Planning your security for 2027, with AI in the picture

For many firms, fall feels like a new school year: a natural moment for new beginnings and for setting next year’s plans. What a security plan for 2027 can easily miss is how you and your staff already use AI. A useful plan has to account for that use, and for what you owe clients when they trust you with their information.

Find out where AI is already in the business

Start with what is true today rather than what the policy says. AI tends to arrive in a business by three routes, and each one raises a different question.

• Approved tools. Which AI tools has the business approved, and for what kind of work?
• Personal and free accounts. Are staff using personal or free AI accounts for work tasks? This is sometimes called “shadow AI,” and it can start with people simply trying to get their work done.
• Features in software you already pay for. Which AI features are already switched on in the software you pay for, and who decided that? Office suites such as Microsoft 365, accounting packages, and practice management systems can include AI assistants.

Ask these as questions, not accusations. People answer honestly when they expect a sensible conversation, and an honest picture is worth more than a tidy one. Your provider or team can often tell you which features are available and which are turned on, but only the people doing the work can tell you what they actually use.

Decide what a careful owner should be able to show

A client, an insurer, or a regulator may one day ask how your firm uses AI. You do not need a long policy to answer well. You need a short set of records that match what really happens.

• An approved-tools list. The list names each tool, who may use it, and what it is for.
• Rules for information. For each approved tool, you write down what information may go into it and what must never go in, such as client files, personal details, or financial records.
• Human review. You name who reviews AI output before it reaches a client, and staff know that it is a draft until that review happens.
• Account controls. Staff use company accounts rather than personal ones and sign in with multi-factor authentication, and the business can remove access when someone leaves. Where a vendor offers admin settings for how long prompts are kept or whether your content may be used to train its models, someone has checked those settings and recorded the choice.
• A decision record. When the firm adopts a new tool or starts a new AI project, it writes down what was decided, who approved it, and what would cause the decision to be revisited.

Vendor settings and defaults vary by product, plan, and date, so confirm them for the tools and subscriptions you actually use rather than relying on a general description. Your provider or team should be able to show you the current settings, not only tell you about them.

Check your professional duties

Many professions already expect their members to think about AI and client information. For lawyers in the United States, the American Bar Association issued Formal Opinion 512 in July 2024. The ABA’s announcement explains that the opinion applies existing model rules, including those on competence, confidentiality of client information, communication with clients, and reasonable fees to lawyers’ use of generative AI tools. The announcement also notes that state and local bar ethics committees are likely to keep issuing their own guidance.

The opinion interprets the ABA’s model rules, and the rules that bind a particular lawyer depend on where they practice. Accountants, financial advisers, healthcare practices, and other regulated firms have their own professional bodies and regulators with their own expectations. This article is not legal advice, so confirm your obligations with your own counsel or professional body before you finalize your plan.

Put it into next year’s plan

You do not need to answer everything at once. A reasonable plan for 2027 might begin with an honest inventory of the tools in use, then an approved-tools list with rules for information, then the account controls and review step that make those rules real. Give each item an owner and a date, as you would for any other part of the plan.

The goal is that you, and the clients who trust you with their information, can be confident in how you and your staff use AI.

If you want an independent view before adopting a new tool or project, our Secure AI Adoption Review looks at one AI tool or project before it rolls out and ends with a decision record. The free Security Reality Snapshot checklist includes a question about AI tools and is a simple place to start.