Accounting firm (55 employees): one secure business AI instead of 55 personal accounts

Example case · anonymized · figures are illustrative

The situation

An accounting and advisory firm in South Holland has 55 employees across three offices. It prepares financial statements and provides tax advice and payroll services. It runs on Microsoft 365, a practice-management system, and fifteen years of documents in SharePoint: memos, standard letters, earlier advice, internal guides.

Management knew employees used ChatGPT. To draft a letter, to quickly check a tax rule, to summarize a long document. Nobody had banned it, nobody had arranged it. A June 2025 study by the Dutch Chamber of Commerce found that 30% of business owners already use ChatGPT or Copilot, and that half do not know the EU AI Act exists. This firm sat exactly in between: using it, but not managing it.

The process before Optimi

A client emails a routine question: “Do I charge VAT on this invoice to a German client?” or “When is the return due?”

1. The assistant accountant reads the email and searches SharePoint for an earlier letter on the same subject. Usually they find three, from different years.
2. They check the rule on a tax website or, more and more often, in their personal ChatGPT.
3. They write an answer, have a colleague read it, and send it.

More than 20 minutes per question. With 55 employees and dozens of these questions a day, that adds up. But time was not the biggest problem.

Where it failed

Three things bothered management:

• Client data. When summarizing a document, someone would sometimes paste the whole text into a personal account. Nobody knew which data had ended up where.
• Reliability. Answers from ChatGPT came without a source. A wrong VAT rule in a client letter is a professional liability.
• The EU AI Act. Since February 2, 2025, Article 4 requires that everyone who works with AI has sufficient knowledge of it. The firm could not show that for 55 people.

What Optimi did

Workshops. We did not start with technology but with a two-hour management session: which tools are allowed, which are not, who approves what. Out of that came a one-page AI policy. Then a three-hour AI literacy workshop for all 55 employees, in three groups, with an attendance list and a short test. That helps the firm show it meets the literacy duty; it is not a certificate, and we say so.

Business AI and agents. Then the workspace:

• One AI workspace for the whole firm, on models in an EU region, in our managed environment. No training on client data, data processing agreement signed.
• Connected read-only to SharePoint and the practice-management system.
• Access per role and per client group: an employee sees in the AI only what they are allowed to see in SharePoint.
• Every answer with a source reference to the document it came from.
• An agent for routine questions: it recognizes the question, finds the firm’s position and the most recent letter, and drafts a reply. The employee approves or edits.
• Personal AI domains blocked on the office laptops, as agreed in the policy.

Managed AI. The firm chose Managed AI: we watch the workspace, keep the AI register (which application, which risk, who is responsible), and process model changes from suppliers.

A person stays in the loop for: every answer to a client, and every change to the policy or the roles.

The result

Indicative results for this scenario, after three months:

• Routine client question: from 20 to 6 minutes, including review.
• 55 employees with documented basic AI knowledge: attendance list, test, and policy in the register.
• 0 client data in personal tools, through policy and blocked domains.
• 100% of answers with a source reference.

And one thing that does not fit in a number: management can now explain to a client or a regulator which AI the firm uses, where the data is, and who is responsible.