Air-Gapped Tax Advice: Why Waterford Practices Are Moving Past Public AI

I've spoken to a fair number of partners and practice managers around Waterford and the South East over the last year and the same point keeps coming up. Nobody doubts that AI can save hours on review and drafting. The doubt is about where client data goes once it has been pasted in. I feel the best answer for most practices is a model that runs on a machine in the office with no route out to the internet, and this post sets out why and what it looks like day to day.

The Quiet Dilemma in Waterford Practices

Most partners I know believe their firm does not use public AI as nothing has been approved. I'd gently suggest that is unlikely. A second-year trainee with 200 pages of client bank statements at 6pm in busy season will find a way through, and the quickest way is usually a free chatbot on a personal phone or a home laptop.

The uses are ordinary. Staff summarise client PDFs, write Excel macros, tidy up letters to Revenue and ask for a plain-English explanation of a technical point. The intentions are good and the work often comes out well, which is part of the problem.

The exposure is the other side of that convenience. A Revenue audit letter carries PPS numbers, tax references and often a full history of a client's affairs. A payroll run carries names, salaries and bank details. Once that material is pasted into a public tool it sits on infrastructure the firm does not control, under terms the firm did not negotiate and possibly outside the EEA. Some consumer tiers may keep prompts and use them to improve their models unless settings are changed, and I'd not expect a trainee to have checked.

The Compliance Firewall

Article 5(1)(f) of the GDPR requires personal data to be processed with appropriate security, including protection against unauthorised processing and accidental loss. Article 32 asks the firm to put technical and organisational measures in place that match the risk. Client files containing payroll, medical expenses or family wealth are not low-risk data.

The firm is the controller for much of what it holds. Sending that data to an AI vendor makes the vendor a processor, which needs an Article 28 contract, and consumer accounts rarely come with one. Where the servers are outside the EEA a transfer mechanism is also required under Chapter V. If something goes wrong the Data Protection Commission can look at all of this, and the higher tier of fines under Article 83 reaches €20 million or 4% of worldwide turnover. A breach also starts a 72 hour notification clock under Article 33. The Commission has also published guidance on AI, large language models and data protection that flags the risk of staff entering personal data into third-party AI tools.

The professional side is just as direct. Confidentiality is a fundamental principle in both the Chartered Accountants Ireland Code of Ethics and the CPA Ireland Code of Ethics, which both deal with it in Section 114, and the duty of care to the client does not transfer to a software vendor. If a client's data ends up somewhere it should not be, the firm answers for it, not the tool.

The EU AI Act adds a further layer. A firm using an AI tool in its work is a deployer, and the Act includes an AI literacy duty in Article 4, which has applied since February 2025 although the wording has been amended more recently, along with transparency duties in certain cases. Most accountancy uses are likely to be low risk, but you'd need to know what is in use and be able to show it. A local model you have chosen and documented is far easier to evidence than a dozen personal accounts. I'd confirm the exact timelines with your legal adviser as they are phased.

Demystifying "Air-Gapped" Local AI

Open-weight models such as Llama, Mistral and Qwen are published so that anyone can download and run them. Once downloaded the model is just a large file on a disk. It needs no account and no connection to the people who built it.

In practical terms that means a machine such as an Apple Mac Studio with plenty of memory, or a desktop workstation with a high-end NVIDIA card, sitting in the comms room or under a desk behind the office firewall. Staff reach it from their own desks over the office network through a simple chat page, much as they would use any internal tool.

Strictly speaking air-gapped means no connection to the outside world at all. In a small office I'd settle for a firewall rule that blocks every outbound connection from that machine, with software updates carried out on site after checking. The result is the same. No data packets leave the building, no third party retrains a model on your clients, no remote logs are kept and there are no cross-border transfers to assess.

I'd be upfront about the limits. These models are smaller than the largest commercial ones and I would not expect them to match on everything. For the tasks below they are good enough, but the output must be reviewed in the same way you would review a trainee's work.

