AI is everywhere right now, but as we know in financial services, it’s not just all about innovation. We’ve got to think about the security and staying compliant.

Today, we're diving into the world of large language models (LLMs) and AI more broadly, and AI-powered services. We need to ask a big question: how safe and secure are they really? And what do operational leaders in financial services really need to know before they jump straight in with their teams?

What is a large language model, and who are the big players?

Let's take a step back and start from the basics. What exactly is a large language model, and who are the big players in the space right now?

The most common one you've heard of is ChatGPT. That was kind of the main big one. But the other main players in large language models are Facebook with Llama, Anthropic with Claude, and Grok with X. They are the main players in this space.

These models require a tremendous amount of energy, power, and graphics in order to make them. It's not a situation where everyone is making up their own model. These core LLMs—ChatGPT, Llama, Claude—they're the main LLMs that we talk about when we say "LLM."

LLMs and the broader AI landscape

I think it’s really important to understand how they fit into the broader AI landscape.

A misconception is that when you see some AI application—something.ai—that does a particular thing, it really doesn't, or it would be very unusual that they have their own LLM that they built. They're just kind of tying into one of these existing large language models like Anthropic, OpenAI, or Facebook's model.

Firms' adoption and use cases

A couple of years ago, when it was still new, the options were really only ChatGPT through OpenAI or Microsoft Copilot, which uses ChatGPT via OpenAI. These are very much generic models, there to suit every kind of general purpose.

But what we've started to see now is more and more players entering into this and building up these more tailored AI applications. A lot of clients were interested in using AI, but got to these more general-purpose LLMs and maybe found that they didn't exactly do what they wanted to do.

Now, a lot more AI applications are available. The options for using AI have kind of exploded. We are seeing clients wanting to use more of these specialist AI applications. These specialist applications are AI-powered services that, again, perhaps use one of those large language models, but they’ve created this to perform a specific function or for a specific use case.

Key security and compliance considerations

If you are looking to adopt, deploy, and use these models, what are the key security and compliance considerations that you would be thinking about and looking at?

The way we look at security and compliance for AI is not too dissimilar to SaaS applications (web applications that have been around for years). So, the types of things we look for are whether they use encryption, MFA—the very basics.

As we get more into AI, some of the things that we would look at for a general web application or business application become even more critical. The main one here is confidentiality or privacy.

• Data confidentiality and residency: What happens when you are uploading your data into these applications or into these models? Where is your data going (data residency)? And how are they going to use that data? You'd be surprised how many of these newer AI applications don't set out what happens. That's probably one of the main ones we look at. There's also the downstream impact—if an AI application is using a core LLM like ChatGPT or Llama, what is happening with all that information you're uploading to it?

• Pace of change: We also look at features. How often are features introduced? AI is changing incredibly fast; new features are dropping into products weekly or monthly. Being able to control what features are turned on and enabled is really key. For example, a new AI feature being able to share the contents of your chat prompt to a colleague might sound useful, but it might also enable somebody to share that to the world or public, and being able to lock that down is really key.

The pace of change and new features in AI is actually a lot faster than in a traditional SaaS environment, so it's harder to keep track of everything new. There are security and compliance implications that go alongside that, so it's a little bit like a moving target.

Security provisions and the big models

How do the big models like OpenAI and Anthropic stack up in terms of the security provisions, guarantees, controls, and compliance provisions, especially for those of us working in financial services?

I've read through the Microsoft Copilot terms and conditions (a somewhat dry reading), but it has everything in there that you kind of want, expect, and need: that clarification around what they are and are not doing with your data, and all the controls they put in place.

If you contrast that with OpenAI, which is effectively using the same model, it’s a bit more difficult because we've got several flavours or licence types, and each one provides a different control. One allows for data residency, others don't—it becomes really broad and difficult.

A good example with OpenAI is that you can get the top-tier enterprise licence type, which gives you data residency control, but only allows you to store in an entire region. You could say, "I want all of the data to be stored in Europe," but you can't say, "I want it to be stored specifically in the UK." So there are all these little caveats with OpenAI.

However, at least OpenAI and some of the other ones similar to OpenAI have that information. A huge proportion of AI applications don't even have the security information needed in order to properly assess the risk of what happens when I use them.

Vendor prioritisation: features versus compliance

What are you seeing in terms of how the different vendors are prioritising the delivery of new features and developing the actual product versus the security and compliance considerations?

Microsoft is definitely concentrated on all of the compliance tooling and making sure the way they've configured their AI means that your data has a level of trust that it's not going to be used, potentially to the detriment of new, flashy AI features.

But it is a definite theme. Compliance tools are not the interesting or flashy tools that people kind of want to use. So they are focusing on features, and all of this other compliance tooling and security information is either typically not there or is a bit of an afterthought.

However, the other main players, like OpenAI, have definitely started to get up there on a similar footing to Microsoft. My view is they've probably been forced to in order to enable financial services firms and other types of industries to be able to then use that platform.

High-profile security incidents

What have we seen so far out there in terms of high-profile security incidents, data breaches, or disasters? Is it early days, or are the number of incidents ramping up as the pace of change increases?

I think it’s still early days, but it is a ticking time bomb. We've all seen or heard of those anecdotes of somebody turning the AI meeting notes on, and then they talked about the people who left the meeting, and everyone got the notes from the AI. There are lots of those types of things happening.

Very recently, we have seen a more dramatic security incident with AI where a third-party AI chatbot that you could hook into your Salesforce application—you gave it access to all your Salesforce data, and it could use that to respond to questions internally or to clients—was compromised. This gave the attacker access to a number of companies' entire Salesforce data.

With SaaS platforms and third-party add-ins, security issues are quite frequent. What is it about these AI-enabled add-ins that means the breaches are more serious or have a greater impact?

It's the scope of access they need. The rule of thumb is the more text information you can throw at these AI, the better it’s going to be in its response. So, the scope of access that it has to these systems is usually quite broad to get a better response. We've seen this ourselves, where clients ask to use an AI tool, we've dug in, and the access they need is basically everything. This could be quite dangerous.

The level of access and amount of data it needs access to is much greater than historically would be the case with traditional add-ins.

Advice for a COO in financial services

Let's consider a scenario: you're a COO in a fund. One of your team members is doing some brilliant work using one of the models or an AI-powered service, but you're not sure it's the right one from a security and compliance point of view. What's your advice to that person, who is clearly delivering something impressive, but you are concerned about the security and compliance?

First, being aware is a good first step, because you should be worried. There are so many unknowns, it's really tricky.

Where we are at the moment—and this won't necessarily be forever—you have two main options:

1. Use an Established Platform: Use one of these more established AI companies, like Microsoft, which has all of those compliance features you would expect and need, but you might compromise on that feature or that specific thing that a more niche AI application could do.

2. Limit Data Input: Limit what data you are putting into whatever AI you're using. You can take the view that "We can use this AI application, but no company data should be uploaded into that."

If the team is using a more flexible but less secure model (like a general ChatGPT or Perplexity) and saying that a more compliant model like Microsoft Copilot is not as fast or good, how do you persuade them to rethink?

It definitely is the case that those who are stronger on compliance and security do tend to be behind in terms of the quality of response and quality of the product (such as OpenAI or Claude). But this is just a matter of time. Microsoft could be a few months out from being on the bleeding edge of functionality, but it will get there.

You could compromise and accept that you use one of the ones that are stronger around security and compliance, but that you might be a few months away from being on top of the latest features. It's just a lag, a delay. And you're talking months, not years, so you just have to be patient.