In brief
- AI adoption in family offices is accelerating rapidly, but significant legal and operational risks accompany its use
- Getting it wrong can result in regulatory fines, claims against directors, and reputational damage for both the family office and the family
- Family offices should act now to put appropriate safeguards in place
How are family offices using AI?
In line with other sectors, we are seeing a marked increase in adoption of generative AI by family offices. Citibank's Family Office surveys show growing uptake, with more than a fifth of respondents in their 2025 survey (22%) having automated some operational tasks, up from 13% in 2024. The survey also demonstrates expansion into other applications of AI, with use for portfolio construction or optimization increasing from 6% to 13% and use for investment performance reporting increasing from 6% to 16%. Given the greater adoption of AI more generally, and the improvement in the tools themselves, we can expect to see these numbers increase still further in 2026, with AI being used for ever more sophisticated applications. The commercial appeal is obvious - reducing cost and accelerating key processes - but family offices can be particularly susceptible to the risks of AI adoption by virtue of their structures, and must actively monitor and mitigate the associated risks.
What are the risks?
Loss of legal privilege
Uploading legal advice or other privileged information to AI tools may result in a loss of the protection offered by legal professional privilege. The case law in this area is developing but we have already seen courts in both England (Munir v Secretary of State for the Home Department) and the US (United States of America v Bradley Heppner) commenting that uploading privileged material into public AI tools places that information in the public domain, resulting in a loss of confidentiality and thus legal professional privilege (or the analogous attorney-client privilege in the US). There is also a risk even with closed AI tools, that prompts and chat logs may be disclosable in litigation if it is deemed that litigation privilege does not apply (for example, because litigation was not in contemplation at the time).
Inaccurate output
The risk of AI hallucinations has been widely reported, with generative AI tools confidently presenting factually incorrect data. Staff must be trained on the limitations of AI, and all AI output must be rigorously checked before reliance.
Data Protection
Family offices routinely handle highly sensitive data. Feeding that data into a public AI tool without proper assessment of data handling practices is likely to breach data protection obligations. Family offices must ensure personal data is processed lawfully with appropriate technical and organisational measures in place. Family offices considering adopting AI may need to undertake a data protection impact assessment, depending upon the risk involved.
Intellectual Property
AI models are trained on vast quantities of data, much of which is protected by copyright. It is possible that AI-generated content infringes third-party rights, and so AI use policies should be put in place to mitigate this risk. For more information, see our Guide to AI and IP.
Malicious Actors
AI tools are vulnerable to exploitation through mechanisms such as prompt injection attacks, which may allow third parties to extract confidential data or distribute malware.
What are the consequences of getting it wrong?
Failure to manage AI risks may lead to significant consequences for both the family office and the family, including:
- Loss of privilege: Sensitive documents become available to counterparties, regulators, or opposing parties.
- Claims against: Directors Failure to properly implement AI leading to losses may result in claims against directors.
- Regulatory fines: Breaches of data protection laws may result in significant fines.
- Professional regulatory exposure: Professionals who rely on unchecked AI output may face referral to their regulator.
- Reputational damage: Any of the above may generate significant adverse coverage for both the family office and the family.
What steps should family offices take now?
AI usage is only likely to become more commonplace. Even if a family office does not intend to deploy AI for specific business cases, it is essential to ensure employees are aware of the risks. Key steps include:
- Legal advice: Maintain close dialogue with legal advisers to ensure governance frameworks remain current in a rapidly evolving landscape.
- Adopt an AI Use Policy: Have a clear written policy specifying which tools are approved and for which purposes.
- Consider a closed: AI system Invest in a closed system rather than relying on public AI tools to significantly reduce the risks of data leakage, loss of privilege, and unauthorised access.
- Invest in training and governance: Training should cover the distinction between open and closed tools, hallucination risk, privilege and confidentiality risks, and data protection obligations.
- Human oversight: All AI-generated output must be reviewed by a suitably qualified professional before reliance.
- Terms and conditions: Conduct a careful review of any AI tool's terms to assess data protection and intellectual property risks as well as terms which may affect the privilege position (for example in relation to use of data for training models, access and disclosure).
- Insurance: Review existing insurance arrangements — including professional indemnity, cyber liability, and D&O policies — to ensure AI-related risks are adequately covered.
This article is intended as a general overview and should not be relied upon as legal advice. Legal advice should be sought in relation to your specific circumstances. Please contact Victoria Pigott or Richard Duggleby.