Copilot for accountants and bookkeepers

What the job actually is

A practice spends its week on the same kinds of tasks: coding a bank export, explaining a variance, chasing a missing invoice, turning last year's management letter into this year's, and writing down what was agreed on a call. Those tasks already sit in Excel, Outlook, Word and Teams for firms that run on Microsoft 365. Microsoft's description of Copilot is that a prompt in an app can be grounded in email, chats and documents the signed-in person is allowed to open, and that the service cannot see the rest of the tenant¹. That is a good fit for a file, and a bad fit for a shared drive where every staff member can open every client.

Personal information, in the Privacy Act 2020, means information about an identifiable individual². A company is not an individual. A client file still usually contains information about people: a sole trader, a director, employees on a payday file, a beneficiary of a trust. Those people are covered. The Office of the Privacy Commissioner expects a human to check generative output before an agency acts, because the tools make confident mistakes³. In a practice, acting means sending a number to a client, to Inland Revenue, or into a set of accounts.

MBIE's guidance for businesses is voluntary, and it is written for sole traders and small firms as well as larger ones. It says a business that handles personal information needs a privacy officer, and that AI inputs and outputs are part of that handling⁴. A two-partner practice in a regional town is an agency under the Privacy Act 2020². It does not get a smaller Act.

Excel is the tool to learn first

Microsoft's Copilot in Excel page says the feature uses Excel's own tools, including tables, charts, PivotTables and formulas, and that the workbook stays editable⁵. It can add or change cells, build formulas across sheets, highlight outliers, sort and filter, and pull data from other workbooks stored in OneDrive or SharePoint, or on the computer. It can also fetch material from the web. For a bookkeeper, the useful part is the formula and the chart. The risky part is the sentence that says Copilot can generate data based on the prompt. Generated data is not a trial balance.

The same page describes three modes. Edit mode changes the workbook and is the default. Plan mode writes a plan you can read before anything is edited. Chat mode answers from the workbook and does not change it⁵. A reviewer who is checking a client's sales extract should start in chat mode or plan mode. Edit mode is for a working copy, after the source file has been saved somewhere the model cannot overwrite. If Copilot is missing from the ribbon, Microsoft says it may not be in the subscription or it may be switched off for the organisation. That is an admin question, not a reason to paste the extract into a personal chatbot.

Ask for work a second person can audit. Useful prompts name the sheet, the columns and the comparison: this year's month column against last year's, differences above a threshold the firm sets, a PivotTable by customer, a formula that does not hide the calculation. Then open the formula. If the narrative says a margin moved and the cells do not, the narrative is wrong. The Privacy Commissioner's accuracy warning applies to a management report as much as to a letter³. Principle 8 of the Privacy Act says personal information is not to be used or disclosed without reasonable steps to see that it is accurate, complete and not misleading². A chart of a sole trader's takings is that kind of information.

• Keep the source export read-only. Let Copilot work on a copy⁵.
• Prefer chat mode or plan mode when the workbook is the client's record.
• Do not accept a total you cannot trace to cells.
• Turn off web search for workbooks that contain client names or pay details, unless the firm's privacy assessment allows it⁶.

Email, letters and meeting notes

Microsoft's architecture page includes email and chats in the material Copilot may use, still limited to the signed-in person¹. A long thread about a disputed invoice can be summarised so the manager sees the dates and the open question. The summary is a reading aid. The email that goes back to the client should be written or edited by someone who is allowed to give that answer. Do not let a draft promise a deduction, a filing date or a fee outcome that the file does not support.

Word is the same pattern. A prior-year management letter or engagement checklist that the person can open is a legitimate source for a first draft of this year's version¹. The draft has to be read against the current standard, the engagement terms and the client's facts. Copilot does not know which clause the firm retired in the spring. A partner or a senior does.

Meeting notes need the same discipline. A recap of a planning call is useful if the actions are checked by someone who was there. It is a poor record if clinical, family or dispute detail was discussed and the note is then dropped into a channel the whole firm can read. Principle 5 requires reasonable safeguards against unauthorised disclosure². The safeguard in Microsoft 365 is the permission on the team and the site, which Copilot will follow rather than repair¹.

Client files and who can see them

The professional risk is not that Copilot breaks into a locked library. Microsoft says it cannot¹. The risk is a library that was never locked. A site created for one job and left open to everyone, a mailbox delegated too widely, a working-paper folder shared with the whole practice: Copilot will treat that sharing as permission. Before a licence is handed to a graduate, a principal should look at the sites that hold tax workpapers, payroll and trust files.

