Commercial vs Consumer AI Accounts: A Terms Check Before Client Data

A Preparer asks whether an AI tool is safe for a client folder. Someone answers with the vendor's name. The name alone doesn't settle much. Before client data goes in, record who holds the account and which terms the Firm has read.

This piece gives the Firm an account terms check for commercial vs consumer AI accounts: a short sheet it fills in for each AI account before any client data goes into it. The sheet asks the same questions of every vendor. Which account type is this? What does the vendor say about training on it? What exceptions does it name? Is there a retention setting, who can change it, and what falls outside it?

The questions are vendor-neutral. To show how a filled sheet reads, there's one worked example built from two of Anthropic's published pages, quoted as written. It's an example of the reading, not a ranking of vendors.

Why the account type comes first

Start by recording the account holder and any stated account or plan label. Record who holds the account: the Firm or an individual.

Identify the account before selecting passages for its sheet. If you start with the product instead of the account, a line written for one account type gets read as covering the other. Starting with the account keeps every later answer tied to the terms that actually apply.

The account terms check

The Firm fills in one sheet per account, not one per vendor. Use a separate sheet for each account the Firm evaluates, including any personal account proposed for client work.

How to fill it in

Quote, don't summarize. Copy the vendor's sentence word for word, with the link and the day it was read. Keep the quote beside its link so the next reader can compare it with the source.

Read the scope line first. Look for an explicit statement of the passage's scope. Record that line in row 1's notes. Apply a quoted passage only within its stated scope.

A blank is an answer. If the page read doesn't answer a row, write "not found on the page read" and the link. The Firm decides what a blank means for that account. One choice: no client data goes in until the blank is closed.

Name the reader. Each sheet carries the name of the person who read the pages and the date. When the vendor changes its pages, the Firm knows which sheets to read again.

Keep legal questions separate. The sheet records what the vendor says. Whether the Firm's use of an account raises a disclosure or consent question is a different matter. The Firm takes those questions to its own counsel or compliance lead, with the filled sheet attached.

A worked example: one vendor's pages

Here is how rows 1, 3, 4, 5, 6 and 7 read when filled from two of Anthropic's pages. These are excerpts as read on this post's publish date. The pages can change, so the Firm reads the current version and records its own read date.

Training default (rows 1, 3 and 4). Anthropic's model-training page includes a section titled "Data usage for Anthropic Commercial Offerings (e.g. Anthropic API, Console, Claude for Work (Team & Enterprise plans), etc.)". Under that heading, it says: "We will not use your chats or coding sessions to train our models, unless you choose to participate in our Development Partner Program." The same page names two more exceptions: if you explicitly report materials, such as through thumbs up or down feedback, or explicitly opt in to training, Anthropic may use those materials to train its models. So row 4 for that account lists three routes, and the Firm records whether anyone has used them.

Retention (rows 5, 6 and 7). Anthropic's retention-controls page says: "This feature is available to Enterprise plan customers. To set custom retention periods for your organization, you must have either a Primary Owner or Owner role." It gives a minimum retention period of 30 days. On scope it says: "Custom retention periods apply to content in chats and projects. They do not apply to Claude Design, Claude Tag, Claude Managed Agents, or any other feature that runs Claude Code in the cloud."

What the example doesn't cover. The retention article states: "This article is about our commercial products, specifically Claude Enterprise." For an account outside that stated scope, leave rows 5 to 7 open until the Firm has read a passage that expressly covers it. Record a supporting passage for each row; don't infer retention terms from a training statement.

Reading the gaps

Row 7 shapes day-to-day use. In the worked example, the vendor's page lists features its retention setting doesn't apply to. Work in those features sits outside the setting the Firm chose, so the sheet records it.

The Firm can decide, feature by feature, what to do. The Firm might keep client data out of excluded features while unresolved terms questions go to its own counsel or compliance lead. Record the decision next to the row, with a name and a date.

Row 4 works the same way. The Firm records whether staff may submit client materials through feedback. If the vendor says reported materials may be used for training, the Firm can decide whether staff use feedback buttons on client work at all, and write that down.

Where the sheet lives

The sheet feeds two documents the Firm may already keep. The data security plan lists each system that holds client data, and the filled sheet can sit behind the line for the AI account.

The AI use policy names approved tools by account, so each approved account points to its sheet.

When a question goes to counsel, the section 7216 questions can travel with the sheet.

A Doe example

The firm, people and accounts below are made up for illustration.

Jane Doe owns Doe & Co. CPA and holds the Owner role on the Firm's Enterprise account. Pat Doe is the Reviewer. Sam Doe, a Preparer, asks to use his personal account on the Doe Holdings folder.

Jane checks the sheets. The Firm's Enterprise account has a filled sheet: training default quoted, the three exception routes listed, retention set by Jane, and the excluded features named in row 7. Sam's personal account has no sheet. Under the Firm's rule, an account with no sheet gets no client data, so Sam's request waits.

Jane also writes a row 7 decision: staff keep client data out of the features the retention page lists as outside the setting. She adds a row 4 decision: no feedback buttons on client work. She signs and dates both.

One question is left: whether the Firm's planned use raises a consent question. Jane sends it to the Firm's counsel with the sheet attached and leaves the account at synthetic files only until the answer comes back.

Once counsel answers and Jane approves client use, nothing about the review changes. Sam checks the work against its sources, and every file ends with Pat's sign-off.

What the check doesn't settle

The sheet tells the Firm what a vendor says about an account. It doesn't check the vendor's practices, and it doesn't answer legal questions. Those go to the Firm's own counsel or compliance lead.

It also changes nothing about the work itself. Approval doesn't replace the Preparer's source check or the Reviewer's sign-off. The Preparer checks the work against its sources, and every file ends with the Reviewer's sign-off.

Where TracePrep fits

We've built a TracePrep plugin that drafts these steps in your Firm's workflow, while your preparer decides and your Reviewer signs off. Join the waitlist and we'll tell you when plugin access opens.

Get on the list for plugin access

This is general information, not tax or legal advice. In TracePrep's workflow, the plugin drafts, the Firm's preparer prepares, and the Firm's Reviewer signs off. Access to the plugin is by waitlist. Keep client data inside the systems your Firm has approved.