Industry
Compliance
Financial ServicesSEC Regulation S-P
An employee exposes client data in an AI tool. Here is how an RIA or broker-dealer asks the vendor to delete it, what vendors actually commit to, and how the request fits the Regulation S-P notice decision and records.
GLBA
An AI tool approved last year may not be the same product today. What GLBA and Reg S-P expect for ongoing AI vendor risk management, what to check in an annual review, and how to document it for examiners.
AECCIS Controls
AI add-ins for Revit, AutoCAD and Bluebeam run inside the software that holds client drawings. A checklist for architecture and engineering firms on vetting each plugin, how each program loads them and keeping unapproved ones off workstations.
Non-ProfitCIS Controls
A simple AI tool approval process for nonprofits: a five-question request form, a vendor terms check, three data tiers and a register that keeps donor and client data in accounts the organization controls.
Law FirmsNIST CSF 2.0
Attorneys work from courthouses, client conference rooms and hotels on networks the firm does not control. Here is a practical approach to law firm remote access that meets confidentiality and competence duties without slowing attorneys down.
Non-ProfitCIS Controls
Volunteers use their own phones and laptops, and AI tools are a tap away. Here is how a nonprofit can stop AI sign-ups with organization accounts and keep donor and client data out of personal AI apps.
AccountingFTC Safeguards Rule
Step-by-step browser DLP rules for CPA firms: detect SSNs, ITINs, EINs and bank numbers, stop pastes and uploads to unapproved sites and AI tools, and tune the rules before filing season.
CCPA
California's DROP platform sends one deletion request to every registered data broker. Here is what brokers must do every 45 days, what the fines and audits look like, and what changes for firms that buy prospect lists or data appends.
Non-ProfitHIPAA
Case managers paste notes into free AI tools to save time, and that can breach VAWA, HIPAA or county confidentiality terms. A checklist for an approved tool, web filtering, browser DLP and a one-paragraph rule.
CCPA
California's ADMT rules apply from January 1, 2027. This checklist covers what an ADMT pre-use notice must say, how the opt-out and the human appeal exception work, and how fast a business must answer ADMT access requests.
CCPA
California will require browsers to offer an opt-out signal on January 1, 2027. Regulators have already fined businesses for ignoring Global Privacy Control. Here is what the rules require, what enforcement shows, and how to test your site.
CCPA
A CCPA request to know gives you 45 days to produce categories or specific pieces of one person's data, back to January 2022. The data inventory fields that make a response possible, and what must stay out of it.
New articles for your industry
