Private AI for regulated industries
Each regulated sector draws its data boundary in a different place. Find yours, the decision it puts in front of you, and where to start.
Book an assessmentFind your sector
Five short answers first. The detail for each follows below.
Research and higher education
One collection per project, agreements carried into access, and study data kept in its own secure environment.
Start with a readiness assessment
Life sciences and health
Research documents in, collaborators scoped, patient level data proposed out of scope.
Start with private AI for life sciences
Legal teams
Matter permissions and information barriers carried into search, and proved with refused accounts.
Start with an assessment or a pilot on one matter
Financial services
The model and its logs inside your outsourcing, resilience and record keeping arrangements.
Start with a readiness assessment
Energy
The platform on the IT side, with operational data moving out to it one way only.
Start with what running a model on premises takes
Research and higher education
Language models help researchers and research offices search literature, internal reports and grant documents, summarise interview and survey material, and draft from approved templates.
The data
Unpublished research, grant applications and reviews, interview and survey data, collaborator material held under data sharing agreements, and staff or student records.
The boundary
Each project or collaboration gets its own collection, so people see only the material their agreement covers. Personal data from studies stays in its own secure environment unless an approved, pseudonymised extract is brought in.
What is expected of you
Research data usually comes with conditions from funders, ethics approvals and data sharing agreements about where it may be processed and who may see it. UK GDPR applies to personal data used in research, and many research data services work to the Five Safes framework.
The decision to make
Which projects the platform may read, whether each agreement allows the material to be processed this way, and when access ends with the project.
Start with a readiness assessment
In the illustrative architecture, each repository you connect is a gate 5 connector.
Financial services
Language models help finance teams answer staff questions from policy and procedure, summarise complaints and case files, and review documents for specific terms.
The data
Client and transaction records, know your customer files, credit and risk files, complaints, internal policies and procedures.
The boundary
Documents, the index, prompts and answers stay in your tenancy. Prompts and answers that inform advice or a customer outcome are logged where your record keeping already lives. A managed model service, if used, is a crossing you list and justify.
What is expected of you
The FCA has said its existing rules apply to the use of AI. Depending on your activities, that includes accountability under the Senior Managers and Certification Regime, outsourcing and operational resilience rules, and, where you serve retail customers, the Consumer Duty, alongside UK GDPR.
The decision to make
Whether a managed model in your own subscription is a material outsourcing for you, which senior manager owns the platform, and whether it supports an important business service.
Start with a readiness assessment for financial services teams
In the illustrative architecture, a managed model service is gate 2.
Legal teams and privileged documents
Language models help legal teams search precedent and know how, summarise matter files, extract clauses and draft first versions from their own templates.
The data
Client files, advice, precedent, contracts and correspondence, all confidential and sometimes privileged, usually held in a document management system.
The boundary
Retrieval should inherit matter permissions and information barriers from the document management system, so a search returns only what the person asking could already open. That must be verified, with accounts that should be refused, and verified again after access changes. Client material is not used to train a model.
What is expected of you
The Solicitors Regulation Authority has warned about confidential client information being entered into AI tools without proper safeguards. The same warning covers inaccurate output, so answers need checking by someone who knows the matter. Duties of confidentiality and legal professional privilege apply whatever tool is used, and some clients' engagement terms now say whether their documents may be used with AI at all.
The decision to make
Which matters the platform may read, how ethical walls are enforced in search, and whether each client's terms allow their documents in.
Start with a readiness assessment, or a pilot on one matter that tests the permissions first
In the illustrative architecture, the connector to your document management system is gate 5.
Life sciences and health
Language models help research teams search literature and internal reports, summarise study documents and draft from approved templates.
The data
Research documents, study and trial documents, collaborator data held under agreements, and in some cases special category health data.
The boundary
Research documents are indexed with permissions. Collaborator material sits in its own collection. We propose keeping patient level data out of scope, in its own secure environment; if it is brought in, pseudonymised data is still personal data.
What is expected of you
UK GDPR treats health data as special category data, with extra conditions for processing it. Where AI touches records that fall under good practice (GxP) rules, the MHRA's data integrity guidance expects systems validated for their intended use.
The decision to make
Which data may be used at all, whether it must be pseudonymised first, and whether any use touches regulated records.
Start with private AI for life sciences
Energy and operational records
Language models help engineers find answers in long technical manuals and standards, summarise inspection histories and prepare for work in the field.
The data
Engineering drawings, technical manuals, maintenance and inspection records, and operational data.
The boundary
The platform sits on the IT side. Data from operational technology moves out to it in one direction only, through a route your engineers control, and nothing moves back.
What is expected of you
If you are a designated operator of essential services, the NIS Regulations apply. Ofgem has also published good practice guidance on the ethical use of AI in the energy sector, covering safety, security, fairness and sustainability, without adding new licence requirements.
The decision to make
How the platform is separated from operational networks, which records may be indexed, and who signs off an answer an engineer acts on.
Start with what it takes to run an LLM on premises
In the illustrative architecture, the one way route from operational systems is a gate 5 connector.
The standards we design to
Across every sector, we design to the CIS Benchmarks and Critical Security Controls, the NCSC Cloud Security Principles and the Microsoft cloud security benchmark, with access following Zero Trust principles. We document the design so your team can map it to the frameworks you already report against, such as ISO 27001 or Cyber Essentials.
Start with an assessment.
An assessment reviews your data, security and compliance position and ranks AI use cases by value and by risk.
Thank you. Your request is on its way. We will reply from info@tlgsolutions.co.uk to arrange a first discussion.
That did not send. Please email info@tlgsolutions.co.uk instead, and we will reply from there.