Why AI Use Needs Governing Here
Financial staff ask AI about statements, spreadsheets and customer files, which carry account numbers and personal data. The GLBA Safeguards Rule and PCI DSS apply whatever tool the data reaches, and examiners now ask how AI use is controlled.
The Policy a New Client Starts With
A client created with the Financial Services industry starts with these policy packs:
- PCI DSS — Cardholder Data. Block card numbers; redact bank details.
- Personal Data (GDPR/GLBA). Redact government IDs; warn on bulk contact data.
- Sensitive Documents. Contracts, financial statements, HR and medical records, customer lists and credential files may only go to approved AI apps.
Every client also gets the baseline packs: Credentials & Secrets, CMMC — CUI & Export Control, Visibility Baseline, Prompt Injection & Jailbreaks.
Setting It Up
- Apply the PCI DSS and personal data packs: card numbers blocked, bank details and government IDs redacted.
- Add the firm's customer records as an exact-match list so its own data is recognized.
- Approve one assistant with work accounts only and block data-analysis tools that aren't approved.
- Use the monthly report as evidence for the Safeguards Rule and the firm's examiners.
Start every client in observe-only mode for two weeks, so the decisions are made on what staff actually use. The shadow AI audit describes the steps.
AI Apps to Decide On First
- DigitsMedium
- Vic.aiMedium
- Julius AIHigh
- Hex MagicMedium
- ChatGPTMedium
- ClaudeMedium
- Google GeminiMedium
- Microsoft CopilotLow
- Meta AIMedium
- Hugging Face (Chat & Spaces)Medium
- LMArenaHigh
- GrokMedium
- Mistral Le ChatMedium
- PiMedium
- DeepSeekHigh
Compliance
GLBA, PCI DSS, SOC 2: the controls ProctoredAI evidences, the packs and the checklist.
Questions
Does the GLBA Safeguards Rule cover AI tools?
It covers customer information wherever it goes, so AI tools that receive it fall inside the firm's security program.
Can account numbers be removed instead of blocked?
Yes. Bank account and routing numbers can be redacted so the rest of the message still goes through, while card numbers are blocked outright.
Are customer lists recognized?
Yes, as a document type, and exact-match lists find the firm's own customer records without storing the raw values.
All industries · The MSP AI governance guide · AI policy template