Firms that hold information other people trusted them with.
Every firm on this page already has staff using AI, whether or not anyone approved it. The obligations attach either way. The engagement is the same in each: the permissions reviewed before anything is switched on, the data controls set in the tenant the firm already pays for, and each control dated when it is met. What changes is the rule each control answers to.
Accounting and tax firms
FTC Safeguards Rule, 16 CFR Part 314. Internal Revenue Code §7216, which attaches criminal penalties to the unauthorized disclosure of tax return information.
16 CFR 314 · 26 U.S.C. §7216
A preparer on a deadline checks a schedule by pasting part of a return into whatever chat tool is open. Nothing stops the file going there, and the firm has no record of it.
A read-only Baseline Assessment, then a governed Microsoft 365 Copilot deployment that includes the Return Reviewer, an agent built for tax practices. Client tax return information goes into it only with each client's consent under 26 CFR 301.7216-3.
Wealth managers and financial advisors
Advisers registered with the SEC are covered by Regulation S-P, amended in May 2024 to require a written incident response program and notice to affected customers as soon as practicable and no later than 30 days after becoming aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred. Advisers not required to register with the SEC are named by the FTC as covered by the Safeguards Rule.
SEC press release 2024-58 · FTC Safeguards Rule business guidance
Client reviews and meeting summaries drafted from account statements, often in a personal AI account. If an incident happens tomorrow, the question is whether the practice can produce its response plan and its notice, in writing, on time.
A read-only Baseline Assessment mapped to whichever rule applies, then the governed deployment. Advisers affiliated with a larger network keep that network’s requirements, and the engagement is built to meet them rather than replace them.
Law firms
Model Rule 1.6 on confidentiality. ABA Formal Opinion 512, issued July 29, 2024, addresses lawyers’ use of generative AI under the duties of competence, confidentiality, communication and reasonable fees, including when client consent is needed before client information goes into a generative AI tool.
ABA announcement of Formal Opinion 512
Matter details summarized in a consumer tool to save an hour. Malpractice carriers are beginning to ask how a firm governs AI use.
The same assessment and deployment, with the confidentiality obligations mapped in place of the tax statute.
Mortgage brokers and lenders
FTC Safeguards Rule, 16 CFR Part 314. The FTC names mortgage lenders and brokers among the financial institutions the rule covers.
FTC Safeguards Rule business guidance
Every loan file holds returns, bank statements and Social Security numbers in one place. Closing funds are what wire fraud targets, and most offices have already had a scare.
The same Baseline Assessment used for tax practices, because it is the same rule.
Medical, dental and therapy practices
HIPAA Security Rule, 45 CFR Part 164, Subpart C. Section 164.308(a)(1)(ii)(A) requires an accurate and thorough risk analysis, and the rule applies directly to business associates as well as to the practice.
45 CFR Part 164 Subpart C (eCFR)
Visit or session notes drafted in an AI note-taking tool nobody approved. For a therapy practice, those notes are the most sensitive records it holds.
A read-only assessment that includes the documented risk analysis. Engagements that involve protected health information are covered by a business associate agreement.
Also reached by the Safeguards Rule
Collection agencies, finance companies, credit counselors, check cashers, account servicers, non-federally insured credit unions, and dealerships that arrange financing or lease vehicles. The same engagement applies.
FTC Safeguards Rule business guidance and FTC automobile dealer FAQ
The same engagement, every time
Statute, obligation, control, evidence, answer. Every engagement follows the same order, and the answer a firm hands to the person asking is never a certificate. It is a dated record of what was in force.
Questions firms ask before they call
Does the FTC Safeguards Rule apply to my accounting firm?+
If your firm prepares tax returns or otherwise handles consumer financial data, yes. The FTC names tax preparation firms and accountants among the financial institutions 16 CFR Part 314 covers. Firm size changes which paragraphs apply, not whether the rule does: below 5,000 consumers, 314.4(b)(1), (d)(2), (h) and (i) do not apply and every other paragraph still does.
Is my affiliated RIA covered by SEC Regulation S-P?+
If the adviser is registered with the SEC, yes. Regulation S-P was amended in May 2024 to require a written incident response program and notice to affected customers as soon as practicable and no later than 30 days after becoming aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred. An adviser not required to register with the SEC is named by the FTC as covered by the Safeguards Rule instead, so one rule or the other reaches the advisory arm.
Does HIPAA apply to my dental or therapy practice?+
If the practice transmits health information electronically in connection with a covered transaction, it is a covered entity and the HIPAA Security Rule at 45 CFR Part 164, Subpart C applies. Section 164.308(a)(1)(ii)(A) requires an accurate and thorough risk analysis. The rule also reaches business associates directly, which includes vendors who handle protected health information on the practice's behalf.
Can a law firm use ChatGPT on client matters?+
Model Rule 1.6(c) asks the lawyer to make reasonable efforts to prevent unauthorized disclosure of information relating to the representation. ABA Formal Opinion 512, issued July 29, 2024, addresses generative AI under the duties of competence, confidentiality, communication and reasonable fees, including when client consent is needed first. The Model Rules are models; your state's adopted rule is the one that binds you.
Are mortgage brokers covered by the Safeguards Rule?+
Yes. The FTC names mortgage lenders and mortgage brokers among the financial institutions 16 CFR Part 314 covers. A loan file holds returns, bank statements and Social Security numbers in one place, which is why the rule reaches it.
What if my firm is not on this page?+
The Safeguards Rule also reaches collection agencies, finance companies, credit counselors, check cashers, account servicers, non-federally insured credit unions, and dealerships that arrange financing or lease vehicles. If your firm holds records other people trusted you with, the engagement is the same and the rule is the variable.
Is the engagement different for each industry?+
No. The permissions are reviewed before anything is switched on, the data controls are set in the tenant the firm already pays for, and each control is dated when it is met. What changes is the rule each control answers to, and therefore what the evidence has to show.
General reference, not legal or tax advice. Each rule is cited to the source shown. Claremont Security does not perform audits, issue certifications, or attest to any examination.