iscover 
Here is a scenario playing out in brokerages across Australia right now.
A broker is working through a client’s refinance. There’s a bank statement to summarise, two lender policies to compare, and a cover note to write. They open an AI chat tool on a personal account they set up months ago, paste in the client’s details, and have what they need in a few minutes. It’s a sensible thing to do, and nobody in the business ever said otherwise, because the business has never said anything about AI at all.
Now picture that happening across 12 staff, most days, for six months. The business has a large amount of client financial information sitting in accounts it doesn’t own and can’t see into, with no record of what went where.
That’s the exposure I find most often when I start with a new client in financial services. It’s rarely the one the owner is worried about.
Most owners ask me whether the AI company will train its models on their clients’ data. On business and enterprise plans, the major providers have ruled that out in the contract, so a company account deals with it. The personal account in my example has no such agreement, and the business has no say over it.
The harder problem is the audit trail. Those conversations stay in each staff member’s personal account until someone deletes them, and anyone who gets into that account can read months of client files. If your aggregator runs a file review or your PI insurer asks how client information was handled, you have nothing to show them. That’s a record-keeping gap inside the business, and no contract with a provider closes it.
Brokers also tend to draw the privacy line in the wrong place. The usual assumption is that names and phone numbers are the sensitive part, and the figures are fine. However, a client’s income, loan amount, and suburb together can be enough to work out who they are. Strip out the name and address before anything goes into a chat window, and most of that risk goes away. Nearly every first draft policy I review misses this.
Credit information comes with its own rules under Part IIIA of the Privacy Act, on top of the general rules for personal information. Most industries never have to think about that. Brokers handle it every day, so any AI policy written for a brokerage needs to deal with it directly.
When owners do write a policy, the first instinct is usually a list of bans on client information and personal accounts. I understand the impulse, but if the tool is already saving someone an hour a day, a ban won’t change what they do. They’ll keep using it and stop telling you, and you lose the one thing you had, which was knowing about it.
A better approach is to look at which tasks people are running through chat windows every week and move them into a system the business controls and logs. Once the tool is built for that job with the right settings, staff don’t have to remember to be careful.
Whatever the size of the brokerage, two rules are worth having. Everyone uses a company account, because staff can’t tell a personal account from a company one by looking at it, and the protection underneath is completely different. And anyone who pastes something they shouldn’t reports it the same day without getting in trouble for it. Under the notifiable data breach scheme, acting quickly can be what stops an incident from becoming a notifiable breach, and people only report fast when they aren’t afraid to.
The brokers I work with who use AI well are getting real time back. What lets them keep doing it is being able to show a client or an auditor exactly how that client’s information was handled.
Nirlep Adhikari is founder and director at fractional CTO and AI advisory practice Mount Mindforce.
[Related: AI adoption is surging, but are lenders’ data systems ready?]
Want to see more stories from trusted news sources?Make Broker Daily a preferred news source on Google.