HumanCentric AI for Exit Planning

The main risks involve security, confidentiality, data retention, and over-reliance without oversight. Key concerns include: • Data breaches exposing client information • Violations of confidentiality or regulatory requirements • AI systems storing data for training or cross-border transfers that may breach privacy laws • Inaccurate outputs and liability from relying on AI without human review How to mitigate: conduct vendor due diligence, set clear data policies, use private/closed AI systems, and disable any default settings that allow your data to be used for training.

Client confidentiality can be protected through these steps: • Use closed/private AI systems* that don’t share or retain data for training • Limit data shared and anonymize identifying details before input • Obtain informed client consent before using AI with their information • Apply encryption (in transit and at rest) to safeguard data • Establish governance policies including staff training, audits, and vendor reviews These practices reduce risk and help preserve client trust. *For those less familiar: a closed or private AI system means your data is kept separate from the public internet and not used to train the AI for other users. If you use a public tool (like ChatGPT), make sure to turn off any settings that allow your data to be used for training.

Rather than relying on one platform, use a criteria checklist when assessing AI tools. Look for: • Enterprise-grade security (e.g., SOC 2 Type II certification*) • Data processing agreements that comply with local privacy laws • Deployment flexibility (on-premises or private cloud options) • Data residency choices to meet jurisdictional requirements • Admin controls like audit logs and single sign-on • Clear policies confirming client information is not used for model training Consult your professional association, IT/security experts, and legal counsel to confirm suitability. Review vendors annually since standards and risks change quickly. *Terms like SOC 2 or data residency are simply benchmarks showing whether a vendor takes security seriously. If you’re not sure how to evaluate them, start with IT/security advisors or work with a trusted partner who can vet platforms for you.