Before you switch on AI in a client-facing system: seven questions

The AI is already in the building. Client portals, practice management systems, CRMs and help desks are adding AI features in routine updates, often switched off but one setting away. For a medical practice or a tax and accounting firm, that setting is a compliance decision, not a feature toggle.

The rules you already follow do not change because the software got smarter. Under HIPAA, a vendor that handles protected health information on your behalf needs a business associate agreement. Under the FTC Safeguards Rule, tax preparers and many other non-bank financial firms must oversee the service providers that touch customer information, and SEC-registered advisers have a similar duty under Regulation S-P. Turning on an AI feature usually means a new service provider is now receiving your records.

Question one: which AI vendor receives the data, and on what terms? Most built-in AI features send your records to a model provider. Find out which one, whether the account is a business plan, whether the provider retains or trains on your data, and whether you have the agreement your regulator expects, such as a business associate agreement or a data processing agreement.

Question two: do clients or patients need to agree? Some rules restrict how information may be disclosed or used, not just how it is stored. Tax preparers, for example, are bound by limits on using and disclosing tax return information. Ask your advisor whether your engagement letters or consent forms cover sending information to an AI provider, and whether any intended use counts as marketing. Disclosures to providers outside the United States generally require the taxpayer's specific written consent, so ask where the AI provider processes the data.

Question three: does your written security program cover it? Your written information security plan or HIPAA risk analysis should name the AI feature, the vendor, the data it receives and the controls around it. If the plan is silent, the AI feature is an unassessed risk.

Question four: who approves what the AI writes or decides? Look for an approval step before anything reaches a client or changes a record, and name the role responsible for it. That person should be on your staff, not your IT vendor's.

Question five: what can the AI actually see? Many tools share a broad set of fields by default. Narrow it to what each feature needs. Data the AI never receives cannot leak, be misused or be quoted back to the wrong person.

Question six: is every decision logged, and for how long? You want a record of what the AI decided or wrote, for whom, how confident it was and who approved it. Check how long that log is kept against your record retention policy.

Question seven: who owns the vendor account? If your IT provider or software consultant sets up the AI account on their card and in their name, your client data is flowing through an account you do not control. The firm should own the account and the key, with access granted to vendors as needed.

None of this means you should keep AI switched off. Used well, these features save real hours. It means the decision to switch them on belongs in the same process as any other new system that touches regulated information.

If you are not sure where your firm stands, our self-assessment walks through these questions alongside the rest of your IT and compliance basics.