Trust is the whole job.

How a session is set up

• Before every engagement, I get written confirmation of which AI tools and plans your firm has approved, and what data rules apply.
• Every demo and practice task uses a fake firm with fake clients.
• I never copy client information into my own AI accounts, email, notes, or drives. If I need to see something, I view it on your screen, in your system.
• Sessions are recorded only with permission, and only when the exercises use sample data.
• If I believe anything sensitive was exposed, I stop and tell your contact the same day.

I don’t write or interpret your policies. I help your people follow them.

Habits I teach

General training, not your firm’s policy. Where your written rules differ, those rules win.

• Use the approved tool, on your work account. Don’t install browser extensions or extra “AI helpers” without IT’s okay.
• Keep client identities out, unless the written policy explicitly allows them. A placeholder works.
• Never paste passwords, security codes, or login links.
• Treat unpublished firm information the same way: financials, deal terms, and personnel matters.
• Check every output for wrong facts, invented sources, bad math, and promises you cannot make.
• Don’t use AI to make a tax, investment, coverage, or legal decision. A qualified person decides.
• Client letters and anything that sounds like advice still go through your firm’s review.
• Keep records the way your firm already requires. An AI draft does not change that.
• Be careful with uploads and recordings. They can capture more than you meant to share.
• If something feels wrong, ask. If a mistake happens, tell your contact the same day.

Don’t paste it

Unless your firm’s approved tool and written policy say otherwise, never paste:

• Social Security numbers, tax IDs, dates of birth, or driver’s license or passport numbers.
• Account, routing, policy, or loan numbers, or balances tied to a name.
• Client names together with financial, health, or family details.
• Passwords, security answers, or login links.
• Unpublished firm financials, deals, or anything marked confidential.
• Anything you wouldn’t put in an email to the wrong person.

When you are unsure, remove names and numbers (“Client A,” “$X”) or ask your compliance officer.