AI is in your firm whether you've approved it or not.
According to Microsoft's own research, the majority of employees in professional services firms are already using consumer AI tools — ChatGPT, Claude, Gemini, Copilot — in their daily work. In law firms and accounting practices, that means client data, privileged communications, tax information, and financial records are being pasted into third-party AI systems with no audit trail and no data retention controls.
Muted red — unmanaged; data may leave your firm without controls or audit trail. Gold — manageable with proper IT configuration and governance.
Client data in consumer AI
Consumer AI tools process your prompts on vendor infrastructure, may use inputs for training, and have data retention policies that conflict with your confidentiality obligations.
Confidentiality violations
Bar association guidance and AICPA ethics rules treat sharing client information with third-party AI services the same as any other unauthorized disclosure — regardless of the employee's intent.
Coverage gaps
Cyber insurers are adding AI-related exclusions. If a breach occurs because an employee pasted client data into an unsanctioned AI tool, your insurer may dispute coverage.
NYDFS, IRS 4557, HIPAA
If your firm is subject to Part 500, IRS 4557, or HIPAA, uncontrolled AI use creates reportable security incidents and potential regulatory exposure — even if no breach occurred.
AI governance that enables, not just blocks.
The goal isn't to ban AI — it's to give your firm the benefits of AI productivity while maintaining the data controls, audit trails, and governance framework that your clients, regulators, and insurers expect.
AI Usage Audit
We identify what AI tools are currently in use across your firm — installed applications, browser extensions, SaaS connections, and shadow AI activity. You can't govern what you don't know is there.
AI Acceptable Use Policy
A written policy — reviewed by your counsel — covering approved tools, prohibited uses, data classification requirements, and employee obligations. Practical enough that people will actually follow it.
M365 Copilot Readiness
Data classification, sensitivity labels, permissions audit, SharePoint governance cleanup, and conditional access — so Copilot can't surface data that employees aren't supposed to see in the first place.
Shadow AI Blocking
Web content filtering and Defender controls block consumer AI tools on firm-managed devices and networks. Approved tools get whitelisted; users get a policy-aware redirect, not a mysterious error.
DLP for AI-Adjacent Data
Microsoft Purview Data Loss Prevention rules configured to detect and block sensitive data — SSNs, client names, matter numbers, financial data — from being sent to external services including AI platforms.
AI Governance Training
A one-time firm-wide session (live or recorded) covering what tools are approved, why the policy exists, the risks for attorneys and accountants specifically, and how to use AI effectively within the approved framework.
Copilot is powerful. It's also a permissions audit in disguise.
Microsoft Copilot for M365 doesn't create new access to data — it surfaces existing access. If your permissions are overly broad (which they almost always are in law firms), Copilot will return emails, documents, and files that shouldn't be accessible to the person asking. This isn't a Copilot bug. It's your existing permissions problem, now visible.
Before enabling Copilot, every firm should run a permissions audit and data classification project. We scope and execute this as a standalone project — and it's valuable independent of whether you deploy Copilot, because it cleans up the underlying exposure.
SharePoint and OneDrive permissions audit — who has access to what, with overly-permissive shares flagged
Sensitivity label deployment — Microsoft Purview labels applied to document libraries and SharePoint sites based on data classification
Copilot governance policy configuration — controls over which users have Copilot access and what data is in scope
Written AI governance policy — covering Copilot acceptable use, data handling, and attorney/accountant-specific obligations
- Attorneys paste client matter details into ChatGPT to draft memos
- No audit trail of what data was sent where
- Depending on the tool, account type, and settings, prompts may be retained, reviewed, or used in ways that conflict with firm confidentiality obligations
- Copilot surfaces files from other matters
- Insurer learns of breach — questions AI data handling
- Regulator asks for AI usage policy — none exists
- Approved tools only, data doesn't leave firm infrastructure
- DLP rules block sensitive data from reaching external AI
- Enterprise agreements with zero data retention
- Permissions cleaned up before Copilot launch
- Written policy on file, training documented
- Annual policy review in Compliance tier
For firms over 50 users or with complex SharePoint environments, contact us for a scoped quote.
Want to know what AI is currently touching your firm's data?
We can tell you in the first conversation what the most common risks look like for your firm type, and what a governance program would cost to implement. No obligation, no jargon.
Free 15-Minute IT Consultation