AI in financial services: protecting client data under supervision

For a regulated firm this is also the start of a register: for each tool the vendor, the hosting, the use cases, an owner and a recorded decision. The AI register keeps that up to date, with a review date for each tool.

#A highlight at the moment it matters

The other half happens in the text field itself. An adviser summarises a client meeting. The passport number and IBAN get a red highlight, the name and phone number a yellow one. The highlights appear as you type, like a spellchecker. The adviser chooses: mask the value with a placeholder such as [NAME1], or remove it. BeeSensible does not block anything of its own accord. If the firm wants more certainty, it can set masking on paste or on send to On by default or Always on. The example at the top of this page shows exactly that moment, and it works: click a highlighted value to see the actions.

The same happens in email and chat. The extension runs in Chrome and Edge, in the apps you already work in: ChatGPT, Claude, Gemini, Copilot, Perplexity, Gmail, Outlook, Slack, WhatsApp Web, LinkedIn and more. The desktop app also covers Outlook, ChatGPT, Claude and Copilot as native apps. How the highlight works and what happens to the text is explained on the Realtime Privacy page.

The setting varies across financial services, but the moment is always the same:

• Mortgage and financial advice. Summarise an application or meeting notes without passport numbers and IBANs. Valuation reports and pension statements anonymised first, then shared.
• Insurance and claims. Summarise a claim while the medical details are highlighted. Policy and account details visible before sending.
• Accounting and payroll. IDs and salaries in payslips and annual accounts are highlighted. KYC and UBO files anonymised before they go into an AI tool.
• Banking and wealth management. Transaction overviews highlighted in reporting prompts, client reports anonymised for analysis.

A claims handler summarising the claim of Aoife Walsh does not need to include her diagnosis and policy number. The summary is no worse for it, and far less data is processed.

#Files anonymised before they leave the firm

Not everything sensitive travels as typed text. An application file, valuation report or set of annual accounts moves as a file: forwarded to a colleague, shared with a lender or added to an AI conversation for a first pass. For those files, the dashboard or the extension opens the document itself, whether it is a PDF, a scan, a Word or an Excel file; the desktop app does this for PDF. The sensitive fields are already ticked; you decide what goes and export an anonymised copy in the same format. If the firm has switched on masking on attach, BeeSensible first holds back a file you add in ChatGPT or Claude: you choose check and mask, add the original or cancel. Hidden document properties are stripped too, so nothing travels along in the file's metadata.

That check runs on our servers in the EU, and the document is not stored.

#The evidence regulators, the GDPR and the AI Act ask for

Back to the question this article started with: can you show you have this under control? For a financial services firm, that question comes from three directions at once.

Financial supervision. Regulators look at sound and controlled business operations and the duty of care towards clients, whether that is the FCA in the UK, the AFM in the Netherlands or another national authority. There is no separate regulatory seal of approval for AI. But careful handling of client data is clearly part of sound operations, and that is what BeeSensible helps you demonstrate: there is a policy for each tool, there is help while people type and there are counts of what happens. BeeSensible does not discharge your regulatory obligations. It makes one part of them tangible and demonstrable.

GDPR. The accountability principle requires you to demonstrate appropriate measures. Highlighting at the point of input supports data minimisation exactly where personal data is about to leave the firm. The aggregated counts of detections and how they were handled serve as evidence in an audit and a DPIA.

EU AI Act. AI literacy has been mandatory since February 2025 for everyone who works with AI, and since the Digital Omnibus it has been a best-efforts obligation. You need to be able to show what you are doing. Highlights while people type are a practical way to do that: the employee sees what is sensitive in every prompt and stays in charge. What the deadlines look like after the omnibus is covered in our AI Act timeline.

The dashboard brings those three together on the Accountability screen. For a month or a quarter it shows the AI tools observed and the tools with a decision, the critical detections and the share adjusted, and the AI notices shown and how often the alternative was opened. For each provision of the GDPR, NIS2 and the AI Act, it sets out what the law says, what BeeSensible contributes and what falls outside its scope. A report for each period is frozen with a checksum.

The foundations fit the sector. A data processing agreement is signed with every customer and a product DPIA is available on request. Detection runs on our own servers at two European providers, both ISO 27001 certified. Typed text is never stored, and the dashboard never shows content and never an individual.

#Policy and training alone, or with help in the text field

What the trade-off looks like at most firms:

Policy and training are still needed. What BeeSensible adds is help at the moment where both most often fall short: the rush, just before sending. That is where the highlight appears, and where the adviser can still get it right. What employees should keep out of prompts altogether is covered in our article on what not to share with AI.

For internal discussion, the financial services leaflet sums this story up on two pages. More sector context is on the finance teams page. And to see it on your own texts first: in a 20-minute demo we show the highlights on texts like the ones your firm writes.