Srf: no free AI accounts for client data, bureau keeps full liability

Accounting and payroll bureaus may not run client data through free or consumer versions of AI services.Srfkonsult Srf konsulterna's new guidance page AI-verktyg i den digitala redovisningsmiljön, linked from the Digital redovisningsmiljö overview, says personal data and other protectable information must not be processed in AI services' free or consumer accountsSrfkonsult, which typically lack the protections, contract terms and administrative controls a professional practice requires.

The guidance fixes the GDPR roles first: where a bureau processes personal data for a client, the bureau is the processor and the client the controller. An AI service or other external provider that gains access to personal data in that work can therefore be a sub-processor. Before the service is used for the client's personal data, the bureau must make sure the client has authorized that particular sub-processor under their data processing agreement.Srfkonsult Under a general authorization the bureau must inform the client of planned additions or replacements so the client can object. The bureau must also sign a written agreement with the sub-processor giving the data the same protection as the client agreementSrfkonsult — for AI services this usually means the vendor's data processing terms, which are often offered only in the enterprise versions. If the sub-processor fails its duties, the bureau remains fully liable to the client.Srfkonsult

Responsibility for the work product can never be handed to the tool.Srfkonsult The consultant must assess the reasonableness of every AI answer, analysis or proposalSrfkonsult and verify it before it is used in the engagement or passed to the clientSrfkonsult. Erroneous conclusions generated by an AI system do not release the user from responsibility, and a later error cannot be excused by pointing at the tool's faulty answer or source material. The same applies to vouchers and postings a tool generates automatically: whoever uses the information is responsible for checking it is correct. The principles of Rex 595 on the use of others' work can guide AI used as preparation or decision support, provided the material is reviewed and quality-assured.

Before any AI use, the bureau should check the vendor's terms for storage, processing and protection of the data — in particular whether the vendor uses the data to train or improve its models and where the data is stored and processed. The same check applies where AI functions are built into a business system or other software: find out how the vendor handles the information and what safeguards are in place.

Srf konsulterna's closing checklist asks each bureau to keep an internal routine stating which AI tools may be used, for what and by whom; to verify and quality-assure AI-generated material before use; never to invoke the tool as an explanation for wrong data or assessments; to use only services with sufficient protection; to clear sub-processors with the client and contractually with the vendor; to check training use and EU/EEA storage; and to confirm the service meets information-security and personal-data requirements before client bookkeeping is analyzed in it.

The sub-processor duties rest on Article 28 of the GDPR (Regulation (EU) 2016/679); the verification duty follows Srf konsulterna's Rex 595 on the use of others' work.