9
Most firms don’t have an AI problem. They have a data-leak problem wearing an AI costume. The tools are new, but the exposure is old: confidential information leaving the building through a channel no one controls, under terms no one read, into a system no one can audit.
Where does AI already sit in the firm? The partner pasting a draft into a free chat tool. The paralegal running a conflict check through a public prompt. The accountant summarizing a client’s return in a browser tab. None of it was approved, none of it was logged, and none of it can be recalled. That is shadow AI, and it is the single largest unmanaged risk in most professional firms today.
You don’t need a consultant to tell you whether you have a problem. You need five minutes and a clear set of questions. Here is the walkthrough.
1. Where does your data actually go?
Take the three most sensitive documents your firm touched this week — a draft engagement letter, a client’s financial statement, a matter file. Ask where each one lives, who can open it, and whether any version of it has ever been pasted into a tool outside your walls. If you cannot answer with certainty, the data has already left.
2. Who is using AI, and who knows about it?
Walk the floor. Ask your team directly which AI tools they use for work. The gap between what they admit and what they actually use is your real exposure. Most firms discover the tools they never sanctioned, the subscriptions they never paid for, and the data those tools now hold.
3. What did you agree to when you clicked?
Every public AI tool has terms. Most reserve the right to use what you submit to improve their models. That means your client’s confidential information is now training data in a system you cannot see, cannot audit, and cannot delete. Read the terms of the tools your people use. If you can’t, that’s the answer.
4. Could you prove what happened?
If a client, regulator, or insurer asked you today to show exactly what data went where, could you? Not a policy on a shelf — an actual record. If the answer is no, you are not merely exposed; you are unprovable, and in a professional firm, unprovable is indefensible.
5. What would you do if it leaked?
Run the scenario. A client’s confidential information appears in a model’s output, or a regulator asks how you protect privilege. Do you have a response, or do you have a crisis? The firms that survive are the ones that can answer before the question is asked.
Five minutes. That is all this takes. If any answer made you uncomfortable, you have found your exposure — and you have found the reason to close it.
Start with the Confidential AI Exposure Checklist at 9tailsadvisory.com/checklist/. Nine lives. Zero leaks.