Five tasks that take time in a law and accounting firm
This article is part of the series «AI for business by industry». It answers the same five questions as the others, but for a firm that works with other people's data the fourth question ("what not to do") decides everything else. Typical tasks:
- Letters to clients. Explanations, reminders about deadlines, cover letters for documents.
- Drafts of standard documents. Contracts, claims, powers of attorney, explanations to returns, internal memos.
- First-pass analysis of a request. What the client asks for and which documents are missing to begin.
- Website and social texts. Service descriptions, answers to "what is…".
- Internal instructions. A month-end checklist, the procedure for receiving documents, regulations.
Tasks 1, 2 and 5 can be done entirely without any information about a client: a template with blanks is enough. Task 3 touches data, so the line runs through it.
What Article 22 of the Law on the Bar says
Article 22 of the Law «On the Bar and Practice of Law» defines attorney-client privilege broadly. It is "any information that became known to the lawyer" about the client, the questions the client turned to the lawyer about, the content of advice and consultations, documents drawn up by the lawyer and information held on electronic media. That is enough to assess a typical paste into a chat: "client Petrenko is suing the landlord under this contract, here are the terms" is exactly what the law calls privileged.
For a firm that is thinking about an assistant, four parts of the article matter:
| Part | What it establishes | What follows for AI |
|---|---|---|
| 1 | Privilege is any information about the client and the content of advice, not only "secret" documents | Anonymisation must remove everything by which the client can be recognised, not only the surname |
| 2 | Information may lose the status of privilege on the client's written statement | "The client did not object" is not a written statement |
| 3 | The duty extends to the lawyer, assistant, trainee and the bureau's employees; the bureau must ensure conditions that make third-party access impossible | The assistant's vendor is a third party; the duty to make access impossible lies with the firm |
| 6–8 | Passing information within anti-money-laundering legislation is not a breach of privilege; there is a separate procedure about trusts under the Tax Code | These are exceptions defined by the law, not by the assistant; the lawyer applies them |
We draw a cautious conclusion from part 3. The law does not name chat assistants. But it requires the bureau to make third-party access "impossible", not to "minimise" it. A public chat service with no contract, an unknown place of storage and vendor staff entitled to read conversations does not meet that condition. Whether a specific corporate plan with a contract does is a question for the firm's lawyer and the vendor's terms; we do not decide it for the reader.
Three classes of data: what falls into which cell
It is easier to decide by what actually goes into the assistant than by the task.
✓ — allowed; ≈ — allowed on a condition; ✗ — do not give to a chat assistant. The classification is ours, built on the norms we refer to; it is not legal advice.
Class 2 is the trickiest. Anonymising a text so that the client cannot be recognised is harder than removing a surname: an unusual sum, a rare event, a place name or a date can give them away. So the rule is practical: if the anonymised text still contains something that would let an outside colleague name the client, it is class 3.
Accounting: other people's personal data and other people's commercial information
An accounting firm has no attorney-client privilege. In the texts we checked for this article there was no separate norm on "accountant's confidentiality"; we did not read the Law on Accounting on this subject, so we leave the question open. That does not mean data may go unprotected. Three things apply.
Personal data of the client's employees. A payroll sheet, a timesheet, a full name with a tax number are personal data. Under Article 4 of the Personal Data Protection Law the controller may entrust processing to a processor "under a contract concluded in writing", and the processor may process data "only for the purpose and in the scope defined in the contract". An accounting firm usually acts as a processor under its contract with the client. The law does not say whether a processor may pass data on to an assistant's vendor. This is our reading: such a transfer needs a direct permission in the contract with the client, otherwise it goes beyond the defined purpose and scope.
Transfer abroad. Article 29 allows transfer to foreign entities "only provided the state ensures adequate protection". States of the European Economic Area and states that signed the Council of Europe Convention on the protection of individuals with regard to automatic processing of personal data are deemed to ensure an adequate level. Where the service physically stores data and which of these categories its state falls into must be established before connecting, not after.
The client's commercial secret. Under Article 505 of the Civil Code a commercial secret is information that "has been the subject of measures adequate to the circumstances to keep it secret, taken by the person who lawfully controls it". Financial statements, pricing terms and counterparties that the client marked confidential are exactly such information. Passing them to third-party services without the client's consent risks the client saying that it took sufficient measures and you broke them.
Can I paste this text into a chat assistant
Before every paste the employee answers four questions. If the answer to any is "yes", the text does not go into the chat in its original form.
- Does the text contain names, company names, tax numbers, account and case numbers, addresses?These are the marks by which the client or the client's employees are recognised. Yes → replace with roles or placeholders, then check again
- Is the text case material: a client's letter, contract, statement or payroll sheet?This is class 3, and anonymisation does not save it, because the document is itself the information. Yes → do not paste; work in the firm's system
- Is there a contract with the service vendor and the client's permission for such a transfer?Without a processing contract (Article 4) and the client's permission, on our reading the transfer goes beyond the defined purpose and scope for an accountant, and for a lawyer it does not meet part 3 of Article 22. No → classes 2 and 3 are closed completely
- Will the answer go to the client or to court without a person checking it?The assistant may name a norm that does not exist or has changed. Yes → check each norm using the four steps below
Checking a norm in four steps
An assistant writes references to articles easily and with a confidence that does not depend on whether they are correct. We did not measure how often it errs on Ukrainian norms: we have no such measurement, and there will be no figures here. But the order of checking does not depend on that.
