Statements of Advice and AI confidentiality: what an SOA gives away in ChatGPT or Claude.

The Statement of Advice is the document the Corporations Act requires for personal advice to a retail client, and the one advisers most want help writing, because it is long and structured and the drafting is slow. It is also the whole client in one place: position, goals, health, the recommendation and what it costs. This page marks every item in a routine SOA that the Code of Ethics, the Corporations Act and the Privacy Act protect, and shows how the same SOA is drafted on Ermos inside the practice.

The Statement of Advice

Prepared after the fact find and strategy work. Section 946A of the Corporations Act requires one for personal advice to a retail client, subject to some exceptions. Section 946C requires it to be given when the advice is provided or as soon as practicable afterwards, and in any event before any further financial service that arises out of or is connected with that advice.

Statement of Advice
Prepared for Tom and Lucy Harrington¹ by Nadia Reyes, Harbourview Wealth Partners, AFSL 123456⁹ · 24 October 2025

Your situation. Tom, 46, is a project manager at Coastline Developments earning $168,000. Lucy, 44, works three days a week as a physiotherapist earning $74,000. You own your home at 9 Seaview Road, Freshwater, valued at $2.4 million with a mortgage of $610,000. Tom’s superannuation balance is $412,000 with Southern Cross Super; Lucy’s is $186,000 with Lighthouse Retirement Fund.²

Your goals. To clear the mortgage before Tom turns 55, to fund two children through private school to 2034, and to protect the household if either of you cannot work. You have told us you are worried about Coastline’s financial position after it lost a major contract in July.³

Health and insurance. Lucy was treated for a thyroid condition in 2023 and takes daily medication. Tom reports no health conditions. Neither of you holds income protection outside superannuation.⁴

Our recommendation. Consolidate Lucy’s superannuation into Southern Cross Super; apply for income protection of $9,500 per month for Tom and $4,300 for Lucy with Meridian Life, held through superannuation; and increase salary sacrifice for Tom to $12,000 per year. We considered keeping Lucy’s fund and rejected it because its insurance would lapse at 50.⁵

Why this is in your best interests. The income protection addresses the risk you identified as your greatest concern. The consolidation reduces fees by approximately $1,100 per year on current balances. The salary sacrifice uses Tom’s unused concessional cap at a tax saving of approximately $2,800 per year.⁶

Fees and benefits. Our advice fee is $3,300 including GST. Meridian Life will pay the practice a commission of 60% of the first year’s premium and 20% of renewal premiums. The ongoing advice fee is $4,400 per year, reviewed annually with your consent.⁷

This advice is based on the information you gave us at our meetings on 2 and 16 October 2025. If any of it is inaccurate or incomplete, the advice may not be appropriate for you.⁸

An invented Statement of Advice. Hover or tap any highlighted item for the analysis; the full list is below.

What leaves the practice

The clients

Two named individuals. Personal information under the Privacy Act, and the key that ties everything below to real people. Privacy Act guide.

Frontier Models (ChatGPT, Claude)	Transmitted to the provider, generally offshore on personal plans
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

Income, home, mortgage and superannuation balances

A household’s complete financial position, with an address. Financial information the practice holds under Standard 8 and the Privacy Act, and the material identity fraud and targeted scams are built from. Privacy Act guide.

Frontier Models (ChatGPT, Claude)	A household’s complete finances transmitted
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

Goals and a confided worry

What the clients want and what they fear, including a concern about an employer’s solvency that names the employer. Confidential, and sensitive to a third party. Privacy Act guide.

Frontier Models (ChatGPT, Claude)	A confided fear, naming an employer, transmitted
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

A health condition

A diagnosis and medication. Health information is sensitive information under the Privacy Act, with stricter rules on collection, use and disclosure. Patient data guide.

Frontier Models (ChatGPT, Claude)	Sensitive health information transmitted; on consumer tiers it can train future models
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

The recommendation and the alternatives considered

The advice itself, including products, amounts and the option rejected. The work the client is paying for, and part of the record a licensee must keep under ASIC’s record-keeping instrument to show the best interests duty in section 961B was met.

Frontier Models (ChatGPT, Claude)	The advice transmitted before the client has read it
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

The reasoning

Why the advice is in the clients’ best interests, with figures. The practice’s professional judgement, written for one client.

Frontier Models (ChatGPT, Claude)	Your reasoning now on a third party’s servers
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

Fees and commissions

What the client pays and what the practice earns from the insurer. Disclosure the client is entitled to and a third party is not, and commercial information about the practice.

Frontier Models (ChatGPT, Claude)	Your commission arrangements transmitted
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

The basis of the advice

That the advice rests on particular meetings and information. Part of the record that protects the adviser if the client later disputes it.

Frontier Models (ChatGPT, Claude)	The protective record transmitted
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

The adviser and the licensee

Ties the SOA to a named adviser bound by the Code of Ethics and to the licensee responsible under section 912A.

