iPayroll warns firms over AI data risks in payroll

iPayroll has warned businesses to scrutinise how artificial intelligence features in software platforms use and manage customer data, particularly in payroll and finance systems that handle sensitive employee information.

The New Zealand payroll provider says it is seeing rising concern about data privacy as AI tools become more common in business software. Some providers include terms allowing customer data to be used to train AI models or shared across third-party platforms, often through privacy policies or conditions users may not examine closely.

That scrutiny matters most in systems holding salary, tax and employee records. Payroll and finance teams are increasingly being asked to balance the promise of automation and efficiency against the risk of losing control over how data is used, stored and processed.

iPayroll argues that cost savings linked to AI features can come with trade-offs, including reduced transparency over data handling and greater dependence on platform design choices that can affect operational decision-making.

It also linked the debate to professional standards in accounting and payroll, pointing to the APES 110 Code of Ethics for Professional Accountants, which sets out five principles: integrity, objectivity, professional competence and due care, confidentiality, and professional behaviour.

As automation becomes more embedded in day-to-day systems, those principles take on greater weight. Finance and payroll professionals still need to ensure trust, accountability and transparency are maintained, even when decisions or workflows are supported by AI tools.

Data terms

One of iPayroll's central concerns is whether organisations fully understand the contractual terms attached to software platforms. In practice, businesses often focus on product features, cost and implementation speed, while clauses covering data usage receive less attention.

That can create exposure if terms allow providers to use customer information beyond the immediate delivery of a service. In payroll and finance environments, where data may include personal identifiers, compensation details and tax records, such provisions can carry wider governance and compliance implications.

"AI is a powerful tool, but businesses need to understand how their data is being used behind the scenes," said Martin Gleeson, Managing Director of iPayroll.

"While data may be used to enhance AI systems, organisations should be fully aware of and comfortable with how their data is handled."

Own approach

Alongside its warning, iPayroll set out its own position on customer information, saying client data remains the client's property and is used only to deliver payroll services, not to train AI models or for other purposes outside agreed services.

It also said it operates as an ISO 27001-certified organisation, placing its data management and information security practices under an internationally recognised framework. The same controls and oversight apply to any AI development and use within the business, it added.

Founded in Wellington in 2001, iPayroll provides cloud-based payroll software and acts as an online PAYE intermediary with Inland Revenue in New Zealand. It says it supports more than 10,000 businesses and offers tools covering pay runs, tax calculations, reporting, leave management and compliance tasks.

The issue it highlighted reflects a broader shift in business software, as AI is added to finance, human resources and operational systems already at the centre of company records. For buyers of those platforms, the debate is moving beyond what the tools can do to the conditions attached to their use and the safeguards applied to the data they ingest.

For payroll teams in particular, the concern is not only technical. It also touches on governance, professional conduct and the duty to protect confidential employee information when evaluating new digital systems.

"Efficiency is important, but not at the cost of trust," Gleeson said.

"Businesses should feel confident their data is handled responsibly, and that starts with choosing partners who prioritise transparency and client ownership."