9You are seven hours into a job that matters. Not busywork — the kind of engagement your firm’s name is staked on. The model has been working since morning, drafting, reviewing, tightening, nearly across the line. Then it stops. Not because it finished. Because a policy filter on the vendor’s side — a filter you have never seen, one that names no rule and cites no reason — decided the run would not continue. The work is not lost, exactly. It is simply interrupted. Held hostage to someone else’s definition of acceptable use, applied after the fact.
That scenario now unfolds regularly for professionals who have leaned on hosted assistants for real, consequential work. It is the detail that never makes it into the brochure: nobody advertises that the tool you depend on can be switched off mid-task, with no standard you can satisfy, no appeal, and no warning. The engine keeps running right up until the moment it doesn’t.
What this means for a firm that “can’t risk the privilege”
For a law practice, a CPA firm, a government contractor, this is not a support ticket. It is a risk event. Every argument for handing your firm’s intelligence to a hosted service assumes a working relationship — that you are a customer in good standing and the service will behave like one. A kill switch that fires for reasons you cannot read breaks that assumption at the exact moment you are most exposed.
Three reasons this should change how you buy AI capacity:
1. A vendor that can stop your run can stop your matter. Deadline-sensitive work — a filing, a response, a closing, a privileged analysis the morning before it matters — cannot tolerate a remote party deciding, without explanation, that the work no longer proceeds. When the disruption penalty lands on your firm’s timeline and reputation, the cost of the interruption is yours, not the provider’s.
2. An invisible rule is a rule you can never comply with. If the terms were clear, you could plan around them — pre-clear the work, split it differently, choose a different tool. But a filter that names no rule leaves you unable to satisfy it. You cannot engineer around a boundary you cannot see. That is not a service; it is an unresolvable dependency.
3. The finish line is exactly when you are most locked in. The painful scenario is not the small job that trips a filter early. It is the long, expensive run — hours in, near completion — where the sunk cost makes you willing to accept almost anything to get the result. That is precisely when a vendor’s discretion bites hardest, and it is precisely the work your firm should never hand over.
The control argument, stated plainly
None of this argues against AI. It argues against depending on AI you do not control. The open-weights models that now run privately on hardware a firm already owns carry none of this exposure: the run starts when you start it, continues until you stop it, and stops for exactly one reason — because you decided so. Your confidential work never leaves the environment you govern, and nothing on the outside can reach in and terminate it mid-matter.
Add to that the confidentiality argument and the case is complete. A run you cannot be cut off from, on data that cannot leave your control, is the only configuration that leaves a professional services firm both protected and provable. The hosted model is powerful. But power you cannot keep in the room with you is power you don’t actually hold.
Before your firm commits to another hosted dependency, see exactly where your exposure sits. Take the Confidential AI Exposure Checklist — five minutes, no obligation — and find out which of your firm’s AI runs can be switched off by someone you will never meet.