Summary (Key Takeaways)
- Many regulated firms believe they have not adopted AI, yet staff are already using public tools to draft client emails, summarise documents and analyse data.
- Unmanaged AI feels like efficiency to the person using it, but client, financial and confidential data can end up in systems the firm has never reviewed or approved.
- AI spreads differently from other technology: there is no buying process, so tools are adopted individually and instantly, often before any policy exists.
- Simply “banning” tools rarely works, because staff believe they are solving a problem, not creating one.
- The defensible position is an open, blame-free conversation about which tools are in use, where data goes, and what must never leave approved systems.
The Firm That “Doesn’t Use AI Yet”
There is a conversation that comes up again and again with practice principals and compliance leads, and it almost always starts the same way: “We don’t really use AI here yet.” It is said with quiet confidence, and the person saying it genuinely believes it. The firm has not signed a contract with an AI vendor, held a project meeting about adoption, or added anything labelled “artificial intelligence” to the technology roadmap. As far as the leadership is concerned, this is a decision still to be made.
Then the questions begin. Does anyone use a tool to help draft longer emails? Well, yes, one of the advisers does. Does anybody summarise meeting notes or long documents with software? Actually, a paralegal has started doing exactly that. Has anyone added a browser extension that helps produce content more quickly? As it turns out, two people have. Within a few minutes, the comfortable belief that the firm has not adopted AI quietly collapses. The firm never made a formal decision, but AI has arrived anyway, carried in one helpful shortcut at a time.
This is not a sign of a poorly run business. It is simply what happens when genuinely useful technology meets busy, capable people. When someone finds a tool that lets them get through their work faster, they are naturally curious, and if it saves them time, they keep using it. The difficulty is not the curiosity. It is that nobody has stopped to agree where the sensible boundaries lie.
How a Harmless Shortcut Becomes a Compliance Exposure
Picture how this unfolds in practice. A member of your team receives a long, complex email from a client and wants to reply well, but quickly. They paste the whole thing into a public AI tool and ask it to help draft a response. The answer comes back in seconds and saves them perhaps fifteen minutes. Nothing appears to have gone wrong, so the next day they do it again. A week later they upload a proposal because they want a tidy summary. A month on, a colleague is using a different AI tool to analyse a spreadsheet of figures.
At no point in that sequence does anyone feel they are doing something risky. Quite the opposite: each person believes they are working more efficiently and serving clients better. And yet, step back, and you can see what has actually happened. Client information, financial data, internal documents and even confidential business plans have been handed to systems that your firm has never reviewed, never approved and cannot account for. There was no malice and no negligence in the ordinary sense. There was simply an absence of agreed boundaries, and in a regulated firm that absence is where the exposure lives.
For a mortgage brokerage, a solicitors’ practice, an accountancy firm or an IFA, this matters a great deal. Under GDPR and your sector’s own rules, you remain accountable for where personal and sensitive data goes and who can access it. “A member of staff pasted it into a free tool to save time” is not an answer that reassures the ICO, the FCA, the SRA or a cyber insurer. The data left your controlled environment, and you cannot easily say where it now sits or how it might be used.
Why AI Spreads Faster Than Any Other Technology
Part of what makes this so difficult is that AI behaves unlike almost any technology your firm has adopted before. A new accounting package goes through a buying process. Someone researches options, a budget is discussed, a decision is signed off, and the tool is rolled out deliberately. A new CRM is talked about long before it arrives. There is a natural pause for thought, and that pause is where governance usually happens.
AI tools skip that pause entirely. They are discovered by individuals during the working day and adopted immediately, with no contract, no cost and no conversation. By the time a firm starts thinking seriously about an AI policy, people have already found their favourite tools and built them into their daily workflows. You are no longer deciding whether to adopt AI; you are discovering that you adopted it months ago without noticing.
This same pattern of invisible, informal adoption is exactly why we keep urging firms to ask who is actually overseeing these tools in the first place. We explored the governance vacuum this creates in our article on whether anyone is genuinely controlling AI at work, which looks at how quickly unmanaged use builds up in the background of an otherwise well-run firm.
The Awkward Problem With Simply Banning Tools
The instinctive reaction, once a firm realises what is happening, is to ban the tools outright. It feels decisive and safe. In practice, it is rarely either. If someone believes a tool is genuinely helping them do their job better, a blanket ban can feel arbitrary and even counter-productive. They were not trying to create a problem; from their point of view they were solving one. Tell them to stop without explaining why, and two things tend to happen. Some comply but quietly resent it. Others simply carry on, more discreetly than before, which is the worst outcome of all because now the risk is both present and hidden.