Concrete Practice Workflows

1) Private retrieval-augmented generation. The firm indexes the Revenue Tax and Duty Manuals (the Tax and Duty Appeals Manual is one example) and Tax Appeals Commission determinations (such as 65TACD2025) alongside its own precedent files and client workpapers. A partner can ask how Revenue has treated a particular point and get an answer that points to the passages used, so it can be checked in seconds. Decades of material become searchable and the client workpapers never leave the office.

2) Local document ingestion. Bank statements, receipts and invoices arrive scanned, photographed and badly cropped. A local model can read them and pull dates, payees and amounts into a spreadsheet. As there is no per-token bill a 5,000 page backlog can run overnight at no extra cost, and staff only deal with the exceptions it flags.

3) Advisory drafting. Fed with the firm's past letters and memos the model can produce a first draft of a technical memo or an engagement letter in the house style. The partner still reviews and signs, but the blank page is gone.

Trust as a Client Acquisition Engine

Privacy-sensitive clients are already asking questions. High-net-worth individuals, family businesses and solicitors with client accounts have their own confidentiality duties and want to know who else touches their information. I've heard these questions more often in the last year than in the ten before it.

A firm that can say in its engagement letter that client data is processed on equipment in its own office and is not sent to any external AI service has a specific and checkable answer. That costs nothing to say once it is true. I'd not oversell it as the claim must match the policy, and the policy must match what staff actually do.

The Financial Case

Look at it the way you would look at any client's investment decision. A dedicated machine costs somewhere between €2,500 and €3,500 once. It qualifies for capital allowances as plant and machinery, which at 12.5% a year over eight years gives a deduction of around €375 per year on a €3,000 machine.

Commercial AI seats typically run to €30 to €40 per user per month. For ten staff at €35 that is €4,200 per year or €21,000 over five years, with nothing owned at the end and the price set by someone else. The seat cost is deductible, but it never stops, and it does not solve the confidentiality problem.

The hardware figure does not include everything. I'd allow something for setup and electricity, and for someone to look after the machine once it is running. That means keeping the model and software up to date, checking the firewall rules, backing up the document index and dealing with anything that goes wrong. Many practices will not want to take that on themselves, and I'd expect a monthly support retainer to be the usual way to cover it. It is a recurring cost, but it is a fixed one that does not grow with the number of users, and one machine can serve the whole office.

A Pragmatic 3-Step Rollout

1) Run a shadow AI audit. Ask staff and trainees plainly what they use and what they paste into it. Make it anonymous if required and make it clear that nobody is in trouble. Two weeks is enough, and the answers are usually more surprising than partners expect.

2) Pilot on a single machine. Set up one open-weight model on one air-gapped machine and give it to two or three people for 6 to 8 weeks on one workflow, such as bank statement ingestion. Record the hours saved and the errors found.

3) Formalise the governance. Write a short firm-wide policy covering approved tools, what data may go where, how output is reviewed and who is responsible. Update the engagement letters, keep a record of what is in use for GDPR and AI Act purposes and carry out a data protection impact assessment if the pilot calls for one.

None of this needs a large budget or a long project. It needs a partner willing to ask the question and a few weeks to test the answer.

See It Running in Your Own Office

If you'd like to see how this works before committing to anything, I'd be happy to bring a demo to your practice. I'll set it up on my own PC in your office with no connection to the internet and run it on sample documents such as a messy bank statement, a Revenue letter and a draft engagement letter. You will not need to share any client data. The demo takes about 45 minutes and there is no cost or obligation, and it will give you a good sense of what a local model can and cannot do before you spend anything on hardware.

If you decide to go ahead I can set up the machine and look after it for you on a monthly retainer, so you do not need anyone in the practice to become an IT department. Let me know a day that suits and I'll work around your diary, as I'm able to cover Waterford and the wider South East. You can reach me via our contact page.