BAS workings and AI data leakage: what a quarterly GST spreadsheet gives away in ChatGPT or Claude.

BAS workings are the spreadsheet an accounting firm opens most often and thinks about least. Each quarter a preparer exports sales, purchases and payroll into a workbook, adds adjustments and notes, and then pastes it into ChatGPT or Claude to check the arithmetic or draft the cover email. The file holds the client’s customers, suppliers, wages and cash position, with the reviewer’s candid comments beside them. This page marks every item in a routine quarterly BAS workbook that APES 110, the TPB Code and the Privacy Act bear on, shows which items are harmless to share, and shows how the same check runs on Ermos inside the practice.

The BAS workings spreadsheet

Prepared each quarter once the bank feeds are reconciled and before the activity statement is lodged. The September quarter BAS is due on 28 October, with extra time through a registered agent for eligible clients, which the ATO sets at 25 November in 2026.

An invented workbook. The ABN is the ATO’s published example value. Hover or tap any highlighted cell for the analysis; the full list is below.

What leaves the firm

1. 1
   The client, the ABN and the file itself

   Names the business behind every figure. The ABN is public on ABN Lookup, but beside the figures it ties them to one entity. A workbook also carries author, company and last-saved-by fields, and any hidden tabs or columns, whenever it is shared as a file. APES 110 confidentiality guide.

2. 2
   Which customer and how much

   Customer names and their share of sales. Confidential financial information acquired in the professional relationship under APES 110 R114.2, and exactly what a competitor would want to see. APES 110 confidentiality guide.

3. 3
   A fall in sales and a third party’s administration

   The client’s trading decline and the name of a company in administration that is nobody’s client here. Information about the client’s affairs that the TPB Code (item 6) says must not go to a third party without the client’s permission. TPB Code guide.

4. 4
   Supplier, terms and credit limit

   The client’s trading terms and a note that its credit limit is under review. Commercial information a supplier or a lender would value. APES 110 confidentiality guide.

5. 5
   A director’s private use and an employee’s vehicle

   The percentage of a named director’s private use, and a named employee whose vehicle is under review for fringe benefits tax. Personal information about two individuals. Cell comments attached to a figure travel with the file in the same way. Privacy Act guide.

6. 6
   The tax invoice rule

   The ordinary GST rule that a tax invoice is needed to claim a credit on a purchase over $82.50 including GST, which the ATO publishes. The wording contains no client data, so sending it exposes nothing.

7. 7
   Named employees, back pay and director fees

   An underpayment and a director’s fees with no tax withheld, each tied to a name. Personal information, and the second is a compliance point the ATO will see in the payroll data. Privacy Act guide.

8. 8
   The instalment variation and the reason

   The client’s own forecast of its income and why it has fallen. Confidential, and information about the client’s affairs under TPB Code item 6. TPB Code guide.

9. 9
   The amount payable and the clash with the payment plan

   What the client owes the ATO this quarter, and that it cannot meet that payment and the plan instalment. The most sensitive line in the workbook. The total is also a calculation, and a person has to check it against the ATO account whoever drafted it. Checking AI output guide.

10. 10
    The preparer and the reviewer

    Ties the workings to the people who signed them off. BAS services provided for a fee or other reward generally require TPB registration, although an employee or contractor of a registered agent who does not provide services in their own right does not need to register. The names tie the workings to the registered agent responsible for them and make any leak traceable to the practice. TPB Code guide.

What happens in Frontier Models (ChatGPT, Claude)

• The whole document is transmitted to the provider’s servers. On personal plans the user cannot choose where it is stored or processed, and for the major providers that has generally meant outside Australia, under that country’s legal process. Some business plans offer storage in Australia, but the provider still receives the content.
• On consumer tiers, prompts can be retained and used to train future models.
• The provider’s staff and systems can reach the content under the provider’s own policies.
• Once sent, the firm no longer controls it. Retention and deletion happen on the provider’s terms.

The same document on Ermos

Part of AI data leakage in accounting firms. See how this works in practice: Workpaper review on Ermos.

Common questions