Confidential or Privileged Information: APESB's Draft Guidance on AI for Forensic Accountants and Valuers, September 2026

The technical staff of Australia's Accounting Professional & Ethical Standards Board, APESB, developed a draft guidance "to assist Members when they use Artificial Intelligence (AI)" in providing forensic accounting services and the services of valuers. It is among the papers for the board's meeting of September 4, 2026, as the board's page of meetings lists them. The draft prints no date of its own, and each page is headed "PRELIMINARY DRAFT FOR BOARD DISCUSSION."

It sets its own limits. It "does not amend or override the Code or applicable APESB pronouncements, whose text alone is authoritative," and it "does not constitute an authoritative or official pronouncement of APESB." The Code is APES 110, the Code of Ethics for Professional Accountants, which the draft says is built on five fundamental principles. Confidentiality is one of them.

Parts of the draft follow, not the whole.

Confidentiality and Data Security

"Maintaining the confidentiality of information is critical in an AI environment," the draft says. The use of AI adds complexity to the handling of confidential information, it says, "particularly where data is processed through external platforms, because information entered into an AI tool may be stored, used to train the underlying model, or become accessible to third parties." That may occur within an organization, for example where multiple users have access to a proprietary AI tool, and/or outside it, for example where the model is trained on the content and the content is used in another AI user's output.

A Member, it says, should therefore "identify and assess the confidentiality risks arising from a proposed use of AI, decide whether a particular tool is appropriate for the information involved and apply appropriate safeguards." That assessment, it says, "should be supported by clear organisational policies on when, and how, AI tools may be used with confidential or privileged information."

An Example From Forensic Work

The draft's first illustrative example, one of the scenarios it calls hypothetical, follows a director in the forensic services group of a mid-tier firm. The director has been retained to prepare an expert report on a client's loss of profits from a supplier's breach of contract, and the brief includes a file of emails marked "privileged and confidential." Under the pressure of a tight deadline, a junior team member suggests entering the email bundle and the bank statement into "a free, publicly available chatbot" to produce a chronology and first summaries. That, the junior member notes, would save significant time.

Entering that information, the draft says, "would risk disclosure, as the information may be stored, used to train the underlying model or become accessible to third parties," none of which the director can control "once the data has left the firm's environment." Its course of action begins, "Confidential or privileged client information should not be entered into public AI tools." If AI is used to help with the report, the team "should use an AI tool with appropriate data-security and no-retention settings and should restrict access within the firm to those working on the engagement."

Transparency and Disclosure

The draft says that "Users of valuation and forensic services should be appropriately informed about when and how AI has been used and the extent to which AI-generated outputs have contributed to the Member's work." Where the use of AI is material to the engagement, the member "should document and communicate to the Client the details of the AI tools used, the protocols in place, including how the Client's confidential information will be used in the AI tool."

How much to disclose, it says, "is a matter of professional judgement," depending on factors such as the extent of the AI's contribution, the needs of the users and any applicable engagement terms or professional, legal or court requirements. Disclosure, it adds, "does not reduce the Member's responsibility for the output."