{"id":4545,"date":"2026-10-07T02:39:54","date_gmt":"2026-10-07T07:39:54","guid":{"rendered":"https:\/\/cmitsolutions.com\/boston-ma-1020\/?p=4545"},"modified":"2026-10-05T03:00:01","modified_gmt":"2026-10-05T08:00:01","slug":"what-ai-changed-about-the-security-questions-worth-asking","status":"publish","type":"post","link":"https:\/\/cmitsolutions.com\/boston-ma-1020\/blog\/what-ai-changed-about-the-security-questions-worth-asking\/","title":{"rendered":"What AI Changed About the Security Questions Worth Asking"},"content":{"rendered":"

Almost every firm I talk to now has people using<\/span> AI tools<\/span><\/a> during the working day. Drafting, summarizing, cleaning up a spreadsheet, turning a rough set of notes into something presentable. Very few of those firms decided to allow it. It simply happened, the way<\/span> cloud storage<\/span><\/a> happened about a decade earlier.<\/span><\/p>\n

I am not going to tell you to ban it. That advice does not survive contact with a busy team, and it was not good advice anyway. The useful questions are narrower and more answerable than the conversation usually suggests.<\/span><\/p>\n

Four questions that are worth an hour of your time<\/b><\/h2>\n

Which tools are in use, and who is paying for them<\/b><\/h3>\n

Start with the inventory, because most firms do not have one.<\/span> Personal accounts<\/span><\/a> are the common case, and a personal account means the firm has no visibility, no record, and no way to remove access when somebody leaves. That is an ordinary access control problem rather than an AI problem, and it has ordinary fixes.<\/span><\/p>\n

What happens to what gets pasted in<\/b><\/h3>\n

Consumer versions of these tools and business versions of the same tools handle submitted content differently. That distinction is the single most consequential thing to understand, and it is knowable. A firm holding<\/span> client financial records<\/span><\/a>, patient information, or customer data held under contract should know the answer for every tool in use before deciding what is acceptable to put into it.<\/span><\/p>\n

\"\"<\/p>\n

What your own client agreements already say<\/b><\/h3>\n

Before worrying about regulation in general, read the<\/span> confidentiality language<\/span><\/a> you have already signed. <\/span>Many professional services agreements contain commitments about subcontractors and<\/span> third party processing<\/span><\/a> that were written years before any of this existed but apply to it cleanly.<\/span> That is usually where the real constraint sits.<\/span><\/p>\n

Is there an AI acceptable use policy that everyone has bought into<\/b><\/h3>\n

Most firms do not need a long document. <\/span>They need an AI<\/span> acceptable use policy<\/span><\/a> that settles three things: which tools are approved, what data may and may not go into them, and the security requirements every tool has to meet, such as business accounts and multifactor authentication.<\/span> It should also say who to ask when the answer is unclear. The part that matters most is buy in. A short policy that everyone has read and agreed to is worth considerably more than a long one that sits in a shared drive.<\/span><\/p>\n

What I would put in place first<\/b><\/h2>\n

If a firm asked me to spend one day on this, I would not start with anything branded as AI. I would start with the controls that make any of it manageable.<\/span><\/p>\n