Frontier Models (ChatGPT, Claude)	Transmitted, and the leak is traceable to you
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

What happens in Frontier Models (ChatGPT, Claude)

The whole document is transmitted to the provider’s servers. On personal plans the user cannot choose where it is stored or processed, and for the major providers that has generally meant outside Australia, under that country’s legal process. Some business plans offer storage in Australia, but the provider still receives the content.
On consumer tiers, prompts can be retained and used to train future models.
The provider’s staff and systems can reach the content under the provider’s own policies.
Once sent, the practice no longer controls it. Retention and deletion happen on the provider’s terms.

The same document on Ermos

Ermos Dominion

The document is drafted on a unit in your office, from your own templates and the client file. Every marked item stays on the unit, which keeps working with the internet switched off. Nothing in it is transmitted to an AI provider, so there is no disclosure to analyse: the confidentiality work is the same as for your file server.

Ermos Edge

Your documents, the index and your access boundaries stay on your own instance in an Australian data centre. When a staff member asks for this draft, only their question and the excerpts they are permitted to see go to a named Australian provider, who is contractually barred from keeping the content or training any model on it. Nothing is processed outside Australia.

	Frontier Models (ChatGPT, Claude)	Ermos Edge	Ermos Dominion
Where the document is processed	Provider servers, generally offshore on personal plans	Your instance in an Australian data centre; answers generated in Australia	The unit in your office
Who can read it	Provider staff and systems, under policy	Your staff, within the boundaries you set. The named Australian provider processes only permitted excerpts, under contract, and keeps nothing	Your staff only
Is it kept	On the provider’s terms	Kept on your instance; the provider is barred from retaining it	Stays on the unit
Can it train a model	On consumer tiers, yes	No, by contract	Only your own unit learns from it, on your hardware

Part of AI data leakage in financial advice practices. See how this works in practice: SOA drafting on Ermos.

Common questions

Do ChatGPT and Claude use the information in a Statement of Advice?

Yes, a pasted Statement of Advice is sent to the AI company's servers and processed there. As at October 2026, whether a conversation on a personal plan (ChatGPT Free, Plus or Pro; Claude Free, Pro or Max) can be used to train the models depends on a setting each user controls. Business plans (ChatGPT Business and Enterprise, Claude Team and Enterprise) and the developer APIs sit under commercial terms, and OpenAI and Anthropic each say they do not train on that content by default (OpenAI, Anthropic). On either product, the thumbs up and thumbs down buttons can send a whole conversation back for training. An SOA puts the household's balances, a thyroid condition and the commission arrangements in one document.

Can we use ChatGPT or Claude for a Statement of Advice if we remove the names?

No, because the rest of an SOA still identifies the couple. Removing names rarely makes a document anonymous. Information stays personal information while the person is reasonably identifiable, and the OAIC warns that information can be at risk of re-identification even when it has been de-identified or anonymised. The street address, the mortgage balance, two named super funds, a thyroid condition and a worry about an employer that lost a major contract in July fit only one household. The Office of the Australian Information Commissioner (OAIC) recommends in its guidance on commercially available AI products that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools, because of the significant and complex privacy risks.

Does a ChatGPT Business or Claude Team plan make it safe to use for a Statement of Advice?

Not on its own. A business plan changes the default on training, and the content still goes to the AI company. On a personal plan the user cannot choose where conversations are stored or processed. Some business plans let an organisation choose to store data at rest in Australia (OpenAI), which still leaves the content with the AI company. The OAIC's guidance also tells organisations to review carefully the terms and settings that will apply to their use of any AI product. For an SOA, the recommendation, the reasoning and the commission details would still arrive there before the client has read the advice. Our comparisons with ChatGPT Enterprise and Claude weigh the trade-offs.

How can an advice practice use AI for a Statement of Advice without sending it to ChatGPT or Claude?

Ermos is built so the document stays under your control. On the Dominion AI unit it is drafted inside your office and none of it is sent to an AI provider. On Ermos Edge your documents and index stay on your own instance in an Australian data centre, and only the question and the excerpts the user is permitted to see go to a named Australian provider that is contractually barred from keeping them or training any model on them. The SOA is drafted from the fact find and the practice's own template. The adviser checks every recommendation against the file and remains responsible for each one.

Can advisers use AI to draft Statements of Advice?

Drafting from templates is one of the better uses of AI, and the Corporations Act does not care which tool produced the document. The question is where the drafting happens. On an Ermos unit the SOA is drafted from the fact find and the practice's templates on hardware in the office, and nothing in it leaves. The adviser still owns every recommendation, as Standard 5 and section 961B require.

Is an SOA covered by the Privacy Act?

It is full of personal information, and the health section is sensitive information, which the Act protects more strictly. Disclosure to an overseas AI provider engages APP 8, the cross-border disclosure principle, as well.

What about the Client Advice Record reforms?

The Delivering Better Financial Outcomes tranche 2 proposals would replace the SOA with a Client Advice Record. At the time of writing they had not passed, and the SOA requirement in section 946A stands. Whatever the document is called, it will carry the same client information, and the same question of where it is drafted.

See Dominion answering from your own documents.

A demonstration takes 30 minutes, uses no client data, and comes with no obligation.

Book a demo

Keep reading

AI data leakage in financial advice practices AI for financial advisers The Privacy Act, the APPs and AI All professions