Ongoing fee consents and AI data leakage: what a fee arrangement gives away in ChatGPT or Claude.

Every year an adviser with an ongoing fee arrangement has to ask the client to consent again, in writing, with the fee, the services and the account the fee comes out of spelled out. The wording repeats from client to client, so staff paste the form into ChatGPT or Claude to fill it in or tidy it. A consent and fee schedule is more than boilerplate. It names the clients, the fee, the superannuation member number the fee is taken from and what the practice did for the money. This page marks every item in an invented consent that the Corporations Act, the Code of Ethics and the Privacy Act bear on, and shows the same document prepared on Ermos inside the practice.

The ongoing fee consent

Prepared before each anniversary of an ongoing fee arrangement entered into on or after 10 January 2025. ASIC’s INFO 286 says the client must give written consent to renew within a window that opens 60 days before the anniversary (or an agreed earlier reference day) and closes 150 days after it, and that the arrangement ends if consent is not renewed in time.

An invented consent. The super member number, phone number and amounts are placeholders. Hover or tap any highlighted item for the analysis; the full list is below.

What leaves the practice

1. 1
   The clients

   Two named individuals tied to a fee arrangement. Personal information under the Privacy Act, where the Act applies to the practice. Privacy Act guide.

2. 2
   The fee

   What the clients pay each year and how it is charged. ASIC’s INFO 286 lists the amount and frequency of each ongoing fee among the things that must be disclosed in writing before consent. Standard 7 of the Code of Ethics requires the adviser to be satisfied that fees are fair and reasonable and represent value for money, and it is commercial information about the practice.

3. 3
   The account the fee comes out of

   A superannuation fund and member number with the amounts and dates of each deduction. INFO 286 says consent to deduct from a client account must state the account holder, the account number and each amount, and says a super trustee may charge ongoing advice fees to a member only if the consent obligations are met, citing section 99FA(1)(d) of the SIS Act. A member number identifies the account to anyone who contacts the fund. Privacy Act guide.

4. 4
   The services entitled to and received

   What the practice will do and did do for the money, including underwriting liaison for a client’s income protection. It reveals insurance work that follows a health condition. Health information is sensitive information under the Privacy Act. Patient data guide.

5. 5
   The commission

   A benefit the practice received from an insurer in connection with acting for the clients. Standard 7 requires the client’s free, prior and informed consent to all benefits the adviser and the principal receive, and the figure is commercial information about the practice.

6. 6
   The dates and the consequence of not renewing

   The anniversary day, the consent window and the end date. INFO 286 says the window opens 60 days before the anniversary (or an agreed earlier reference day) and closes 150 days after it, and that the arrangement ends if consent is not renewed. The rule is public, and the arrangement’s own dates say when this one ends.

7. 7
   The adviser and the contact details

   Ties the document to a named adviser bound by the Code of Ethics, with a direct line.

8. 8
   The client’s rights wording

   Standard wording about ending the arrangement, withdrawing consent and record keeping. INFO 286 describes the right to end an arrangement at any time in writing and says records of consents are kept for at least five years under regulation 7.7A.11AA. It contains no client information.

What happens in Frontier Models (ChatGPT, Claude)

• The whole document is transmitted to the provider’s servers. On personal plans the user cannot choose where it is stored or processed, and for the major providers that has generally meant outside Australia, under that country’s legal process. Some business plans offer storage in Australia, but the provider still receives the content.
• On consumer tiers, prompts can be retained and used to train future models.
• The provider’s staff and systems can reach the content under the provider’s own policies.
• Once sent, the practice no longer controls it. Retention and deletion happen on the provider’s terms.

The same document on Ermos

Part of AI data leakage in financial advice practices. See how this works in practice: Client correspondence on Ermos.

Common questions