Guide
Staff on personal AI accounts? Bring it in safely.
Don’t ban it. Learn what people use, move it onto a plan the firm controls, then write the rules.
Built forQopia FinancialJSI Systems
It starts with good intentions
People use what helps. If the firm hasn’t provided a tool, they use their own, usually with no idea what the plan does with what they paste in. Security teams call it shadow AI. In a firm of 40 people it is just Tuesday.
Where client data is exposed
Training
Many personal plans may train the model on what you type unless the setting is off. Business plans generally don’t. The register lists each tool, plan by plan.
No agreement
The firm has no contract covering that data, so there is nothing to show a client or an auditor.
No visibility
Nobody can say what went in, and when someone leaves, their chat history leaves with them.
Your first month, in order
- Ask, without judgment. Which tools, for what, how often. Make it safe to answer honestly, or you will learn nothing.
- Stop the obvious leaks. Say plainly what must not go into a personal account: client information and credentials.
- Provide a sanctioned tool. Pick one, on a business plan, and give people access. A ban with no alternative sends the use back underground.
- Write the policy from what you found. The AI use policy template is a starting point.
- Name an owner. One person keeps the approved list and re-checks the tools when a vendor changes its terms.
2 mistakes to avoid
Don’t start with the policy. A policy written before you know what people do will be about the wrong things. And don’t make examples of people: the ones who were open with you are the ones you need.
Set the rules with us.
A working session surfaces what your team already does with AI, and writes the policy from that.
Questions we get asked
Should we ban AI until we have a policy?
A ban rarely holds, and it stops people telling you what they use. Provide a sanctioned tool and clear limits.
How do we find out what people are using?
Ask them, in a way that is safe to answer. A short anonymous survey and a few conversations tell you more than monitoring.
Has client data already been exposed?
Possibly. Find out what went into which tools, check each tool’s terms, and decide with your lawyer whether anything needs disclosing.
Which plan should we move people to?
One where the vendor commits not to train on your content and gives you admin control. The register compares them.
What to use from here
Your brief · 1 of 3
What brings you here?
See what we’d build first at a firm like yours.