K2's AI - Security And Privacy Issues

Regulated industries face real compliance risks because data fed into most AI engines can be used for training, and in highly regulated sectors like healthcare and finance, that's a serious problem. The instructor walked through specific cases: QuickBooks Online doesn't even offer an opt-out for AI training, and putting HIPAA-covered data into commercial AI engines without a business associate agreement is legally questionable. Claude and Copilot (with enterprise data protection enabled) are your safest commercial options, but even then you need to scrub sensitive identifiers—social security numbers, account numbers, client names—before uploading anything. For truly confidential work, the instructor runs Claude offline using Open LLM, an open-source version disconnected from the internet, precisely to avoid this exposure.

The free versions of ChatGPT, Gemini, and Claude come with significant privacy trade-offs—your data can be used for model training, and your prompts and conversations are logged. The instructor demonstrates using paid business accounts instead: ChatGPT's business tier, Microsoft Copilot for Microsoft 365 ($30/user/month with enterprise data protection), and Claude's commercial API when using tools like LibreChat or Open Router. If you want to work through the examples, you can start free, but you'll quickly see why the instructor switched to paid tiers when handling any client or sensitive information.

You'll be able to read and interpret the privacy policies and terms of service that come with AI platforms—the instructor shows the exact process he uses with ChatGPT to summarize complex 40,000+ word documents into actionable summaries, highlighting data-sharing practices, subprocessors, and opt-out rights. You'll know which engines are safe for which tasks: Claude and Copilot for client work when properly configured, what data to scrub before uploading, and how to spot when vendors are using dark patterns (like Intuit withholding refund tracking until you consent to tax data sharing). You'll also understand the regulatory landscape—EU AI Act, GDPR, state laws like California SB 53, and emerging US frameworks—so you can assess your firm's exposure and liability when deploying AI at scale.

The instructor demonstrates live workflows throughout: opening LibreChat, a self-hosted open-source AI platform with enterprise-class privacy; showing how to load your API keys into Open Router to access 500+ models through a single interface; displaying his actual privacy policy analysis tool in ChatGPT with the exact prompts he uses; and walking through how he classifies files with Azure information protection to prevent data leakage in Microsoft Copilot. He also shows the deepfake attack that hit UK engineering firm RUP—a $25 million fraud using a cloned executive's voice and video—and explains the motion-capture encoding that makes it possible, so you understand not just the risk but how it actually works. The second half shifts from concepts to concrete decisions you make when adopting AI.

The instructor emphasizes regulatory uncertainty as the central challenge: there is no settled federal US law on AI copyright, data privacy, or liability yet. What does apply depends on where your clients are and where your firm operates. EU AI Act requires risk management and transparency for high-risk models; it was phased in August 2024 with full compliance due August 2026. California SB 53 mandates safety frameworks and whistleblower protections for frontier AI developers—and because California is the largest state, many companies follow it nationally. Canada has PEPEDA federally plus provincial privacy acts in Ontario, British Columbia, and Quebec (where 60% of Canadians live). The US has a patchwork of state laws and no comprehensive federal standard. Rather than waiting for clarity, the instructor recommends monitoring CISA's binding operational directives, Treasury's AI cyber clearinghouse, and the NIST AI Risk Management Framework—which the course walks through alongside your firm's existing control frameworks.