Dia Systems

06/18/2026

https://diasystems.net/ai-governance-for-law-firms-is-not-about-saying-no/

Somewhere in the last year or two, someone at your firm started using AI. Maybe it was a paralegal summarizing a long document. Maybe it was an associate

06/17/2026

NIST's AI Risk Management Framework was built for organizations that want to govern AI responsibly. Most professional services firms have never looked at it.

What's interesting is that if you strip away the technical language, it is basically asking four things. Do you know what AI tools are in use? Do you have a policy? Does someone own accountability, and do you have a plan if something goes wrong?

For firms that handle sensitive client data, those are not abstract questions.

Have you started thinking about AI governance at your firm yet, or is it still in the "we'll deal with it later" category?

06/16/2026

A question worth sitting with this week if you run an accounting firm or enrolled agent practice.

If one of your staff members received an email tomorrow that looked like it came from IRS e-Services, asking them to verify their login credentials, would they know it was a phishing attempt?

The IRS does not initiate contact by email asking for credentials. However, that is not common knowledge inside most small firms, and phishing emails targeting tax professionals are designed to look convincing.

Taking fifteen minutes to walk your team through one scenario, what to look for, what not to click, and who to notify, is one of the most practical things you can do to protect your clients and your firm this season.

Peace of mind comes from knowing your team is ready, not just hoping they are.

06/16/2026

If someone at your firm used an AI tool this week to help draft a client document, the question worth asking is not just which tool they used. It is whether your firm has ever told them which tools are approved for that purpose.

For law firms, this is not only a technology question. The ABA's duty of confidentiality applies to how attorneys use technology, including AI. Using an unvetted tool with client information may create ethics exposure, not just a security risk.

Your team needs a written policy that names approved tools, identifies what information cannot be used in any AI tool, and gives your team a clear place to ask questions. Then you need to have governance over it.

Your people want to do the right thing. Give them the clarity to do it.

06/15/2026

Pasting client details into an AI tool is not just a data security issue. Under ABA Model Rule 1.6, it may be a confidentiality violation. Your Bar standing does not care whether the breach came from a hacker or a chat window. The policy conversation belongs with the managing partner, not the IT vendor.

06/15/2026

06/13/2026

Reach out if your firm needs help with AI Governance.

06/12/2026

If your attorneys are using AI tools to help with drafting, research, or case summaries, here is a question worth asking this Friday.

Do they know which tools are approved for work that involves actual client information?

This is not just a security question. Several state bars have issued guidance making clear that pasting client details into an unvetted AI platform may violate confidentiality obligations under your Rules of Professional Conduct.

Most firms have not addressed this in writing yet. That means attorneys are making these decisions on their own, often under deadline pressure, without guidance from firm leadership.

A written AI use policy does not have to be complicated. It just has to exist. Your clients, and your Bar, expect reasonable measures to protect their information. That expectation now includes the tools your team uses every day.

06/11/2026

For accounting firm owners, here is a grounding question.

When did you last review who at your firm can access client tax data, and what specifically they can see?

What we’re noticing is that small practices often set up access during onboarding and never revisit it. Staff changes. Roles change. Software gets added. The access list quietly grows without anyone making a deliberate decision.

You do not need a full audit to get started. Pick one system today and ask a simple question: does everyone who has access still need it, and do they need as much of it as they have?

That kind of calm, regular review is what keeps a practice protected, productive, and out of situations that are hard to explain to clients.

06/11/2026

Quick question for accounting firm owners and enrolled agents.

If someone walked into your office today and asked to see your Written Information Security Plan, how long would it take you to find it and when you found it, would it still reflect how your firm actually operates right now?