Asset schedules and AI security: what an insured equipment list gives away in ChatGPT or Claude.

Before a renewal a broker rebuilds the client’s asset schedule: every item worth insuring, where it is, what it is worth and how it is protected. Pasting that grid into ChatGPT or Claude looks like a quick way to reformat it or spot underinsurance. A schedule is also a ready-made list for a thief: serial numbers, rooms, values, which door key sits where and which cupboard is left unlocked. This page marks every item in a realistic dental practice schedule that the Privacy Act and the Code of Practice bear on, shows the generic parts, and shows how the same schedule is worked on Ermos inside the brokerage.

The asset schedule

Rebuilt from the client’s asset register and invoices before each renewal, then checked against the sums insured in the policy schedule.

An invented schedule. Serial numbers are obvious placeholders. Hover or tap any highlighted cell for the analysis; the full list is below.

What leaves the brokerage

1. 1
   The client and the practice

   The practice, its legal entity and the renewal date. Ties every row below to one business. A workbook shared as a file also carries author and last-saved-by fields, and any hidden tabs or columns such as a values history. Privacy Act guide.

2. 2
   Serial numbers

   Identifiers that let a particular machine be proved as the insured one, traced if stolen, or claimed for twice if misused. Commercial information the client and its insurer rely on.

3. 3
   The most valuable item and its room

   The $185,000 sum insured on the most valuable item. With the item and its room in the same row, a complete statement of what is worth taking and where to find it.

4. 4
   Keys, portability and room access

   Where a key is kept and which equipment leaves the building. Security information that is most useful to someone planning a theft.

5. 5
   The patient records server

   About 9,400 patients’ records on a server in a cupboard left unlocked in business hours, backed up offshore. Patient health information, and the practice is a health service provider covered by the Privacy Act whatever its turnover (OAIC). Patient data guide.

6. 6
   Scheduled medicines and the key

   A kit of scheduled medicines and where its key is kept. Safety and security information for the practice and its patients.

7. 7
   Finance and the interested party

   That the scanner is financed through a lessor with an interest in the claim proceeds. Commercial terms between the client and its lender.

8. 8
   The landlord and the related party

   The premises address and that the landlord is a family trust connected to the owners. Related-party information, and a reason the sums insured on fit-out and contents need to be clear.

9. 9
   The column headings

   Labels such as Item and Sum insured. Generic wording found in any schedule, with no client data in it.

10. 10
    The underinsurance note

    The broker’s observation that the scanner is insured at purchase price and now costs more to replace. Advice the Code of Practice describes as acting in the client’s best interests (clause 5.3). The replacement figure is a quote a person has to check.

What happens in Frontier Models (ChatGPT, Claude)

• The whole document is transmitted to the provider’s servers. On personal plans the user cannot choose where it is stored or processed, and for the major providers that has generally meant outside Australia, under that country’s legal process. Some business plans offer storage in Australia, but the provider still receives the content.
• On consumer tiers, prompts can be retained and used to train future models.
• The provider’s staff and systems can reach the content under the provider’s own policies.
• Once sent, the brokerage no longer controls it. Retention and deletion happen on the provider’s terms.

The same document on Ermos

Part of AI data leakage in insurance brokerages. See how this works in practice: Renewal preparation on Ermos.

Common questions