Hi Josh! I've been following your articles for a while now. I used Claude AI to help me evaluate my (long out of date) WISP and go through what I needed to be in compliance. Now, though, it feels like every day I have to stop myself from using various tools available to me while wondering "is this going to violate my WISP" and it feels like EVERYTHING is a violation. AI is being built into so many of the services and tools I use in my business, and now Apple Intelligence is on my Mac. What are your thoughts on how to navigate this brave new AI-included-in-everything world while protecting client data from inadvertent disclosures?
Thank you for being a subscriber and for asking this. That "is this a violation?" feeling is something a lot of people have.
A WISP isn't a list of banned tools. It's a framework for deciding where client data goes. When AI shows up in a tool, I ask three questions:
Where does the data go? Who keeps it? Can it be used for training?
Translation: the AI label matters less than the data flow behind it.
A few practical moves:
Keep an approved tools list in your WISP. Decide once which tools are cleared for client data, so you aren't re-deciding every morning.
Default to off. In any app that holds client data, disable AI features until you've reviewed the vendor's terms. Under the FTC Safeguards Rule, an AI feature is just another service provider you need to oversee.
On Apple Intelligence, much of it runs on the device or through Apple's Private Cloud Compute. The ChatGPT integration is a separate opt-in, and I'd leave it off on your client work machine.
Keep identifiers out. Even with tools you trust, don't paste in SSNs or account numbers.
Document your decisions and review them each year. Regulators want to see that you were thoughtful (perfection realy doesn't exist), and you're already doing that by asking.
Hi Josh! I've been following your articles for a while now. I used Claude AI to help me evaluate my (long out of date) WISP and go through what I needed to be in compliance. Now, though, it feels like every day I have to stop myself from using various tools available to me while wondering "is this going to violate my WISP" and it feels like EVERYTHING is a violation. AI is being built into so many of the services and tools I use in my business, and now Apple Intelligence is on my Mac. What are your thoughts on how to navigate this brave new AI-included-in-everything world while protecting client data from inadvertent disclosures?
Thank you for being a subscriber and for asking this. That "is this a violation?" feeling is something a lot of people have.
A WISP isn't a list of banned tools. It's a framework for deciding where client data goes. When AI shows up in a tool, I ask three questions:
Where does the data go? Who keeps it? Can it be used for training?
Translation: the AI label matters less than the data flow behind it.
A few practical moves:
Keep an approved tools list in your WISP. Decide once which tools are cleared for client data, so you aren't re-deciding every morning.
Default to off. In any app that holds client data, disable AI features until you've reviewed the vendor's terms. Under the FTC Safeguards Rule, an AI feature is just another service provider you need to oversee.
On Apple Intelligence, much of it runs on the device or through Apple's Private Cloud Compute. The ChatGPT integration is a separate opt-in, and I'd leave it off on your client work machine.
Keep identifiers out. Even with tools you trust, don't paste in SSNs or account numbers.
Document your decisions and review them each year. Regulators want to see that you were thoughtful (perfection realy doesn't exist), and you're already doing that by asking.
That is a very good idea.