The AI Learning Hub Journal

Confidentiality, Independence and the Paste Problem

The paste problem — and the question this course refuses to answerconfidentiality is a professional duty and a contractual one at once — the reasoning behind the rule is not the team’s to redoCLIENT DATA GOES ONLY INTO FIRM-APPROVED TOOLS — THE BOUNDARY IS NOT THE TEAM’S TO MOVEthe approved listthe visible edge of an agreement betweenfirm, clients and regulators aboutwhere client information may travela consumer tool on a personal loginsits outside every one of those protections:· outside the engagement terms the team may never have read in full· outside the professional duty of confidentiality and its protections· outside anything the firm has assessed — whatever its settings claimoff the list?the question is never ‘is this probably fine’it is ‘who do I ask’the convenience of the paste is not a factor the duty recognisesTHE INDEPENDENCE ANGLES — ORIENTATION LEVEL: RECOGNISE THE SHAPE, ROUTE IT ONTHE SELF-REVIEW SHAPEthe firm advises a client on selecting,building or tuning an AI system —then audits numbers that systemhelped producestanding near the self-review line theprofession has spent decades drawingWHOSE INFORMATION IS WORKING?a tool trained or tuned on one client’sdata later assists another client’sengagement — a question the old rulesnever had to phraseneither shape has a settled, universalanswer yet‘WHAT MAY NEVER BE PASTED?’ — ANY GENERIC LIST WOULD BE WRONG SOMEWHERE, BECAUSE THE BOUNDARY MOVES WITH:the jurisdictionand its data ruleseach engagement’stermsthe firm’s own policiesand toolingregulatory expectationsstill being writtena tidy list here would repeat the exact failure this course warns about — a confident answer without the groundingthe portable answer is a procedure, not a listknow that the boundary exists · assume it is nearer than convenience suggests ·know the person or policy at your firm that answers it — before the moment you need itTHE REFUSAL TO HAND YOU A LIST IS THE LESSONthe boundary is a firm and jurisdictional question — the practitioner’s job is the reflex, not the answer
A course that handed you a tidy never-paste list would be producing a confident, fluent answer without the grounding to support it.

Approved Tools, and Where the Boundary Sits

Client data goes only into firm-approved tools. The sentence is short because the reasoning behind it is not the engagement team's to redo: confidentiality is a professional duty — the territory of the IESBA Code and its national equivalents — and it is also a contractual one, set by engagement terms the team may never have read in full. A consumer AI tool reached through a personal login sits outside every one of those protections, whatever its settings claim, and the convenience of the paste is not a factor the duty recognises. The approved list is therefore not bureaucracy slowing the team down; it is the visible edge of an agreement between the firm, its clients and its regulators about where client information may travel. If a tool is not on the list, the question is not 'is this probably fine' but 'who do I ask'.

  • Client data goes only into firm-approved tools — the boundary is not the team's to move
  • Confidentiality is IESBA Code territory and engagement-contract territory at once
  • A consumer tool on a personal login sits outside every protection, whatever its settings claim
  • Off the list, the question is never 'probably fine' — it is 'who do I ask'

The Independence Angles

Confidentiality is the familiar half; independence is the newer one, and this course raises it at orientation level only. Two shapes are worth recognising. First, a firm that advises a client on selecting, building or tuning an AI system, and then audits numbers that system helped produce, is standing near the self-review line the profession has spent decades drawing — where exactly the line falls is a question for the firm's independence function, not for a course. Second, a tool trained or tuned on one client's data that later assists another client's engagement raises a question the old rules never had to phrase: whose information is doing the work? Neither shape has a settled, universal answer yet. What the practitioner needs is not the answer but the reflex — recognise the shape, and route it to the people whose job the answer is.

  • Advising on the same AI the firm audits stands near the self-review line
  • A tool tuned on one client's data assisting another's engagement asks: whose information is working?
  • Neither shape has a settled universal answer yet, and pretending otherwise would mislead
  • The practitioner's job is the reflex: recognise the shape, route it to the independence function

The Question This Course Will Not Answer

There is an obvious question this lesson looks like it should end with: what, concretely, may never be pasted into an AI tool? This course declines to answer it, and the refusal is the lesson. Any general list would be wrong somewhere — the boundary moves with the jurisdiction and its data rules, with each engagement's terms, with the firm's own policies and tooling, and with regulatory expectations that are still being written. A course that handed you a tidy list would be doing the thing it has warned you about since module one: producing a confident, fluent answer without the grounding to support it. The genuinely portable answer is a procedure, not a list. Know that the boundary exists; assume it is nearer than convenience suggests; and know the name of the person or policy at your firm that answers it — before the moment you need it.

  • Any generic never-paste list would be wrong somewhere — jurisdiction, terms, policy and regulation all move it
  • A confident list here would repeat the exact failure this course warns about
  • The portable answer is a procedure: assume the boundary is nearer than convenience suggests
  • Know the person or policy at your firm that answers this, before you need it

Prefer slides, quizzes, and saved progress? Read this lesson in the library — free, no sign-up.