When a practice worries about AI, it worries about the chatbot. Someone opened a tab, pasted something in, and nobody knows what.
That is a real problem and it is the smaller one. The larger one arrived by software update.
FINRA Regulatory Notice 24-09 says the rules apply whether a firm develops a tool itself or is "leveraging the technology of a third party, including through embedded features in existing third-party products."
Embedded features in existing third-party products. Your tax software. Your practice management system. Your document portal. Your email. The note-taker that joined the client call because it was on by default. Nobody in your office chose any of those, which is exactly why nobody in your office is governing them.
You cannot write a policy about tools you have not listed. And the tools nobody chose are the ones nobody lists.
The exercise
Take the list you already have of every piece of software the practice pays for. It is in your accounts payable. Beside each one, four columns.
Ask the vendor, in writing, and keep the answer
Do not fill the third column from a marketing page. Send the vendor a sentence and file the reply.
"Which features of your product use AI, are any of them enabled by default, where is our data processed when they run, and is any of it used to train models? Please reply in writing."
A written answer is worth more than a correct guess. It is the thing you would show someone later, and it costs you an email.
Why we are insistent about not trusting the page
Three of our own, from the last few weeks.
We went to install a tool and the install command in its own README did not work — the package simply does not exist under that name. Not a typo in somebody's walkthrough. Wrong at the source, and fifteen seconds of checking would have caught it, which is precisely why we now check.
We found a "free, unlimited, today only" offer that people were still linking to as live. It had expired on 22 July. Nothing on the page said so, because nothing on the page carried a date at all.
And we swept our own site for a fault by searching the source, which found exactly the fault we had already named and nothing else. The real answer needed rendering every page and looking at it. That one applies directly here: searching your vendor list for the word "AI" will find the vendors who market it, not the ones who have it.
What the finished page is worth
One dated sheet that answers, in your own building, the first question any examiner, insurer, referral partner or slightly nervous client is going to ask: what AI is in use here?
Before it, the honest answer is "I'm not certain, and I'd have to find out." After it, the answer is a page with a date on it. That is the whole change, and it is a bigger one than it sounds — most of the anxiety in this subject is not about risk, it is about not knowing.
What to do
Hand it to whoever owns the software renewals. They already have the list, which is the only genuinely tedious part, and nothing in the exercise needs the person who signs the returns.
Have it done in one sitting, badly, this week. An incomplete sheet with three "don't knows" on it beats a perfect one that never gets made, and the "don't knows" are simply the agenda for the calls.
Then put a date on it and diary it for six months. The only thing that makes this page worthless is letting it go stale without anyone noticing — the same failure as the offer page that never carried a date.