Illustrative scenarios · composites, not clients
Everyone was already using ChatGPT. Nobody had said how.
Staff paste client files into free AI tools. The fix is an assessment, clear written rules, training, and one tool they're allowed to use.
At a glance: Toronto professional services team · 12–30 staff · Security assessment → training → written policy
The situation
A partner-led accounting and advisory firm. Busy season is coming. Junior staff are clearly faster than last year, and a partner finds out why: several people are using personal ChatGPT accounts to summarize client emails and draft memos.
The friction
- Client data in personal accounts. Nobody knows which tools are in use, under whose account, or what has been pasted in.
- Banning it is the obvious reaction, and it doesn't work. People who are already faster with AI will keep using it, just more quietly.
- Enterprise-style programmes are the wrong size. The firm first needs basic rules and a sanctioned tool.
- Partners disagree. One wants it banned. One wants it everywhere. Nothing gets decided.
What Hero would do
| Branch | What Hero would do |
|---|---|
| AI security | An AI security assessment: partner interviews, an anonymous staff survey (which tools do you actually use, for what?), a review of the current Microsoft/Google admin settings, and a simple sketch of where client data goes. The output: ranked findings and a written AI use policy with three priorities: one approved tool, a never-paste list, and access by role, written in plain, PIPEDA-aware language. |
| Training | AI security team training (half day) built around the firm's real tasks: what's fine to paste, what never is, how to anonymize a client scenario before asking for help, and how to spot a prompt-injection trick hidden in a forwarded document. Each manager leaves with a one-page checklist. |
| Consulting | A short section of the plan names two safe, approved uses to start with (first drafts of engagement letters from a template, and summarizing internal meeting notes), with a person reviewing every output before it goes to a client. |
| Follow-on (optional) | When the firm is ready, Hero can help apply the agreed admin settings. Only if the partners ask. |
The outcome
What changed (qualitative):
- AI use has a path out of personal accounts and into one approved, admin-controlled workspace.
- Staff got a clear answer to "am I allowed to use this?", so they stopped hiding it.
- Partners agreed on a written policy they could show a client who asks how the firm handles AI.
- The firm knows what it doesn't have yet. Where a client contract needs a formal certification or legal opinion, Hero says so and points them to the right kind of specialist.
We don't certify compliance. We help you put practical, written rules in place. Your counsel owns the legal call.
Is this you?
You suspect client information is already in tools you don't control, and you want a calm, documented fix rather than a ban nobody follows.
Book a free 30-min Fit Call → · or call (289) 901-2136
Questions: (289) 901-2136 · info@growwithhero.com
A CLEAR NEXT STEP STARTS HERE
Is this you?
Book a free 30-min Fit Call. Or call (289) 901-2136.
Free Fit Call · 30 minutes · Video or phone