Your client’s AI subscriptions are a practice risk

Some of the biggest data risks your clients carry today began as a routine expense claim. A staff member signs up for an AI tool, pays with a company card and gets reimbursed. At that moment, nobody in finance sees it as a matter for the auditors.

Processing Content

The issue surfaces later, when someone asks who can access the client’s financial records. The engagement partner expects a familiar list of systems and users. Nobody can answer with confidence, because the question has never been put in those terms.

Over the past 18 months, transcription services, document analysis tools and research assistants have spread across businesses of every size. Each charge sat below any approval threshold, so no one read the terms or assessed the vendor. Some of these tools now hold contracts, payroll files and draft financial statements.

SaaS management firm Zylo’s 2026 SaaS Management Index found that expense-based software spend rose 267% in a single year. Written policies lag behind too, as IBM’s 2025 breach research found 63% of breached organizations had no AI governance policy.

Your firm did not choose any of these tools, yet it inherits the risk all the same. Firms should treat this as an engagement matter, raised at acceptance and again at every continuance. The evidence is still early, and most of it comes from observation and vendor-funded research. A piece claiming hard proof would not stand up.

The sections below cover where these tools hide, which carry the most risk, what to ask, and how to raise it.

Where the client’s problem becomes yours

Your professional duties cover what your firm discloses and how your team performs its work. You are not answerable for every subscription a client’s staff takes out. Even so, the line between the client’s risk and your firm’s risk blurs in a few places.

•  The information system: Under SAS 145, codified in AU-C 315, auditors must identify the IT applications subject to risks arising from IT use. Suppose an AP clerk runs vendor invoices through an AI extraction tool and posts the output. The tool now handles data on its way into the ledger, even if nobody documented it.
• Your work product: Draft statements, proposed adjustments, tax projections and planning memos all leave your firm by email. Once they arrive, you no longer control where they go. A client employee might upload your review notes to a free assistant for a quick summary. Your work then sits with a vendor whose terms neither of you has read.
• Your conversations: Many AI notetakers join calls automatically once someone links them to a calendar. A 2025 class action in a California federal court alleges Otter.ai recorded meetings without every participant’s consent. The suit also claims the company used those recordings to train its product. The claims remain unproven, yet your engagement team may already be on a recording held by a vendor you never assessed.

A breach at the client can also pull your firm in. IBM’s Cost of a Data Breach Report 2026 found that 43% of breached organizations reported a security incident involving shadow AI. The figure stood at 20% a year earlier, so it has more than doubled. Breaches involving shadow AI averaged $5.39 million, compared with a $4.99 million global average for all breaches. When a client suffers a breach, auditors face new questions about contingencies, subsequent events and remediation costs. At some point, someone will also ask who could see the client’s financial records. You do not want your firm to be the one without an answer. 

The list sits with finance, outside IT’s view

These tools will not appear in an IT asset register or a single sign-on log. Staff usually signed up with personal logins, so neither system ever recorded them. The evidence sits in card and reimbursement data, which the client already holds, and you already know how to read. Reimbursements also reach finance after the money is spent, so any review comes too late to stop the purchase.

• Transaction-level detail: Pull 12 months of card and reimbursement line items rather than summaries. Small recurring monthly charges at single-user price points often signal an individual AI subscription.
• Merchant descriptors: Many AI vendors bill under names that differ from the product name. Search the descriptors themselves instead of relying on general ledger coding.
• App store charges: Payments routed through Apple or Google Play hide the vendor’s name completely. You will need to ask the employee who submitted the claim.
• Annual plans: One larger charge that renews each year is easy to miss in a monthly review. Look back over the full 12 months to catch these.
• Catch-all expense heads: Claims coded to software, subscriptions, office supplies or miscellaneous deserve a second look. Small AI purchases often land in these categories.

There is one gap you should mention to the client openly. Free accounts leave no payment trail, and they can carry the highest risk of all. Data security firm Harmonic Security studied employee AI activity in the third quarter of 2025. It found that 21.81% of sensitive data went into tools that train on user inputs, including free chatbot versions. The expense list is therefore a starting point and not a complete count. Still, it gives you evidence to work.

Which tools see the most client financial data

Not every subscription carries the same exposure. Some categories are far more likely than others to receive sensitive records.

• Meeting notetakers: These tools capture discussions about cash, disputes, pricing and headcount. Many of them keep the full recording as well as the written summary.
• Document and PDF assistants: Staff upload contracts, leases, loan agreements and bank statements to get a quick overview. In most cases, the whole document goes in.
• Chat and research assistants on personal plans: Employees paste in trial balances, variance notes or payroll figures to build a formula or draft a narrative.
• Spreadsheet add-ins and browser extensions: Depending on their permissions, these can read whatever sits in an open workbook or on the screen.
• Writing assistants with inbox access: These tools read incoming email, which includes every message your firm sends the client.
• Receipt and invoice scanners: One department may adopt a capture tool on its own. Finance may never see its terms or data settings.

What to ask at acceptance and continuance

The profession’s leadership has flagged this area as well. In a January 2024 podcast, Barry Melancon, then CEO of AICPA & CIMA, discussed AI and auditing. He said auditors would need to consider how a client uses AI, including passive use by its employees. He also noted that “confidential information and the like is a really important aspect of our profession.”

Most firms already ask about significant systems during acceptance, so a few extra questions on AI add very little time. Here is a short set you can adapt:

1. Which AI tools does the business pay for, including through employee reimbursements?
2. Have any of these tools received financial records, contracts, payroll files or customer data?
3. Are any accounts on consumer or individual plans that allow training on user inputs?
4. Who can cancel each account and ask the vendor to delete stored data?
5. Do any notetakers or assistants join calls or read email automatically?
6. Does the business have a written AI use policy, and when was it last reviewed?

Keep the answers in the engagement file with the rest of your understanding of the entity. Call recording also deserves a line in the engagement letter. Both sides can then agree in advance whether third-party tools may record meetings with your team.

You do not need to design the client’s AI policy yourself. Your role is to know where the client’s records travel, judge the effect on your work, and flag what needs fixing.

How to raise it without sounding alarmist

Clients may hear “AI risk” as a lecture or a sales pitch. Starting with something concrete keeps the conversation calm and useful.

• Bring the list: Show the client the subscriptions you found in their own expense data. Names and amounts make a stronger case than any warning.
• Frame it as housekeeping: Place the review alongside the vendor and access checks the client already treats as routine.
• Begin with notetakers: Owners see right away why a recorded pricing discussion should not sit with an unknown vendor.
•  Offer three choices per tool: The client can cancel it, move it to a business plan with proper terms, or keep it with a documented reason.
•  Separate patterns from one-offs: One employee with one subscription calls for a quick chat. A dozen unreviewed tools across departments points to a control weakness worth recording.

Clients tend to respond well once they see the exercise protects them. Starting from their own receipts helps them see this quickly.

Ask the question before someone else does

Sooner or later, a lender, an insurer, a regulator or the clients themselves will ask who can see the records. Firms that ask first can answer with a tidy list of subscriptions. Firms that wait may end up answering with an incident report instead.