance, including how-to questions for Xero and other approved systems.
• Summarising or analysing client information only where the AI provider, client permission and data-handling controls permit that information to be used.
• Administrative assistance and quality-review prompts that do not replace the required professional review.

5. Prohibited or restricted uses

• Using an unapproved AI account for client work involving confidential or personal information, or using a personal AI account outside a specifically approved Director exception.
• Entering client information into a provider where the firm has not assessed privacy, security, training use, retention, subprocessors and data location.
• Relying on AI-generated tax law, calculations, citations or conclusions without appropriate verification.
• Allowing AI to determine a final tax position, lodge a document, communicate final technical advice or make a material client decision without authorised human review.
• Entering passwords, authentication codes, API keys, banking credentials, credit card details or suspicious-matter information into AI.
• Using AI output that appears fabricated, internally inconsistent, outdated or unsupported without resolving the issue.
• Circumventing client restrictions, software controls, copyright restrictions or provider terms through AI.

6. Client permission and confidentiality

Information relating to a client’s affairs must not be disclosed to a third-party AI provider unless the client has given permission or there is a legal duty to disclose. For new clients, the standard engagement terms may provide this permission where the approved AI providers, purposes and data-location information are clearly identified in the Privacy Policy. Existing clients require equivalent permission before information relating to their affairs is first provided to an AI provider.

Before information relating to a client’s affairs is entered into an AI provider, the provider and use must be approved, the client must have given permission, and the provider, type of disclosure and relevant processing or storage location must be identified in the public Privacy Policy or separately disclosed to the client. If those conditions are not met, the prompt must be limited to public, generic or hypothetical information that does not relate to an actual client’s affairs.

7. Philippines staff restrictions

Personnel based in the Philippines may use ChatGPT Free and Google Search AI features only for public, generic or hypothetical assistance that does not relate to an actual client’s affairs. They must not upload, paste, summarise or otherwise provide client documents, raw client records, client emails, names, facts, figures, amounts or other information relating to a client’s affairs to those tools.

• Do not upload client documents, attachments, screenshots, email chains, tax returns, financial statements, workpapers, payroll files, Dext documents, Xero exports or other raw client data to AI.
• Do not enter TFNs, identity documents, bank details, authentication information, payroll credentials, AML/CTF restricted information or other Restricted information.
• AI may be used for general questions such as how to perform a task in Xero or another approved program.
• AI may assist with drafting or improving wording only where the prompt is generic or hypothetical and does not contain or derive from an actual client’s affairs, confidential facts, amounts, identifiers, emails or attachments.
• Where a client-specific answer depends on tax interpretation, material facts or professional judgement, prepare the issue for review by the responsible Australian accountant or Director rather than seeking a client-specific conclusion from AI.
• ChatGPT Plus use: before any client-specific information is entered, the client permission position must be satisfied under the engagement/privacy framework. ‘Improve the model for everyone’ must be switched off. Temporary Chat should be used for client-specific work where practicable. Restricted information listed in section 5 must not be entered. Client information must be minimised and material outputs independently checked.

8. Competence, reliability and human review

• The person using AI must understand the task and be capable of recognising an incorrect or incomplete output.
• Material tax propositions must be checked against current primary or authoritative sources appropriate to the issue.
• Calculations generated by AI must be independently checked where material.
• Citations, case names, rulings, legislation and quoted material generated by AI must be verified before use.
• AI output must be assessed in the context of the client’s actual circumstances; generic AI output is not a substitute for ascertaining the client’s state of affairs.
• Final client advice and material lodgement positions require the same level of review and sign-off as work prepared without AI.
• Where the reviewer cannot verify an AI-generated conclusion, the conclusion must not be used.

9. Record keeping and quality management

Where AI materially contributes to a tax agent or BAS service, the workpaper or file note should record enough information to show how the output was used and verified. Depending on materiality this may include the tool, date, purpose, key output or conclusion, sources checked, changes made, and reviewer.

Full prompts and outputs do not need to be copied into the client file merely because AI was used where doing so would duplicate sensitive information or conflict with data-minimisation practices. The record must nevertheless be sufficient to demonstrate the professional work and review performed.

