How a multi-family office adopted AI without a compliance problem
A multi-family office brought me in to put AI to work inside a firm that answers to regulators. The buyer was the chief compliance officer, so we built the governance and the private workspace before a single automation. By the third session he was building and running them himself.
The person who has to defend it
In most firms the AI conversation starts with whoever is most curious about the technology. Here it started with the person who would have to explain it to an examiner.
That changes the order of everything. Before you can talk about what AI could do for the operations team, you have to answer what happens to a client file, where it goes, who can see it, what gets retained and for how long. A chief compliance officer cannot approve what they cannot describe under questioning.
Most vendors answer that question with a marketing sentence. It is the wrong kind of answer, and this buyer knew it.
What we settled before building anything
Five seats on a business plan where the vendor does not train on your data, signed in through the firm's existing identity provider. One controlled folder on the firm's own file server as the single root, so nothing depended on somebody's personal cloud drive. Account numbers masked before anything is read. The AI drafts email and never sends it.
Then the part people skip: written rules. What AI is allowed to touch, what a human reviews before it counts, what never leaves the building. That document is the reason this engagement could happen at all, and it took a fraction of the time everyone expected.
I want to be exact about one thing, because imprecision here is how firms get into trouble. Working on a local folder means file access is local. It does not mean the content never leaves. What you send to the model is processed by the model provider, and the defensible claim is about training, retention and access, not about the file staying on the desk. Any consultant who tells a compliance officer otherwise has just created a problem for both of you.
The first automation
Weekly cash management, done by hand across many accounts. Someone opens exports from the portfolio reporting platform and reads down the list looking for accounts that are overdrawn, accounts sitting on too much idle cash, and accounts that cannot cover a capital call that has already been announced.
It is exactly the kind of work that is too important to skip and too repetitive to stay sharp at. Ninety-four thousand dollars in an account and a two hundred thousand dollar call coming due is not a subtle problem. It is only invisible because it is on line four hundred of a spreadsheet nobody has time to read twice.
We built a check that reads the export, applies the firm's own thresholds, and produces a flagged list with the reason attached to each line. It does not move money. It does not touch the portfolio system. It reads, it flags, and a person decides.
The part that mattered more than the bot
The objective across three sessions was not a working bot. It was whether the compliance officer could build the next one without me.
In the third session he did. His own machine, his own hands, his own output file. That was the end of the initial engagement, and it was the point of it.
What still does not self-serve
He is a builder. He already had a developer he could send Python to. So the honest question was always what he would still need from me once he could do it himself.
The answer turned out to be the layer above the code. How the pieces fit together so a second automation does not contradict the first. Governance that survives an examiner rather than a demo. Verification, which is the step almost everyone skips: a system that produces a wrong number confidently is worse than no system. And migrating all of it every time the models change underneath, which happens more often than any annual plan expects.
Writing a script is the part a good operator can learn in an afternoon. Knowing which script should exist, and proving the number it produces is right, is the part that takes someone who has done it before.
If the person who has to sign off on AI at your firm is the same person who would have to defend it, start there rather than with a tool.
That conversation is thirty minutes and it usually settles more than a proposal would.