There is a further subtlety that boards rarely discuss. Prohibition without understanding does not remove AI from your firm; it drives it underground, into personal devices, personal accounts and tools you have no visibility of whatsoever. You replace a known, manageable risk with an unknown, unmanageable one. For a regulated firm, losing sight of where client data flows is considerably more dangerous than knowing it flows somewhere imperfect and being able to fix it.
This is the same reasoning that applies to AI-driven spending and procurement, where tools quietly commit the firm to things no one consciously approved. If you have ever wondered how decisions get made without a clear human sign-off, our piece on who is really approving AI-made purchases in your business is a useful companion to this one.
Could You Intervene If It Went Wrong?
Here is a question worth asking at your next leadership meeting. If one of these unofficial AI tools did something it should not, exposed a client’s personal data, produced incorrect guidance that went out under your name, or contributed to a breach, could your firm identify it quickly, shut it down, and explain calmly to a regulator what happened and why? For most firms, the honest answer is “not confidently”, and that gap is precisely what needs closing before it is ever tested.
This is not about assuming the worst of your people or the technology. It is about recognising that the ability to intervene is now part of responsible governance, sitting alongside every other operational risk your firm already manages. We set out why that matters, and what a practical intervention plan looks like, in our guidance on how you would stop AI in an emergency. It is a short read that reframes AI from a productivity novelty into a risk you can actually control.
The Conversation That Changes Everything
The good news is that the solution is not dramatic, expensive or technical. It is a conversation, held openly and without blame. The aim is to get the most value from AI while removing the risk that comes from using it in the dark. That means making sure everyone in your firm understands which tools are actually being used, where information is going when they use them, and, crucially, what data must never be shared outside approved systems.
Framing matters enormously here. If staff feel they are being policed or accused, they will tell you less, not more. If they understand that the firm wants to help them use these tools safely rather than take them away, they will be candid, and candour is what you need. The goal is to give people enough freedom to benefit from the technology without accidentally creating risks for the business or the clients who depend on it.
A practical first step is simply to ask. If you have never asked your team which AI tools they are using, the answers may genuinely surprise you, and that surprise is the whole point. You cannot govern what you cannot see. Once the picture is on the table, you can make sensible, proportionate decisions: which tools are approved, which are not, what the data rules are, and who owns the ongoing oversight. Much of this depends on understanding where your sensitive information already lives and who can reach it, which is why it is worth checking whether your data security is genuinely keeping pace with your business before layering AI decisions on top.
A Defensible Position, Not a Perfect One
No regulated firm will ever eliminate AI risk entirely, and chasing perfection is the wrong goal. What matters to regulators, auditors and insurers is whether you took reasonable, evidenced steps to understand and manage the risk. A firm that knows which AI tools are in use, has clear rules about what data can and cannot be shared, and has named someone to own the question is in a defensible position. A firm that insists it “doesn’t really use AI” while its people quietly paste client data into public tools is not.
The firms that handle this well are not the ones with the largest technology budgets. They are the ones that treat AI as an ongoing governance matter rather than a one-off decision, that ask the uncomfortable questions regularly, and that keep a current, honest picture of how the technology is really being used. They build enough freedom for their people to benefit, and enough control to protect their clients.
Where to Start
If reading this has prompted a slightly uneasy “I wonder what ours are actually using”, that is a healthy instinct, and it is the right place to begin. Start the conversation. Ask your team openly which AI tools they rely on and what they put into them. Map where client data might be travelling. Decide what is approved and what is off-limits, and make sure everyone knows the difference. Then assign clear ownership so the picture stays current as new tools appear.
If you would like help reviewing how AI is really being used across your firm, and making sure it is helping rather than quietly creating risk, we would be glad to assist. We will give you a clear, jargon-free view of where you stand and how to bring AI under control without slowing your team down. Get in touch with Absolutely PC.
What next?
One of my passions is helping businesses to succeed and if I can help you save some money as well – even better. You can fill out our contact form, phone us or click on the appointment button below and let’s start a conversation to see if I can help your business. Our guarantee:
- There are no hidden charges – this is a 100% free 15 minute consultation with no hidden charges.
- We will never spam you or sell on your contact details.
- We will treat your information with absolute confidentiality.
Other Posts for you to Enjoy
