Law firms, medical practices, accountants and financial advisers are adopting AI for the same reasons as everyone else: drafting, summarising, notes, research. The difference is what goes into the tools. A paragraph from a client file, a patient’s history or an account statement isn’t just company data. It comes with professional duties attached.
That’s why AI governance matters more in regulated industries. It doesn’t mean banning AI. It means knowing which AI tools are in use, what data goes into them, who approved them, and being able to show that.
This post is general information, not legal advice. Your own regulator, bar or professional body sets the rules that apply to you.
Why regulated businesses can’t treat AI like any other app
- AI use is already widespread and unmanaged. 78% of people who use AI at work bring their own tools, and 80% at small and medium-sized companies. (Microsoft and LinkedIn 2024 Work Trend Index)
- Ungoverned AI costs more when things go wrong. In IBM’s study, one in five organizations had a breach involving shadow AI, and 63% of breached organizations had no AI governance policy or were still writing one. (IBM Cost of a Data Breach Report 2025)
- Professional duties don’t pause for new tools. The guidance below makes the same point in three industries: existing rules already apply to AI.
What regulators and professional bodies have said
Law firms: ABA Formal Opinion 512
In July 2024 the American Bar Association issued its first ethics opinion on generative AI. It applies the existing Model Rules rather than creating new ones. (ABA Formal Opinion 512) The key points:
- Competence: lawyers need a reasonable understanding of what a tool can and can’t do, and must check its output.
- Confidentiality: for many AI tools, the client’s informed consent is needed before information about their matter goes in. General boilerplate in an engagement letter isn’t enough.
- Supervision: partners must make sure staff and outside providers are trained on how AI may be used.
- Fees: lawyers generally can’t bill clients for time spent learning an AI tool.
State bars apply their own rules, so firms should check their own jurisdiction too.
Broker-dealers: FINRA Regulatory Notice 24-09
In June 2024 FINRA reminded member firms that its rules apply to generative AI just as they do to any other technology, whether a firm builds the tool or uses AI built into a vendor’s product. (FINRA Regulatory Notice 24-09) In practice:
- Supervision policies should cover how AI tools are governed, including data privacy and the accuracy of what they produce.
- Communications rules apply whether a person or an AI tool wrote the message.
- Firms should test tools before rolling them out, to make sure they can still meet existing obligations.
Healthcare: HIPAA and the business associate agreement
There’s no special HIPAA rule for AI yet, but the existing ones already reach AI vendors. A vendor that creates, receives, keeps or sends protected health information for a practice is a business associate, and a business associate agreement has to be in place first. (HHS, Business Associate Contracts; HHS, Guidance on HIPAA and Cloud Computing)
In practice, a free AI chatbot on a personal account almost certainly has no such agreement with the practice. Patient details shouldn’t go into it.
The common thread: five things to put in place
The three industries face different rules, but the practical steps are the same:
- Know what’s in use. List every AI tool staff use, including personal accounts, browser extensions and AI apps connected to mail and files. You can’t apply any rule to tools you don’t know about.
- Know what data goes in. Watch for client, patient or account data being pasted or uploaded into AI tools, especially on personal accounts.
- Give each tool an owner and a decision. Approved, approved with limits, or not approved. Record who decided and when it’s next reviewed.
- Close what’s left open. AI apps people connected and forgot often keep full access to mailboxes and files for months.
- Keep the record. If a client asks how AI is used at your firm, you need to be able to show the tools, the decisions and what changed.
A worked example: a 20-person law firm
This is an illustrative example, not a real client. A litigation firm’s MSP runs a first AI review.
- Found: associates using ChatGPT on personal accounts for first drafts; two AI meeting note-takers connected to partners’ calendars and mailboxes, one unused since spring; an AI writing extension that can read every page in the browser.
- The risk: client matter details going into tools with no agreement and no record, and a forgotten note-taker still able to read partner email.
- What changed: the firm approved one AI tool with business terms for drafting, revoked the unused note-taker, removed the extension, and set a simple rule: no client information in personal AI accounts. The MSP keeps a register of every AI tool, its owner and its review date, and the firm updated its engagement letters to explain its AI use in plain language.
Checklist for regulated businesses
- Every AI tool in use is listed, including personal accounts and extensions.
- Each tool has an owner, a decision and a review date.
- There is a written rule on client, patient or account data in AI tools.
- AI vendors that handle regulated data have the right agreements in place.
- Unused AI app access to mail and files has been revoked.
- Staff have been told which AI tool to use, and why.
- Pastes and uploads of sensitive data to AI tools are noticed.
- There’s a record of decisions and changes you could show if asked.
How Centeye helps
Centeye Lumen is the AI governance and registry platform. It finds which AI tools are in use and by whom, including personal accounts, and shows how much data is pasted or uploaded and where to, without ever reading the content. It keeps the register: every AI tool, who uses it, what it can reach, who owns it and when it’s next reviewed. It also revokes forgotten AI app access at your setting and coaches people in the moment, pointing them to the approved tool.
Lumen gives you the facts and the record. Your professional obligations, and the decisions about them, stay with you and your advisers.
Read more: shadow AI detection, how company data leaks into AI tools, and AI governance for AI agents. Want to see what’s in use at your firm? Start a free trial.
Frequently asked questions
Can a law firm use ChatGPT?
The ABA’s opinion doesn’t ban AI tools. It says lawyers must understand them, protect client confidences, and in many cases get informed client consent before client information goes in. A business account with clear data terms is very different from a personal account. Check your state bar’s guidance as well.
Can a medical practice put patient information into an AI tool?
Only if the AI vendor is acting as a business associate under a business associate agreement, and the use fits HIPAA’s rules. Free consumer AI tools generally don’t offer that agreement, so patient information shouldn’t go into them.
What does FINRA expect from firms using AI?
FINRA says its existing rules apply, including supervision and communications rules, whether a firm builds an AI tool or uses one inside a vendor’s product. Firms should cover AI in their supervisory policies and test tools before using them.
What is an AI register?
A simple, current list of every AI tool in use: who uses it, what data it can reach, who approved it, any limits, and when it’s next reviewed. It’s the single most useful document for showing how AI is governed.
Guidance and figures cited from ABA Formal Opinion 512 (July 2024), FINRA Regulatory Notice 24-09 (June 2024), HHS guidance on business associate contracts and on HIPAA and cloud computing, the Microsoft and LinkedIn 2024 Work Trend Index, and the IBM Cost of a Data Breach Report 2025. The worked example is illustrative. This post is general information, not legal advice. Centeye describes only capabilities that ship in the product today.