What a data security specialist told us about AI and the client data it touches

Implemented correctly, AI pays a firm in two ways: in hours and fees that can be counted, and in the confidence of knowing its client data is safe and its use of AI is compliant. Both depend on getting the data right before any solution goes in.

Carl Jackett, one of the two founders of Rivello, made the same case in two long conversations with us over the past two weeks. Rivello helps small and growing businesses use data and new tools, AI included, while staying in control of the data they are responsible for. Its two founders have spent decades on difficult data problems in fields such as defence, fintech, banking and gaming compliance.

The benefit depends on the data work underneath it

Rivello never set out to do AI work, but more of its projects involve AI now. "You get so far and then you realise that actually the data implications can be slightly trickier than you might have thought," Carl told us. "But it's worth it, because the benefit's there."

We find the same in firms, so we check the data along with the firm's other AI layers before anyone talks about a solution. Every task the team tells us about is recorded with the information it uses, and one that touches client financial or personal data is flagged early. Depending on how serious it is, Carl said, a data problem either "triggers an intervention in its own right" or becomes "a further down the line one in the roadmap". Either way, the fix goes on the roadmap ahead of the solution that depends on it.

Client data has to be tracked wherever it goes

Checking the data also means tracking it. Much of Carl's work on these projects is mapping where data goes once a workflow uses it. That means knowing "you've got permission to put it into the workflow", and knowing "how would you delete it if someone said, 'Delete my personal data,' while not losing the benefit" of what the workflow produces. For Carl, "that's just data. Tracking and management."

The trail often starts in ordinary tools. Accountants, solicitors and mortgage advisers all need clients' bank statements and identity documents, and Carl said "loads of them are still using email, which is shocking from a security perspective." The usual workaround, a PDF with a password on it and the password sent by WhatsApp or text, is little better, and Carl put it bluntly: "It would take me about 30 seconds to break those passwords." Accounts are the other weak point. "What starts happening when people sign up to things is you lose the account control," Carl told us, when we showed how our reports list the AI a team already uses.

A solution that reads client documents reads them wherever they land, so how documents reach the firm and whose accounts the team uses belong in the data layer we check, and personal-account use is brought inside the firm's AI policy, on accounts the firm controls. Then each solution runs where its data allows: the AI provider's cloud only when nothing sensitive is in it, the firm's own server, where the provider never trains on what it sends, or a machine in the office, where the data never leaves the building. The AI policy also says what each solution keeps and how a request to delete someone's data would reach it.

To know exactly where your firm's client data goes once AI touches it, and what to do in the next 30 days to keep it secure, take the quiz below. It takes a few minutes.

Doing it correctly pays in two kinds of benefit

Carl asked us how we show the benefits that aren't hours. Dealing with risks like these "doesn't necessarily save them time, but it does make them more safe and secure," Carl said. Some owners care most about the money a solution saves and others about not getting it wrong. "They're not wrong or right," Carl said. "They're just different."

Implementing AI in a secure, compliance-driven and ROI-focused way gives a firm both kinds of benefit. The tangible ones can be counted. Every job has a time budget, and the fee is set from it. When a job runs over, the extra time is written off, so the firm bills less of the time it recorded, and the share it does bill is its recovery rate. When AI gets the work done inside the budget, less is written off, so the recovery rate, fee income and gross profit all rise, and the same people have room for more clients without adding headcount. Every solution is fully costed, so before the firm spends anything it can see the hours it frees up, what it costs to implement and the return in the first year.

The intangible ones are the ones Carl was describing. Every solution is checked for compliance, governance and data security before it is implemented, against the rules of every body the firm answers to, from its regulator to GDPR, so there are no nasty surprises afterwards. The firm can trust what comes out, because every solution keeps the check its owner makes today, and when a client, an insurer or a regulator asks how the firm uses AI, it has a clear answer ready. Carl also sees "quite a lot of danger, I think, in not knowing how this or the industry will progress". That risk is covered as well, because the firm owns its knowledge and rents the AI, and each solution is a set of instructions any agent can follow, so the firm can change provider without starting again.

What firm leaders should do now

Taken together, Carl's points set out the order a firm needs to follow to get both kinds of benefit, whoever does the work.

Start with the firm's own work, broken down into the individual tasks and processes that create value for its clients: who does each one, how long it takes, what data it uses and where it comes from, and who signs it off.

Before any solution, check the layers those tasks sit on: the business and each department, the tech stack, the quality, completeness and security of the data, compliance and governance, and the people who will work alongside the AI. Where a layer isn't ready, fixing it comes first.

Then set out a roadmap of solutions, each fully costed with the hours it frees up, what it costs to implement, its first-year return and what it does to the recovery rate on the jobs it touches.

Implement the solutions one by one, in the roadmap's order, each running where its data allows, with its risks designed out, covered by the AI policy and owned by a named person who checks what it produces before it reaches a client, so the standard of the work holds or rises. Once they are live, keep managing them as the models change, so their quality doesn't drop unnoticed.

Done in that order, the firm gets more capacity from the same team, hits its chargeable time targets and lifts its recovery rate, with AI that is compliant, keeps client data secure and takes the worry off the partners.

If you want us to do it for you, book a free call and we'll find you at least $50,000 a year in new business that AI can unlock. It's compliant, data-secure and has governance built in.

Know exactly where your client data goes, and how to keep it secure

Our quiz asks which AI your team uses, where client data goes, whether your clients have agreed to it and who checks the work. Your report shows where your firm stands today and gives you a 30-day plan to make its AI safe with client data.

We'll find you $50,000 a year in new business AI can unlock in 72 hours, or you don't pay.