A fractional CFO holds the books of four companies in one head. Usually on one laptop, often in one AI account. Each client signed a different engagement letter, uses a different ledger, and has a different view of what "confidential" means. Many of them have never been asked what they think about AI.
That last point is the one that matters. In a survey of 311 senior finance professionals published in June 2026, 40% said their organization either has no rules governing AI use or they are unsure what those rules are (insightsoftware, 2026). Among senior financial modellers, 48% report no formal policy on AI in model development (Financial Modeling Institute, 2026).
So in a large share of engagements, the client has no AI rule for you to follow. You are the one who brings AI in. Which means you are also the one who writes the rule.
The Short Answer
Fractional CFO firms handle confidentiality around financial data per client. For each client, they agree a short written AI policy (which data, which tools, on whose account, how long it is kept, who checks the output), add a clause to the engagement letter, keep each client's data in its own space, and delete what they hold when the engagement ends. Where the client's rules are strict, they use AI on the structure of the work and keep the client's figures out of it.
There is no single firm-wide policy that works, because there is no single client. The firm's job is to make the per-client policy fast to write and easy to check.
Why Confidentiality Is a Per-Client Question
An in-house CFO answers to one company's IT and legal teams. A fractional CFO answers to four, and most of them do not have an IT or legal team.
Three things differ from one client to the next:
- The contract. One NDA says nothing about AI. Another forbids "consumer-grade" tools. A third, often from a PE-backed client, bans any third-party processing. What each wording actually covers is in Your Client's Contract Says No AI.
- The ledger and the access. An advisor seat on one client's Xero, an export by email from another, a read-only bank feed from a third.
- The appetite. Some founders want you to use every tool available. Some boards want to approve each one.
For US CPAs, the professional rule already points in this direction. AICPA Interpretation 1.700.040 provides that before disclosing confidential client information to a third-party service provider, a member should either have a confidentiality agreement with that provider or obtain the client's specific consent (Journal of Accountancy, 2024). The interpretation predates generative AI and does not name it. A hosted AI model is a third-party service provider on any plain reading. Outside the US, check your own professional body and data protection rules, which set comparable expectations (à vérifier per jurisdiction).
What Is Actually at Risk
Most of the exposure comes from three situations. Each has a simple control.
1. Client data on the wrong tier
The commercial and consumer tiers of the same assistant are different products. Anthropic states that its consumer terms of August 2025 (Free, Pro and Max plans) let users choose whether chats are used to improve the models, with 5-year retention if they allow it and 30 days if they do not, and that the change does not apply to Claude for Work (Team and Enterprise) or the API (Anthropic, 2025). OpenAI states that business data from ChatGPT Business, Enterprise and the API is not used for training by default (OpenAI, Business data), while personal plans have data sharing on by default with an opt-out.
The control: client work runs on a business or API account, or on the client's own account. Never on a personal subscription you also use at home.
2. Two clients in the same conversation
The quieter risk. A chat history where client A's margin sits next to client B's payroll is a confidentiality breach waiting for a screenshot, and it also degrades the answers: the assistant mixes contexts.
The control: one project or workspace per client in the assistant, one folder per client on disk, and no cross-client question that carries figures.
3. Copies that outlive the engagement
Exports in your downloads folder, uploaded files in the assistant, a model in your account. When the engagement ends, the client expects their data to leave with them.
The control: an offboarding step written into the policy (delete the project, the uploads and the local files, remove your access, hand over a working file) and a short confirmation to the client that it is done.
Financial data is the category that most often leaks this way. In one analysis of 22.4 million enterprise prompts and uploads in 2025, financial data was the largest category of sensitive information detected, at 16.6% of exposures (Harmonic Security, 2025; vendor telemetry, not a representative panel). More figures with their scope are on our AI financial model risk statistics page.
The One-Page AI Policy per Client
Write it at onboarding, agree it with the founder or the finance lead by email, file it with the engagement letter. It takes 15 minutes once you have the template. Here is one you can copy.
AI use policy: [Client name] Agreed on [date] between [Client] and [Fractional CFO / firm]. Reviewed at each renewal.
- Data in scope. AI tools may process: [general ledger exports / management accounts / bank transactions / payroll totals only]. AI tools will not process: [individual salaries / customer personal data / deal documents / none excluded].
- Tools and tier. [Claude Team / ChatGPT Business / API under a data processing agreement / the client's own account]. No consumer or personal plans.
- Whose account. [Client-owned seat, CFO as user / CFO's business account, client informed].
- Connections. Ledger and bank access is [read-only / export only]. No AI tool posts entries in the client's ledger.
- Training and retention. The provider's terms for this tier state no training on the data by default and a retention of [X days per the provider's terms]. Link to the provider's page.
- Separation. The client's data is kept in a dedicated project and folder, never shared with another client's.
- Review. Every figure that reaches a deliverable is checked by the CFO against the source. AI drafts, the CFO signs.
- Exit. At the end of the engagement, the CFO deletes AI projects, uploads and local copies, removes their access, and hands over a working Excel model.
Two notes on using it. Write the policy per client, even when three of them end up identical: the fourth will not be, and the habit is what protects you. And keep the wording plain. A founder should be able to read it in two minutes and say yes.