10. Approval of AI providers and features

Before an AI provider or material AI-enabled feature is approved, a Director must consider:

• the intended use and whether the tool is suitable for the task;
• the type and sensitivity of information that may be entered;
• whether prompts, files or outputs are retained and whether they are used to train or improve models;
• available business, enterprise, privacy and training opt-out settings;
• data storage and processing locations and relevant subprocessors;
• access controls, authentication, encryption, logging and incident notification;
• contractual terms, privacy policy, data processing terms, retention and deletion;
• the ability to supervise use and retrieve evidence where required;
• the reliability and limitations of the model for the intended use; and
• whether the engagement terms and Privacy Policy adequately disclose the proposed use.

11. HubSpot and client communications

I Count Beans uses HubSpot to retain and manage email communications so authorised personnel, including Tony Mann and Michael Tedman, can supervise staff communications, maintain continuity, perform quality control and review what has been communicated to clients. HubSpot is a communication and record-management tool; it does not remove the requirement for staff to review the accuracy and appropriateness of communications before sending them.

If AI assists with drafting a client email, the final email must be reviewed by the responsible staff member and escalated for professional review where the content contains technical advice, a material tax position or another matter outside that staff member’s authority.

HubSpot email storage is separate from HubSpot AI. The firm may use HubSpot to store and supervise client email communications while HubSpot AI features remain disabled or unapproved for client information.

12. Incidents and escalation

• Immediately report accidental disclosure of client information to an unapproved AI tool.
• Immediately report any AI-generated communication sent to a client without required review or containing a material error.
• Preserve relevant evidence and stop further use of the affected tool or workflow if directed.
• The responsible Director must assess confidentiality, privacy, TPB, professional, contractual and data-breach consequences.
• Material incidents must result in corrective action and, where appropriate, updates to provider approval, training or controls.

13. Training and supervision

Personnel authorised to use AI must receive training appropriate to their role. Supervisors must consider the staff member’s knowledge and skills, the nature of the task and the risks of the AI use. Repeated or deliberate breaches may result in removal of AI access or disciplinary action.

14. Monitoring and review

The Directors will review this policy, the Approved AI Register and material AI use at least annually and when there is a material change in TPB guidance, law, provider terms, model capability, data handling or I Count Beans’ use of AI.

15. Approved AI Register

The following AI services are the current I Count Beans tools. Their permitted use differs by account type. Consumer/free tools must not be treated as equivalent to an enterprise environment. No staff member may use a tool outside the limits recorded in this policy.

Tool / account	Permitted use	Client information & controls	Data / governance position
ChatGPT Plus – Directors	Research, drafting, document review and analysis.	Limited client-specific use only after client permission. Turn off ‘Improve the model for everyone’; use Temporary Chat where practicable; minimise information. Never enter TFNs, ID documents, passwords/authentication codes, complete bank/card details, biometric data, AML/CTF restricted information or suspicious-matter information.	Plus is a personal workspace. OpenAI states personal-workspace content may be used for training unless the user opts out. Temporary Chats are not used for training and are retained for up to 30 days for safety. OpenAI may process/store personal data in the US and other jurisdictions.
ChatGPT Free – staff	Public, generic or hypothetical drafting, wording assistance and software/how-to questions.	No information relating to an actual client’s affairs. Do not paste client emails, names, facts, figures, documents or attachments.	Personal/free service. It is not approved as a processor of client information.
Microsoft 365 Copilot / Copilot Chat – work account	Drafting, summarisation, research, analysis and assistance within Microsoft 365.	Client information may be used where reasonably necessary and within the user’s existing Microsoft 365 permissions. Material technical output requires independent professional review.	Enterprise data protection applies; Microsoft states prompts, responses and Graph data are not used to train foundation models. The I Count Beans tenant is understood to be provisioned in Australia and is managed by Precision IT.
Google Search AI / AI Overviews / AI Mode	Public, generic or hypothetical research and locating public sources only.	No information relating to an actual client’s affairs. Do not enter client names, facts, amounts, documents, screenshots or confidential information.	Google states Search/AI interactions may be used to improve generative AI, including human review subject to privacy safeguards. Important results must be verified against authoritative sources.
HubSpot AI features	Not approved for client-information use.	No client information may be processed through HubSpot AI unless separately assessed and approved.	HubSpot CRM/email storage is approved separately. AI features may involve additional AI subprocessors and require a new Director review, privacy disclosure and client-permission assessment.