Labels help when they are applied. Microsoft says Copilot can inherit sensitivity labels and retention settings where the subscription provides them⁷. A label that says a payroll workbook is restricted is only useful if the workbook actually has the label, and if the admin policy stops Copilot from using that label as grounding. MBIE tells firms to classify information so they know what is personal before an AI system sees it⁴. In a practice, the classes are simple enough to write down: client working papers, staff files, the firm's own finance, and public templates.

Unique identifiers need a short note. Principle 13 limits how an agency assigns its own identifiers, and it says an agency must not require a person to disclose an identifier another agency assigned, unless the disclosure is for the purpose of that identifier or a directly related purpose². Principle 13 also requires reasonable steps to minimise misuse of identifiers, and gives truncation as an example². An IRD number collected for tax is not material for a sample file. Truncate identifiers in training exercises. Use fictional names. The NCSC guidance on using AI securely says staff must be trained on what they may and may not enter⁸.

• List the libraries that hold client work and confirm they are not open to the whole practice.
• Use fictional or truncated files in training sessions⁸.
• Keep staff HR and pay folders out of any team the wider practice can search.

The privacy steps that belong in the engagement

The Commissioner expects senior approval, a privacy impact assessment, a plain explanation when a use will affect a client, and a bar on putting personal or confidential information into a tool unless it is confirmed that the provider does not retain or disclose that input³. For Copilot under Microsoft's enterprise data protection terms, Microsoft says prompts, responses and Graph data are not used to train foundation models, and that Microsoft is a processor under the Data Protection Addendum⁷. That confirmation is about those Copilot offers. It is not a confirmation about a free chatbot tab, and it is not a confirmation about web search.

Web queries sent from Copilot go to Bing without user and tenant identifiers, and Microsoft says the Data Protection Addendum does not cover them⁶. A prompt that includes a client's name and a dispute about their account can still produce a query that should never have left the practice. Admins can switch web search off. Do that for anyone who works in client files, and review it only if the privacy officer writes down why a particular team needs the open web.

Overseas storage is the other record to keep. Information privacy principle 12 restricts disclosure of personal information to a foreign person or entity unless a listed condition is met, including a contract that gives comparable protection². Microsoft lists New Zealand as a Local Region Geography, with an Auckland data centre, but the standard Product Terms commitment for where Copilot data rests does not include New Zealand. Advanced Data Residency is the add-on that can commit Copilot and Copilot Chat data to that local region⁹. The practice's Microsoft admin can read the Data Location Card. The privacy officer should file a copy with the assessment. A firm that advises clients on cross-border tax should be able to answer the same question about its own tenant.

The Government Chief Digital Officer tells agencies not to put personal information into a public generative system¹⁰. A private practice is not a department, but the same bar fits a personal login. The National Cyber Security Centre warns that generative tools make phishing and impostor scams more convincing¹¹. Accounts staff pay those invoices. A rollout that never mentions a changed bank account is incomplete.

A week-one routine for a practice

Pick one team, not the whole firm. A management-accounts group, or the bookkeepers who already live in Excel, will show you more than a licence for every director. Give them chat mode and plan mode on real, non-sensitive work first: a firm overhead workbook, a public template, a procedures note. Move to a single client only after the site permissions for that client have been checked¹. Agree the questions they will ask, and agree that every figure in a client email is traced.

Write five lines into the staff manual. Copilot in the Microsoft 365 apps is allowed for the tasks on the list. Personal chatbot accounts are not allowed for client or staff information¹⁰. Web search stays off for client work⁶. Output is checked before it is sent³. A suspected leak is reported the same day, so the privacy officer can decide whether the Privacy Act's notifiable-breach rules apply². Section 114 requires notice to the Commissioner as soon as practicable after becoming aware of a breach that has caused or is likely to cause serious harm, and section 115 requires notice to the person affected, subject to the Act's exceptions².

Count how many drafts were used and how many errors were caught. MBIE's AI strategy says many New Zealand organisations are still early, and that larger businesses are further ahead than small ones¹². Stats NZ has paused the Business Operations Survey and, with MBIE, is asking about AI use in a 2026 survey¹³. The practice can finish its own note before that release.

When the routine holds, widen it. The next group might be the people who write engagement letters, or the people who prepare board packs from a checked workbook. Agents and Copilot Studio are a later decision, for a question the team asks every day and for content you have approved as a source. They are not week one. Week one is a checked formula, a checked email, and a library that does not show one client's pay to another client's team.

• One pilot team, one class of file, one named reviewer.
• Source exports stay intact. Copilot works on a copy⁵.
• The privacy officer sees the Data Location Card before client content is in scope⁹.
• Phishing practice sits beside the Copilot practice, because impostor payment requests are part of the same month¹¹.