9
Here is a signal worth watching: serious money is now going into the question of whether AI actually changes how professionals work. Research centers are funding studies. Regulators are inviting comment. Institutions are spending real budgets to understand AI competence — not as an experiment, but as an obligation taking shape.
When funded institutions start investing in a question, it is no longer a trend. It is a direction — and the direction has consequences for professional firms whether they have noticed yet or not.
Competence is already a written duty. For attorneys, the ABA Model Rule 1.1 no longer leaves technology as an afterthought. Its comment frames competence as including an understanding of the benefits and risks of relevant technology — and the direction of travel since has only tightened, not loosened. The same question is creeping into the professional obligations of accountants, of firms that handle government data, and of any practice whose regulator thinks in terms of client protection.
The practical effect is that “we do not use AI” is ceasing to function as a defense. More and more, the question is not whether you use AI — everyone’s people use it one way or another. The question is whether you use it competently and safely: whether you understand what it touches, whether you have controls over where client data goes, and whether the people operating it know what they are doing.
Someone will ask your firm that question. It may be a client evaluating you, a vendor auditing you, an insurer pricing your professional liability, or a regulator following a complaint. When they ask, an honest answer depends on more than a slogan.
Competence is not a tool. It is a system. Three parts hold it together:
1. Policy. A clear, written position on what AI is permitted to touch, who decides, and what happens at the boundary. If the answer is “we just use it carefully,” you do not have a policy — you have an accident waiting for a question.
2. Control. Actual technical guardrails over where data goes. Not a promise in a terms page, but infrastructure you own or knowingly contract, where client data stays inside a boundary you can describe and defend.
3. Training. People who understand what they are deploying, what the risks are, and what the rules require. A firm where only a few people understand the exposure is a firm operating on borrowed time.
A firm that has all three can answer the competence question tomorrow. A firm that does not is exposed — whether anyone has asked yet or not.
The good news is that competence is buildable. It does not require becoming an AI lab, hiring an army of engineers, or buying an expensive platform on faith. It requires discipline: assess your actual exposure, deploy under your control, manage the capability continuously, and train your people. It is a program, not a purchase.
That is exactly the motion we run for firms that cannot risk their privilege. And it starts with one artifact: an honest picture of where you stand. The Confidential AI Exposure Checklist is the first five minutes — the questions that tell you whether your firm can answer the competence question, or is hoping no one asks. Nine lives. Zero leaks.