Does Microsoft Copilot in Excel work with confidential client data?

Microsoft 365 Copilot operates inside your tenant and does not train on your data per its commercial terms. However, your firm's policy may still restrict Copilot use on certain client engagements, especially audit clients with independence concerns. Ask your firm's IT or risk team before using it on client data.

Can I use ChatGPT to write Excel formulas for client work?

Many firms restrict pasting client data into ChatGPT because it leaves the firm's tenant. ChatGPT is generally fine for asking 'how do I write a formula that does X?' — without including any client-specific values. The line is whether identifiable client data crosses the boundary.

How do I document AI-assisted work for SOX or audit purposes?

Standard practice in 2026 is to add a comment in the workpaper noting that AI was used to generate or check a formula, what was reviewed, and that the human signed off after independent verification. Your firm likely has a specific AI-use disclosure template — use it consistently.

AI-Powered Excel: Copilots, Formula Generators, and Audit-Trail Risks

If you use Excel for a living, AI inside Excel is the highest-leverage productivity tool you'll touch this year. It's also where the most accountants are quietly creating audit-trail problems they don't realize they've created. Both are true at once.

The three layers of AI-in-Excel

Microsoft Copilot for Excel — the real-deal integration. Operates on actual cells. Available in M365 Business Standard and above with the Copilot add-on.
Excel Labs / Advanced Formula Environment — Microsoft's experimental sandbox. Lets you write LAMBDA functions in a friendlier editor.
External AI (ChatGPT, Claude) used to generate formulas you paste in — the most common pattern, and the one with the most footguns.

Where AI-in-Excel actually wins

Formula explanation. Inherited a workbook with nested IFERROR(INDEX(MATCH... structures? Copilot will explain it. Hours saved per week.
Pivot table generation. "Make me a pivot showing revenue by region by month, with a YoY comparison column" — works.
Data cleanup. "These vendor names have inconsistent capitalization and trailing whitespace" — Copilot fixes a column in seconds.
Conditional formatting setup. Hard to remember the rules; trivial to ask for.
Variance commentary drafting. "Generate a 3-sentence variance explanation given these numbers" — usually needs editing, but cuts time on management reports.

Where it fails (don't trust it for these)

Multi-step calculations across sheets. AI loses track of cross-sheet references.
Anything involving real money decisions. Always verify output against an independent source.
Tax calculations with thresholds. AI hallucinates phaseout amounts, AGI thresholds, and bracket cutoffs.
Audit calculations (testing samples, materiality). Use the firm's sanctioned tools.

The audit-trail trap

The most common 2026 mistake: a junior uses ChatGPT to generate a complex formula, pastes it in, gets the right answer, and ships the workpaper. Six months later, an audit reviewer asks "where did this formula come from?" and the answer is "ChatGPT, but I don't remember the prompt." That's a problem under most firms' AI-use policies — and an even bigger problem if the workpaper is part of a SOX 404 control test.

Standard 2026 mitigation: a one-line note in the workpaper noting AI assistance, what was verified, and the verification method. Firms publish templates for this. Use them.

SOC, SOX, and tenant boundaries

If you're working on a SOC 2 or SOX engagement, your firm almost certainly has a policy about which AI tools are approved for which data types. Microsoft Copilot inside your firm's M365 tenant is usually approved (it stays within the boundary). Public ChatGPT usually isn't. Approved internal-LLM wrappers (most Big Four have them now) usually are. When in doubt, ask risk before pasting.

Bottom line

Get fluent in Microsoft Copilot for Excel. Use ChatGPT and Claude for general-purpose formula questions where no client data crosses the boundary. Document AI use on workpapers per your firm's policy. The accountants who do this carefully look like superheroes; the ones who don't end up in a quality-review conversation they didn't see coming.