D&S-04: AI in Regulated Industries: Finance, Health, Legal

Part 4 of the Data & Security series. In Part 3 we checked the training promises of the big four vendors. Here we look at the firms that face those questions with a regulator standing behind the client.

For most companies, an AI data mistake means embarrassment and a difficult apology. For a finance firm, a clinic or a law practice, it can mean a reportable incident, a fine, and a letter nobody wants to write. That is why regulated companies ask harder questions about AI, and why the honest answer is not “avoid AI.” Many regulated firms use it every day. The difference is that they do the paperwork first.

What the regulator actually asks

Strip the industry language away and every regulator asks the same five questions about any system that touches client data.

Where does the data go, and where does it physically sit? Who can access it, at the vendor and at the vendor's own suppliers? How long is it kept, and how is it deleted? What happens, in hours not adjectives, when there is a breach? And can you prove all of the above, with logs, to an auditor who was not in the room?

An AI tool that cannot answer those five is not a bad tool. It is an unfinished decision.

The evidence pack

Serious vendors in this space can produce a standard pack of documents, and asking for it separates the adults from the demos.

A signed data agreement. For health data in the US that means a Business Associate Agreement, the HIPAA document that makes the vendor legally responsible alongside you. For finance, expect the agreement to speak to the Safeguards Rule expectations your examiner works from. For law firms, the agreement has to respect client confidentiality duties that come from your own profession, not just privacy law.

Independent audit reports. The common one is SOC 2 Type II, which means an outside auditor watched the vendor's controls operate over time, not just on the day of the photo. Ask for the current report, under NDA if needed. A vendor who cannot produce one is telling you something.

Residency and subprocessor lists. Which countries hold the data, and which other companies touch it along the way. Both lists exist for any mature vendor. Both change over time, and the good contracts promise notice when they do.

Audit logs and retention controls on your side. You need your own records of who used the tool and what it touched, in your admin console, exportable, kept as long as your industry requires.

Breach notification in the contract. Not “we take security seriously.” A number of hours, and a named process.

The three industries, quickly

Finance. Client financial data plus examiner culture. The work is mostly vendor management: risk assessment before signing, evidence on file, periodic review. AI fits fine inside that machinery. It just has to enter through it.

Health. HIPAA makes the BAA the gate. No BAA, no patient data in the tool, full stop. With a BAA and the right configuration, AI is already doing scheduling, documentation and intake work in practices that run it carefully.

Legal. The duty is confidentiality and privilege. The questions are whether anything trains on client material (it must not), whether matter data stays separated, and whether using the tool could ever be discoverable in a way that hurts the client. Conservative firms start with internal documents and templates, not live client files, and that order is wise.

The point

Regulation does not forbid AI. It forbids shrugging. If your company answers the five questions in writing before the first employee pastes the first client paragraph, you are ahead of most of the market, including firms ten times your size running premium licenses on pure confidence.

Next in the series: where the AI actually lives, cloud, private cloud, or a server in your own building, and what that choice really costs.