The AI you are probably already running
Most of these arrive as a feature of something you bought rather than as a project anyone called AI. That is exactly why they are missing from the register.
- Legal research and drafting assistantsWhere hallucinated citations have already produced regulatory reports and judicial criticism.
- Document review and disclosureHigh volume, client-confidential, and often the first place a firm deployed AI at scale.
- Contract analysis and due diligenceClient data, frequently under an NDA that says nothing about third-party processing.
- Audit analytics and anomaly detectionTouches professional scepticism: the auditor remains accountable for a judgement the tool influenced.
- Tax research and computation assistantsConfident wrong answers on a subject where the firm carries the liability.
- Time recording, billing and matter triageLower risk, high adoption, and almost never recorded anywhere.
- Public generative assistants used informallyThe largest exposure in most firms, and the one nobody has a register for.
Confidentiality is not a policy here, it is the product
Client data is the one thing a professional services firm cannot afford to lose control of, and AI tools are unusually good at moving it somewhere nobody intended. A single paste into a public assistant can put privileged material outside the firm, and there is no version of that which gets undone afterwards.
The exposure is also individual rather than institutional. Adoption happens fee earner by fee earner, on tools bought with a card or used on a free tier, which means the firm's real AI estate is invisible to everyone including the people accountable for it. A register with named owners is how that becomes something you can supervise.
What you get
A register of what people actually use
Shadow AI surveys surface the assistants adopted informally by fee earners and support staff, which is where most of a firm's exposure sits and where procurement records show nothing.
Data handling recorded per tool
What client data goes in, where it goes, what the vendor guarantees, and whether anything is shared onward — captured per tool rather than assumed from the contract.
Named owner and oversight per system
Who is accountable for each tool and who reviews its output, so supervision is evidenced rather than asserted.
Guardrails and acceptable use recorded
What each tool may and may not be used for, held against the tool itself rather than in a policy document nobody opens.
Policy library tied to systems
Policies linked to the systems they govern, with review dates, so the gap between what the policy says and what is running is visible.
Audit log of changes
Who changed what and when across the register — useful when your COLP, your insurer or a client asks how the firm controls AI.
What changes
A register of what your people actually use
Including the assistants adopted informally, which surveys surface and procurement records never will.
Confidentiality exposure recorded per tool
What client data it touches, where that data goes, and whether the contract permits it.
Supervision made evidenceable
Who owns each tool, who reviews its output, and what the firm expects of the professional using it.
A position for your COLP and your insurer
Both increasingly ask what AI the firm uses and how it is controlled. Most firms cannot currently answer, because nobody holds the list.
CXO Ready is an aid, not an assurance. It helps you structure your thinking, record what you have done and see where the gaps are. It does not make you compliant, and nothing it produces is legal advice or a regulatory opinion. Scores are indicative. Responsibility for compliance stays with your organisation, and decisions with legal consequences should be taken with a qualified adviser.
Before you start
Questions from law & accountancy
How do we know what our people are actually using?
Short surveys sent across the firm, framed as amnesty rather than audit. Responses come back as candidate systems for the register, which is consistently a mix of tools worth sanctioning properly and a few worth stopping. Procurement records will not show you this, because most of it was never procured.
What does CXO Ready record about each tool?
What it is used for, who owns it, what client data goes into it, where that data goes, what the vendor guarantees, and what the tool may and may not be used for. Plus who reviews its output — so supervision is evidenced rather than assumed.
Can this stop an AI tool inventing a citation?
No, and nothing can. What it does is make the expectation explicit and attributable: guardrails recorded against each tool saying what it may be relied on for, a named person accountable, and an audit trail of what changed. The verification stays a human job; the record of who owns it does not.
How does this apply to an accountancy practice?
The structure is identical: client confidentiality, a judgement the tool influenced rather than made, and a professional signing their name to the result. Audit analytics and tax research assistants sit in the register alongside everything else, with the same owner, data handling and oversight fields.
Our insurer has started asking about AI. What do they want?
Usually the same three things: what you use, who is accountable, and what stops confidential material leaving. A register with named owners, recorded data handling and an audit trail answers all three — and answering it well is increasingly a pricing question rather than only a paperwork one.
More in the full FAQ, or ask us directly.
Other sectors