Regulated and insider data
Card numbers, health records, legal advice and unreleased financials: the data with legal consequences.
Start: Data with legal weightAbout this pack
Regulated and insider data covers information with legal consequences: health records, payment card numbers, unreleased financials, legal advice and export-controlled technical data. You'll learn to spot it, check whether a tool is approved for that type of data, and see what contracts like a BAA or data residency change and what they leave the same. When in doubt, the lessons show who to ask.
Best for: Anyone who handles health, payment, financial, legal or export-controlled data, in a company or on their own.
Good for
- Telling when health data falls under HIPAA and when it doesn't
- Keeping card numbers, deal code names and earnings data out of the wrong tools
- Protecting legal privilege when you use AI chats
- Knowing when to ask compliance about export-controlled or government data
Where people slip
- Trusting a tool with health data because its vendor says it's HIPAA compliant
- Pasting a full card number into a chat to get help with an invoice
- Letting an AI assistant or connector widen who can see deal information
- Thinking US-only storage solves export control rules
Can I put patient health data into an AI tool?
Only in a tool your organization approved for health data. Under HIPAA, an AI vendor that handles patient data for a covered entity needs a business associate agreement (BAA). Even then, share only the minimum necessary.
Are AI chats protected by attorney-client privilege?
Not always. In United States v. Heppner (2026), a federal district court in New York held that a defendant's own chats with a consumer AI tool weren't privileged. The ruling isn't binding elsewhere, and enterprise use directed by counsel may be treated differently. Ask your legal team.
What is MNPI?
Material nonpublic information: facts a reasonable investor would likely find important that the public doesn't have yet, like unreleased earnings or a pending deal. Keep it within need-to-know groups, and check that AI assistants and connectors can't spread it wider.
Can I put card numbers into an AI tool?
Redact them first. PCI DSS says a displayed card number should show at most the first six and last four digits to people without a business need. Security codes must never be stored after authorization. Most AI tasks don't need the number at all.
Spot data with legal weight
Recognize card, health, insider and privileged data, and pick a safe path before any of it reaches an AI tool.
0 of 2 lessons completeInsider information and privileged advice
Keep deal and earnings information inside the right group, and use AI on legal matters without putting privilege at risk.
0 of 2 lessons completeContracts, location and clearance
Know what a BAA, a residency setting or an export authorization changes, and what each one leaves untouched.
0 of 2 lessons complete