Cross-regulator map

Seven controls, seven sources of guidance — one map

UK guidance on AI and confidential data converges on a small set of expectations: keep identifiable data out of public tools, minimise what providers receive, stay accountable, and keep evidence. This table maps each NeutralAI control to the guidance lines it addresses. Lines are paraphrased for brevity — the verbatim quotes and source links live on each guidance page.

Mask before send

PII detected and replaced in the browser before the prompt or upload leaves the firm.

Law Society

No identifiable client data into public AI tools without safeguards.

Judiciary

Nothing non-public into a public AI chatbot — inputs are publication.

Bar Council

Extreme vigilance with privileged or confidential information; no personal data in prompts.

ICO

Data minimisation applies to AI processing under UK GDPR.

Reversible vault (15-minute TTL)

Masked tokens restore locally after the response; encrypted vault entries expire in minutes.

Judiciary

Inputs are irreversible publication — so real values must never be the input.

Bar Council

Inputs may be retained, used for training, and repeated verbatim later.

Law Society

Understand what the provider retains — or ensure it retains nothing identifying.

Audit trail

Category-level masking events logged with policy and timestamp — no raw PII in the log.

ICO

Accountability: demonstrate compliance, not just assert it.

FCA

SM&CR: the accountable senior manager needs evidence of reasonable steps.

SRA

Firms remain accountable for AI use — supervision needs a record.

DUAA 2025

Document where human involvement sits in automated workflows.

Whitelist & tenant policy

Firm-approved terms and per-tenant masking policy applied consistently across every AI tool.

Law Society

Approve tools deliberately; apply the same confidentiality rules everywhere.

SRA

Safe adoption is a firm-level posture, not a per-tool improvisation.

BYOK

Growth/Enterprise tenants use their own LLM provider keys and contracts.

ICO

Controllership: keep the processing chain under your own contracts.

FCA

Operational control over data flows within the firm’s documented perimeter.

On-prem / private deployment

The gateway can run inside the firm’s own environment or VPC.

Judiciary

The guidance distinguishes public tools from systems inside a secure network.

FCA

Resilience and control expectations favour infrastructure the firm governs.

SSO & access control

OIDC/SAML SSO, MFA posture, and role-based access for admin surfaces.

ICO

Security of processing: control who can reach personal data and policy settings.

SRA

The DPP Law fine (April 2025) turned on missing basic access controls like MFA.

This map summarises third-party guidance for convenience and is not legal advice, a compliance guarantee, or a claim of endorsement by any regulator. Read the originals via the source links on each guidance page. Last reviewed: 17 July 2026.

Get the AI Confidentiality Checklist Book a 20-minute risk review