A Clause for the Engagement Letter
The policy is the working document. The engagement letter needs one clause that points to it. A starting wording, to adapt with your own counsel (this is not legal advice):
The Consultant may use artificial intelligence tools to assist in delivering the Services, limited to business or enterprise tiers whose terms exclude the use of Client data for model training by default, or to accounts provided by the Client. The data in scope, the tools used and the retention terms are set out in the AI Use Policy agreed between the parties, which the Client may amend at any time by written notice. The Consultant remains responsible for all deliverables and reviews every figure before it is provided to the Client. On termination, the Consultant will delete Client data held in such tools and confirm the deletion in writing.
Two details matter. "May amend at any time" lets a cautious client start narrow and widen later, which is how most of them end up. And "remains responsible" says the obvious thing out loud: the AI does not dilute your accountability.
How to Ask a Client Who Has No Rules
A general question gets a general answer, often "no". A specific one usually gets a yes, because it shows you have already thought about the risk.
Compare:
- "Is it OK if I use AI on your numbers?"
- "I would like to use Claude on a business account, whose terms exclude training on your data, to draft the monthly commentary from your management accounts. Payroll detail stays out. Every figure is checked by me against the ledger. Here is the one-page policy."
The second one names the tool, the tier, the data, the retention and the control. It also creates the written record that the AICPA interpretation, and most clients' auditors, will look for. The same approach works with ChatGPT Business or any assistant on a business tier: the client is agreeing to the terms, not to the brand.
Four Set-Ups That Fit a Strict Client
When the client says "be careful" or the contract restricts AI, ranked from the most to the least AI in the workflow.
- The client's own account. The client pays for the seat, you are a user on it. The data never leaves the client's tenancy, and when you leave, they remove you. This is the cleanest answer for PE-backed clients with an existing AI policy.
- Your business account, documented. A commercial tier with a data processing agreement, named in the policy, with the provider's retention terms attached. This covers most "no consumer tools" clauses.
- Structure without data. Use AI to build and maintain the model's structure (the formulas, the links between the P&L, cash flow and balance sheet, the timeline, the conventions) on placeholder figures. Load the client's actual values in a step no AI sees. Confidentiality attaches to the client's numbers, not to the fact that interest is computed on average debt.
- AI on the method only. No client data in any AI tool. You still use AI for your own templates, checklists, generic formula questions and drafting from your own notes. For the strictest clauses, including local models, see Your Client's Contract Says No AI.
Set-up 3 is the one most often missed, and the one that keeps most of the value. It works with a blank workbook. It works better in a tool where structure and data are genuinely separate objects.
For Firms With Several CFOs
A firm adds one layer: the policy has to hold when a different CFO picks up the client, or covers a holiday.
- A register. One line per client: policy date, tier, data in scope, exit status. A partner should be able to answer "what is our AI set-up at this client?" in ten seconds.
- No personal accounts on client work. The firm provides business accounts, or uses the client's. This also settles who pays for the tools.
- The method is shared, the data is not. Conventions, templates, prompts and checklists travel between CFOs and clients. Client data stays in the client's space. The same split for a solo practice is described in GitHub for Fractional CFOs, and the full tool picture, layer by layer, in The Fractional CFO Tech Stack.
- Offboarding is a checklist, not a memory. Same steps at every client, signed off by the partner.
Where Layerz Fits
Layerz is a structured spreadsheet, ready for AI. It keeps the structure of a financial model (the formulas, the timelines, the links between the statements) separate from each client's data. One structure travels between clients; the values stay in each client's own model. That is set-up 3 above, as the default shape of the work rather than a discipline to hold by hand.
Layerz does not send model content to AI providers and does not train any AI model on your data. AI processing happens only when you connect your own agent, such as Claude, under your own account and your agreement with that provider. The details are on our trust page. Every model exports to Excel with formulas intact, so the client keeps a working file when the engagement ends.
It is free for one person working alone, with unlimited models: one per client, as many clients as you have.
FAQ
How do fractional CFO firms handle confidentiality around financial data? Per client. Each client gets a short written AI policy (data in scope, tools and tier, whose account, retention, review, exit), a clause in the engagement letter that points to it, a dedicated project for their data, and an offboarding step that deletes what the CFO holds.
Can a fractional CFO use ChatGPT or Claude with client financial data? Yes, if the client's contract allows it and the work runs on a business or API tier, or on the client's own account. Both Anthropic and OpenAI state that business data is not used for training by default. Personal plans are the risk: they are the tier most confidentiality clauses target.
Do I need client consent to use AI? If the contract requires it, yes. If the contract is silent, ask anyway, specifically, and keep the answer in writing. For US CPAs, AICPA Interpretation 1.700.040 already expects either a confidentiality agreement with the provider or the client's specific consent.
What should a fractional CFO AI policy include? Eight points fit on a page: data in scope, tools and tier, whose account, ledger connections and their scope, training and retention terms, separation from other clients, human review of every figure, and the exit procedure.
What if the client bans AI completely? Then no client data goes into an AI tool. You can still use AI on your own method (templates, checklists, generic questions) and, where the clause allows it, on a model structure that holds no client figures.
The Takeaway
Many clients have not written their AI rules yet. That is not a reason to wait, and it is not permission either. It is a question nobody has asked them, and the fractional CFO is the person best placed to ask it.
Write the page. Name the tier. Keep each client in its own space. Delete what you hold when you leave. And keep your signature on every number, whoever drafted it.