Guide
How to keep client data safe when portfolio companies use AI
Keep client data safe by controlling three things: which AI tools staff use (company accounts with admin controls and terms that keep your data out of model training), what information goes into them (a simple public, internal and client data rule), and who checks the output (a person reviews anything that reaches a client). At most portcos the larger risk today is unmanaged use, not the AI itself.
Start with the risk you already have
Staff are using AI whether or not the company has set it up. In Liberty Mutual's 2026 Independent Agency Growth Study, 65% of agency staff said they had used AI for work in the past year, while only 14% said their agency had put an AI tool in place, and only 22% said they trusted AI with client and business data. Use is running ahead of the company's tools and rules, which usually means personal accounts the company can't see.
1. Move AI work into company accounts
- Use business plans the company controls, not personal or free accounts.
- Turn on single sign-on or two-factor authentication, and remove access when people leave.
- Confirm in the contract or data processing agreement that your data is not used to train the vendor's models, and how long it is kept.
- Prefer AI features inside the systems that already hold client data (the agency management system, CRM or ERP) over copying data into a separate chat tool.
2. Give people one rule they can remember
Sort information into a few groups and say where each may go:
| Information | Where it can go |
|---|---|
| Public | Any approved tool |
| Internal | Approved company tools only |
| Client and personal | Only tools approved for client data, and only what the task needs |
| Passwords, Social Security numbers, full bank or card numbers, health information | Nowhere, unless a specific tool is approved for that data in writing |
Our AI policy template for portfolio companies puts this rule on one page.
3. Keep a person on anything that leaves the company
AI drafts; people send. Quotes, coverage explanations, proposals, contract terms and prices get reviewed by a person before they go out. That protects clients from confident mistakes and keeps responsibility where it belongs.
4. Limit what AI tools can reach
Connecting an AI assistant to email, shared drives or core systems is where much of the time saving comes from, and where most of the exposure is. Connect one system at a time, give the tool the narrowest access that does the job, and keep a list of what is connected to what.
5. Plan for mistakes
Ask people to report the same day if client information went into the wrong tool or a mistake reached a client, and make it safe to do so. Then remove the data where the vendor allows it, revoke access if needed, and check your contracts and state law for any notice you owe.
Industry-specific checks
| Industry | Check |
|---|---|
| Insurance agencies | Carrier agreements may limit how policyholder data is shared. Coverage advice should stay with licensed staff. |
| Architecture and engineering | Client contracts often include confidentiality terms that cover project data used in proposals. |
| Staffing | Candidate records are personal data. Some cities and states regulate AI used in hiring decisions, for example New York City's Local Law 144. |
| Distribution | Customer-specific pricing and margins are commercially sensitive. Check customer contracts before sharing them with outside tools. |
Questions to ask any AI vendor
- Is our data used to train your models, and does the contract say so?
- Where is our data stored, and for how long?
- Can we delete our data, and can we export it?
- Do you support single sign-on, two-factor authentication and admin audit logs?
- Will you sign a data processing agreement, and who are your subprocessors?
- Do you have an independent security report, such as SOC 2, that we can review?
For the full rollout, see how to roll out AI across portfolio companies.
This guide is practical guidance, not legal advice. Have counsel review your policies, especially for regulated data.
Questions
Is it safe to put client data into ChatGPT?
It depends on the account. Client data should never go into a personal or free account. A business plan the company controls, with contract terms that keep its data out of model training, can be approved for specific client data under a written policy. Confirm the current terms with the vendor before approving it.
What is the biggest AI data risk at a portfolio company?
Unmanaged use. Staff are already using AI, often in personal accounts the company can't see or control. Moving that work into company accounts with clear rules removes more risk than any single technical control.
Do AI vendors train on the data you put in?
It depends on the vendor, the plan and the settings. Business plans from major vendors commonly exclude customer data from model training by default, but confirm it in the contract or data processing agreement for each tool you approve.