- Find the law by name and number on zakon.rada.gov.ua, not by the assistant's quotation. Open the current version.
- Find the exact article and part. An assistant often names the right article with the wrong part or paragraph.
- Look at the editorial marks in the text. The law shows when a part was added or changed. For example, in Article 22 of the Law on the Bar parts six and seven are in the version of Law No. 2571-IX of 06.09.2022 and part eight was added by Law No. 2970-IX of 20.03.2023. An answer based on an older version will not show this.
- Compare the words. If the assistant puts a quotation in quotation marks, find it in the text verbatim. If the words are not there, it is a paraphrase and carries the force of hearsay.
Check separately that the norm has not lost force and whether there are transitional provisions. For resolutions, orders and tax clarifications step 1 is the same, but look for them on the authority's official site.
Document templates: what is safe
The safe form is a document with blanks for the variable parts, which a person fills in their own system, not the assistant.
| Task | What to give the assistant | What stays in the firm's system |
|---|---|---|
| Service contract | The structure of sections, wording of the subject and the acceptance procedure without the parties | Parties, details, sums, special terms |
| Claim | A frame: ground, demand, deadline, reference to a norm (the lawyer checks it) | Facts of the dispute, evidence, sums |
| Letter about missing documents | A standard list and a polite form | The client's name, the period, what exactly is missing |
| Month-end checklist | A general list of steps | Funds, balances, counterparties |
The lawyer checks and signs the finished document personally. The assistant is responsible neither for the content nor for the norm.
What it costs
According to the ChatGPT pricing page on 17 October 2026 a Business standard seat costs $20 a month billed annually and $25 billed monthly; the plan is for teams of 2 to 200 people and data on it is not used for training by default. The Claude team plan, according to the Anthropic pricing page, has the same $20 and $25 for a standard seat for teams of 2 to 150 people, and also states "No model training on your content by default". The National Bank of Ukraine rate on 17 October 2026 is UAH 44.8871 per dollar. VAT that may be added is not included: according to the Anthropic page, prices are shown without tax.
$25 × number of seats × 44.8871 UAH. Billed annually ($20 a seat): UAH 1,795, 2,693, 4,489 and 8,977 a month. ChatGPT and Claude prices checked on 17 October 2026; the minimum for both plans is 2 seats.
A conditional example of how to count the payback. Suppose an hour of a lawyer's or accountant's work costs the firm UAH 600 (a conditional number; insert your own). A $25 seat is UAH 1,122 a month, so it pays back when it saves 1,122 ÷ 600 ≈ 1.9 hours a month. Billed annually ($20, UAH 898) — 1.5 hours. If in a month the assistant has not saved even two hours per person, the plan is not needed.
What not to do
- Do not paste case materials and a client's source documents into the assistant, even "just to shorten".
- Do not use a free or personal plan for client data. Corporate promises of "no training by default" refer to business plans, not personal ones.
- Do not send a client text in which a norm has not been checked. A quotation in quotation marks must be found in the law verbatim.
- Do not assume that "we turned training off" settles the matter. Article 22 requires making third-party access impossible, not turning off one function.
- Do not agree with the client after the first paste. If you want to use the assistant with a client's data, the permission is needed before it.
General rules for all industries are in the article on data for an AI assistant.
First step for one week: a library of templates
This task lies entirely in class 1: it has no client in it, and the effect is visible in a week.
- Choose the five documents you write most often. From your own archive, with no information about the parties.
- Ask the assistant to make a frame for each with blanks in square brackets, and add to each blank a hint about what the person puts there.
- The lawyer or accountant checks the frames and strikes out everything that sounds like a conclusion on the merits or a norm not found in the law.
- Measure the time. How many minutes a draft of such a document takes before and after. Measure on five real cases, do not estimate.
- Collect the frames in one place in the firm. Assistants take a template from there and enter the data in their own system.
Our position
A law and accounting firm needs an assistant for templates, drafts and internal regulations, not for working with a client's materials. Class 3 is not passed under any conditions, class 2 only on a business plan and only after checking that the client cannot be recognised, and every norm is checked by a person against the text of the law.
The position does not apply if the firm has a contract with the vendor that meets the requirements of Article 4 of the Personal Data Protection Law, the client's written permission for such a transfer, an established place of data storage and a lawyer's opinion on Article 22 for a law bureau. Then the decision is made on those documents, not on the rule of this article. For a small firm that has none of this, the rule "the case and the source documents do not go into the chat" remains the only safe one.
Checked on 17 October 2026 against the texts of the laws on zakon.rada.gov.ua: the Law «On the Bar and Practice of Law» (Article 22), the Law «On Personal Data Protection» (Articles 4 and 29, version of 14.06.2025), the Civil Code (Article 505); prices — on the ChatGPT and Claude pricing pages; exchange rate — National Bank of Ukraine on 17 October 2026. This article is not legal advice; the question of the basis for transferring data in a specific firm is decided by a lawyer.