The Leaky Stack Professional Confidentiality in the Age of Agentic AI

Abstract

Professional confidentiality obligations in law, medicine, accounting, and financial advice rest on theassumption that practitioners can exercise meaningful control over how client data is processed —through contracts, configuration, and governance of third-party processors. This assumption isincreasingly strained by two developments since 2018. First, the US CLOUD Act grants US lawenforcement extraterritorial access to data held by US-headquartered companies regardless ofstorage location, creating a category of processor behaviour that domestic contracts cannot govern.Second, the embedding of agentic AI features in standard professional software — tools that activelyread, process, and generate derivatives of client data — extends a trajectory of vendor-side processingthat began with search indexing and telemetry but now operates at qualitatively greater scope andopacity. The insurance market has independently confirmed the significance of this shift: sinceJanuary 2026, major carriers have begun excluding AI-related liabilities from standard policies, whileall four major AI vendors cap their own liability at twelve months of fees and disclaim consequentialdamages. These exclusions, originating in the US market, propagate through global reinsurancechains to affect professional indemnity coverage in the UK, Australia, New Zealand, and the EU. Thisessay argues that the default professional stack has made confidentiality materially more fragile thanit was in the pre-2018 environment — before the CLOUD Act and before agentic AI features wereembedded in standard tools — and that regulatory and professional guidance has not kept pace withthe change.

Ähnliche Arbeiten