Chartered accountants: using AI without breaking professional secrecy

Ledgers, payroll files, client emails: an accountant's files are full of exactly the data generative AI is good at reading, and exactly the data professional secrecy covers. The Order's position is not "no AI". It is "no client data in a tool you do not control".

1. The secret: same text, same penalty as lawyers

Article 21 of Ordinance No. 45-2138 of 19 September 1945 provides that chartered accountants, the employees referred to in articles 83 ter and 83 quater, trainees and partially authorised professionals "are bound by professional secrecy under the conditions and penalties laid down in article 226-13 of the Penal Code" (our translation). Article 226-13 punishes the disclosure of secret information with one year's imprisonment and a €15,000 fine.

The code of ethics adds a layer. Article 147 of Decree No. 2012-432 of 30 March 2012 provides: "Without prejudice to the obligation of professional secrecy, the persons mentioned in article 141 are subject to a duty of discretion in the use of all information they become aware of in the course of their activity" (our translation). Secrecy forbids disclosure; discretion also governs how you use the information, including handing it to a tool.

2. What the Order says about generative AI

In its summary "Parlons data et IA", part of its Data and AI work, the national council of the Order of chartered accountants encourages use: "Generative AI is more and more widespread, we must seize this opportunity! […] We simply need to respect the regulations, including the GDPR and our professional secrecy" (our translation). Among its usage precautions: "Do not upload personal, sensitive and/or confidential data: no client emails, FEC or DSN files… that have not been anonymised, to sites you do not control (GDPR and professional secrecy)" (our translation). It also says to always check the answers, since AI can "make mistakes or make things up".

The same document offers a model "charter for the use of generative AI within the firm". Its security section is unambiguous: "Users must comply with the General Data Protection Regulation and share no personal data in their interactions with generative AI" (our translation). The model also requires answers to be "checked and validated before being shared internally (staff) or externally (clients, users, partners, …)" (our translation).

The CNIL says the same in its Q&A on using a generative AI system: never share confidential information such as personal data with a consumer service, and favour on-premise deployments.

3. What that means in a firm

Read together, the texts leave two compliant routes for working on a real client file with AI:

• A tool the firm controls. Deployed on its own systems, or under a contract and settings that the firm has actually checked (hosting, access, reuse of prompts for training).
• Data that no longer identifies anyone. The client's name, the employees on a payroll file, IBANs, addresses and tax numbers replaced before the file reaches the AI.

4. Two concrete cases

We describe step by step how a firm prepares a review file or analyses KYC files with AI, on a pseudonymised copy:

• Prepare a review file with AI
• Analyse KYC files with AI

5. Where Hexagone AI fits

Hexagone AI runs on the accountant's own Mac or PC. It detects and replaces names, company names, addresses, IBANs and card numbers, tax and social security numbers, amounts and client references in PDF, Word, Excel and PowerPoint files, and rebuilds them with their layout. The protected copy can go to ChatGPT, Claude, Mistral or Copilot; the mapping stays on the machine, and the AI's answer is re-identified there. In the Order's words, the data that reaches a site you do not control is no longer the client's.