Professional services firms have unique ethical and regulatory obligations that govern how business must be conducted. Not meeting those obligations is one of the greatest risks a professional services firm faces. As more business gets conducted through artificial intelligence, the more firms must ensure that compliance is built into the tools and processes that are facilitating greater productivity. This week we discuss how Firm AI makes professional compliance the structural foundation upon which all other AI operates.
Principle 6: Professional compliance is the substrate. Trust is what gets built on top of it.
“Can I sleep at night with this agent running in my firm?” Answering yes requires professional compliance as the substrate the model runs on top of, and trust — accuracy, scoped identity, real-time transparency, and an admissible audit trail — as properties of the environment it runs inside.
Every firm leader has had the same conversation about the firmwide agent — the one with its own identity, write access to critical systems, and the authority to act on behalf of the firm — and most have stopped it at the same moment. “How do I know it will respect the ethical walls, not hallucinate, not surface compensation data in the wrong place, and produce an audit trail I can defend to a court, an insurer, or a partnership vote?” Horizontal AI vendors are structurally unable to answer these questions, because the answers require an architecture the firm runs on — not a model with a wrapper around it.
Horizontal AI keeps the content of a document and strips the metadata around it. That works for marketing copy. It does not work in a firm, because in a firm the metadata is the compliance posture. Which partner is walled off because her brother works at the counterparty? Which deal team is on the buy-side versus the sell-side of a live auction, and who among them has MNPI from which public entity? Which documents are privileged, on litigation hold, or required to be destroyed after a set period? Strip the tags and you have not built an assistant. You have built a breach. Now give that breach an identity and write access to critical systems. The assistant that hallucinated an answer was a liability. The agent that acts on regulated information across a live matter is a different order of problem entirely.
Strip the tags and you have not built an assistant. You have built a breach. Now give that breach an identity and write access to critical systems.
There is a second breach hiding in the same approach. To make a firm’s documents usable, horizontal AI copies them into a new store: a second repository of its most sensitive material, outside its retention rules, outside its access controls, outside the systems its policies were written for. A discovery request reaches it. A retention schedule does not.
Firm AI is built the other way. It reasons over the firm’s own systems of record, where the data already lives under the firm’s governance. When it does create something new — an analysis, a draft, a record of a decision — that artifact is stored inside the same controls, inheriting the access permissions, walls, and retention rules of what it came from. There is nothing the firm cannot see, and nothing outside its policies.
Walls for AI treats compliance as the bedrock the system runs on. Matter- and deal-based access control, independence, MNPI, retention, jurisdiction, privilege, and consent are not features that can be turned on — they are the grammar the system speaks. Every prompt is a query against the firm’s policy. Every answer carries the source’s controls. Every agent inherits the posture of the function it is acting for. Every action is admissibly logged. The walls are not a constraint on the agent — they are the environment the agent runs inside. Accuracy, scoped identity, real-time transparency, and an admissible audit trail are properties of that environment, not bolt-ons.
This is why a growing list of practice-AI vendors, such as Harvey, are moving toward Walls for AI as the compliance foundation under their tools. Not because anyone is forcing them, but because firms will not deploy them at scale otherwise. Vendors who treat compliance as an afterthought will ship faster this year. They will also be ripped out.
Next up
In next week’s final post on the seven Firm AI principles, we discuss one of the biggest challenges firms have faced for a long time: fully capturing and leveraging the collective memory and methods of the firm. “If only the firm could know what the firm knows” is a refrain we have heard for decades. Firm AI is how the firm finally makes this come to life. We look forward to demonstrating how.
In the meantime, the full argument is in the blueprint: Mind your business. Not just your practice.