Why Professional Services Firms Can't Use Cloud AI

The productivity story about AI is real. A senior associate can summarize a 200-page deposition in minutes. A CPA can draft an engagement letter in seconds. A partner can get a plain-language briefing on a new regulation without leaving their chair. The compliance story is different, and most firms are not having that conversation yet. They should be.

What "Cloud AI" Actually Means

When a partner pastes a document into ChatGPT, Claude, or Gemini, three things happen. First, the document is transmitted to the vendor's servers. Second, the model processes it on that infrastructure. Third, the output is returned. Depending on the vendor, account tier, and workspace settings, that document may be logged, cached, used for abuse monitoring, or seen by a human reviewer if a content filter trips.

This is not a security failure. This is how cloud AI works. The entire business model depends on the data flowing to the vendor. The only question is what happens to it once it arrives.

For most consumers and most businesses, that tradeoff is fine. For professional services firms governed by privilege, fiduciary duty, and specific statutory disclosure rules, it is not fine by default. It has to be justified, documented, and, in many cases, authorized by the client.

Why Law Firms Have a Different Problem

Three doctrines govern how a law firm handles client information, and cloud AI touches all three.

Attorney-client privilege protects confidential communications between lawyer and client made for the purpose of legal advice. Privilege can be waived. The most common way privilege is waived is by disclosing the communication to a third party. Pasting a client email into a cloud AI tool is, on its face, a disclosure to a third party. Whether that third party counts as a privilege-preserving agent of the firm is a question most firms have not answered. Most vendor contracts do not answer it either.

Work product doctrine protects materials prepared in anticipation of litigation. It is a more forgiving standard than privilege, but it still depends on the firm controlling the circulation of the material. Feeding work product through a vendor's infrastructure for processing is, again, a question most firms have not addressed in writing.

The duty of confidentiality under the ABA Model Rules of Professional Conduct (Rule 1.6) is broader than privilege. It covers all information relating to the representation, regardless of source. Rule 1.6(c) requires lawyers to make reasonable efforts to prevent inadvertent or unauthorized disclosure. Sending a client memo into a cloud AI system without a clear understanding of what happens to it is the kind of thing Rule 1.6(c) was written to prevent.

None of this means cloud AI is categorically off-limits. It means the decision to use it is a decision the firm has to make consciously, in writing, with client authorization where appropriate, and with a clear picture of what the vendor actually does with the data. Most firms using cloud AI today have not done that.

Why CPAs Have a Different Problem

Section 7216 of the Internal Revenue Code prohibits tax return preparers from disclosing or using taxpayer information for purposes other than preparing the return, unless the taxpayer provides specific written consent. The penalties are criminal. This is not an abstract rule. The IRS publishes guidance on what counts as disclosure and what consent looks like.

Running a client's tax data through a cloud AI vendor is a disclosure to a third party. Unless the firm has specific written consent from the client authorizing that disclosure, for that purpose, with that vendor, under that vendor's privacy terms, the firm is in violation.

Most firms using ChatGPT or Claude to "help with client prep" have not obtained that consent. Many have not read Section 7216 recently. Both problems are fixable, but the fix is not "hope the IRS does not notice." The fix is either getting real consent for real cloud AI use, or choosing an architecture where the data never leaves the firm in the first place.

The AICPA Code of Professional Conduct adds a separate layer. Rule 1.700 addresses confidential client information. A CPA's duty to protect client information is broader than Section 7216, and the "reasonable care" standard applies to technology choices including AI.

"But We're SOC 2 Compliant"

SOC 2 is a framework for service organizations to demonstrate controls around security, availability, processing integrity, confidentiality, and privacy. It is useful. It is not a permission slip for professional services firms to disclose privileged or regulated data to a cloud vendor.

SOC 2 tells you the vendor has documented controls and had an auditor check them. It does not tell you whether sending your specific client data to that vendor is authorized under Rule 1.6, Section 7216, or your engagement letter. Those questions are separate, and they are yours to answer.

The same applies to "we do not train on your data." Good. That handles one concern. It does not handle the disclosure question. Whether the vendor trains on your data or not, the data was still disclosed to the vendor the moment it left your network. Privilege and statutory disclosure rules care about the disclosure, not the downstream use.

The Questions Your Cloud AI Vendor Needs to Answer

If you are going to use a cloud AI vendor for client work, here is the short list. In writing, ideally in your MSA.

1. Where does our data go? Which countries, which data centers, which sub-processors.
2. Who can access it? Employee access, abuse reviewers, law enforcement requests, subpoenas. What is your notice policy when access is requested?
3. How long is it retained? Prompts, outputs, logs, caches. All of them.
4. What is logged? The full prompt? The full output? Metadata only?
5. Do you act as our agent for privilege purposes? This is a legal question. Most vendor contracts explicitly say they do not.
6. What is your breach notification timeline? Not "prompt" or "as soon as practicable." A number of hours.
7. Can we get a written agreement on all of the above that survives a discovery request?

If the vendor cannot answer those clearly, the firm cannot credibly claim it made reasonable efforts to protect the data. That is the standard Rule 1.6(c) uses. It is the standard AICPA Rule 1.700 uses. It is the standard a malpractice insurer uses when the question comes up after the fact.

The Real Options

There are three paths a professional services firm can take with AI, and each has tradeoffs.

Option 1: Do not use AI. This is a real option. It is becoming a less competitive one as other firms adopt AI for the non-sensitive parts of their work, but it is defensible. No disclosure, no new risk.

Option 2: Use cloud AI with scoped, documented, client-authorized workflows. Carve out specific use cases (marketing copy, general research, non-privileged drafting) where cloud AI is safe. Get the vendor's answers to the seven questions above. Document the boundaries. Train the team. Audit usage. This is work, and it is ongoing work.

Option 3: Go private. Run AI on infrastructure the firm controls, so the data never leaves. No vendor disclosure, no Section 7216 event, no Rule 1.6(c) question about reasonable efforts. The model runs on a machine in the firm's office. The prompts and outputs never cross the firewall. The compliance question collapses because the facts that made it a question stop being true.

Option 3 used to be prohibitively expensive and operationally complex. That has changed. Open-source models are now competitive with frontier cloud models for a large set of professional-services use cases. Consumer-grade hardware can host them. The operational complexity has dropped from "build a data center" to "plug in a box."

Where This Goes Next

The firms that have already had the compliance conversation are the ones moving first on private AI. They are not moving first because they are anti-cloud or anti-innovation. They are moving first because they did the analysis, and the analysis said: the only architecture that cleanly passes the privilege, Section 7216, and fiduciary tests is one where the data does not leave the firm.

The firms that have not had the conversation yet will have to have it eventually. Bar counsel is starting to weigh in. State accountancy boards are publishing guidance. Malpractice carriers are asking questions on renewal forms. The conversation is not going away.

The good news is that the answer is now buildable. Private AI is no longer a thought experiment. It is shipping. We wrote a companion piece on how it actually works if you want to see the architecture. If you want to talk through what the right architecture looks like for your firm, reach out.