HumanCentric AI for Exit Planning

The main risks involve security, confidentiality, data retention, and over-reliance without oversight. Key concerns include:

• Data breaches exposing client information

• Violations of confidentiality or regulatory requirements

• AI systems storing data for training or cross-border transfers that may breach privacy laws

• Inaccurate outputs and liability from relying on AI without human review
  

How to mitigate: conduct vendor due diligence, set clear data policies, use private/closed AI systems, and disable any default settings that allow your data to be used for training.

Client confidentiality can be protected through these steps:

• Use closed/private AI systems* that don’t share or retain data for training

• Limit data shared and anonymize identifying details before input

• Obtain informed client consent before using AI with their information

• Apply encryption (in transit and at rest) to safeguard data

• Establish governance policies including staff training, audits, and vendor reviews

These practices reduce risk and help preserve client trust.

*For those less familiar: a closed or private AI system means your data is kept separate from the public internet and not used to train the AI for other users. If you use a public tool (like ChatGPT), make sure to turn off any settings that allow your data to be used for training.

Rather than relying on one platform, use a criteria checklist when assessing AI tools. Look for:

• Enterprise-grade security (e.g., SOC 2 Type II certification*)

• Data processing agreements that comply with local privacy laws

• Deployment flexibility (on-premises or private cloud options)

• Data residency choices to meet jurisdictional requirements

• Admin controls like audit logs and single sign-on

• Clear policies confirming client information is not used for model training

Consult your professional association, IT/security experts, and legal counsel to confirm suitability. Review vendors annually since standards and risks change quickly.

*Terms like SOC 2 or data residency are simply benchmarks showing whether a vendor takes security seriously. If you’re not sure how to evaluate them, start with IT/security advisors or work with a trusted partner who can vet platforms for you.