AI Copilot for Advisory Firms: Uses and Limits

Suitable use cases

A well-designed AI copilot for professional practices can take on repetitive tasks without making professional decisions:

• Classify incoming documents.
• Extract fields for review.
• Summarise regulations or case files.
• Search internal procedures.
• Draft emails and reports.
• Flag missing documents.
• Suggest a checklist per procedure.
• Compare versions.

These tasks often rely on document processing to classify and extract fields reliably. The highest-impact cases —filings, calculations, final advice or decisions about clients— require professional validation and additional controls.

What it should not do by default

• File tax returns without approval.
• Modify master data.
• Send final communications.
• Draw conclusions on a case without evidence.
• Reuse data for training.
• Mix client files together.
• Operate with broad personal credentials.
• Invent citations or deadlines.

Recommended architecture

The model does not get direct access to every client: authorisation is applied before the information is retrieved.

Confidentiality and data protection

Advisory firms handle payroll, tax data, health information, penalties, accounts and trade secrets. Before using AI, firms should assess the purpose, the legal basis, the processor and sub-processors, any transfers, retention periods, and whether the provider might use the data for training.

The internal policy must define which data is off-limits, which services are authorised, and when anonymisation applies. Copying a case file to a personal or free account is not an acceptable use.

The AEPD (Spain’s data protection authority) recommends rolling out these use cases through a formal procedure, secure environments and supervision. Any incidental processing of personal data remains subject to the GDPR.

Sources and RAG

For internal queries, a RAG system should prioritise:

• Official regulations.
• Approved internal criteria.
• Current manuals.
• Case files with the corresponding permissions.
• Manufacturer documentation.

Every fragment must carry a source, date, version and scope. The copilot should abstain when there is not enough evidence and flag any contradictions it detects.

Professional review

The reviewer must check:

1. Client and context.
2. Source and currency.
3. Assumed facts.
4. Calculation or reasoning.
5. Limits and exceptions.
6. Recipient and tone.
7. Personal data.
8. Follow-up action.

An “approve” button is not enough if it does not surface these elements.

Evaluation

The test set should include:

• Ordinary cases.
• Exceptions.
• Repealed regulations.
• Incomplete documents.
• Figures and dates.
• Similar case files.
• Unanswerable questions.
• Cross-access attempts.
• Malicious instructions.

Metrics to track are:

• Extraction accuracy.
• Faithfulness to sources.
• Correct abstention rate.
• Critical errors.
• Human corrections.
• Information leakage between clients.
• Time per valid task.

Permissions and tools

The copilot can read a case file without being able to send, delete or file anything on its own. Every action must have a defined scope, limit and idempotency. Irreversible operations require contextual approval and, where applicable, dual control.

A received document must never be allowed to change the agent’s rules.

Providers

The essential questions before choosing a provider are:

• Where does it process and store information?
• Does it use the data to train its models?
• Which sub-processors are involved?
• What logs does it keep?
• How is data exported and deleted?
• How does it report incidents?
• Can you choose a region, and does it offer enterprise controls?
• What changes between service versions?

A lack of information on these points is itself a risk.

Knowledge management

The AI must not hide the fact that the repository it is consulting is out of date. Every area needs an owner and an SLA. Wrong answers are fixed at the source, not in the prompt.

Relevant professional decisions are kept as evidence, but they are not automatically folded into a global memory.

Rollout plan

Days 1 to 30

A scoped use case, an inventory, an internal policy, provider selection and initial tests.

Days 31 to 60

RAG, permissions, logs, evaluation and training.

Days 61 to 90

A pilot with full review, metrics and a final decision.

Common mistakes

1. Starting with every client at once.
2. Using personal accounts.
3. Trusting answers without a source.
4. Mixing case files.
5. Delegating the professional decision.
6. Measuring speed alone.
7. Not testing against outdated regulations.
8. Granting write permissions without need.
9. Keeping prompts indefinitely.
10. Not tracking the provider’s changes.

Checklist

• Use case and limits defined.
• Internal policy approved.
• Provider and contract reviewed.
• Sources kept current.
• Permissions set per case file.
• Professional review in place.
• Evaluation and abstention tested.
• Logs and versions recorded.
• Incident and exit plan ready.
• Role-based training delivered.

Frequently asked questions

Can it draft professional advice?

It can prepare drafts, but a competent professional must validate the facts, the sources and the conclusion before it is communicated.

Can it use real case files?

Only in authorised environments, with a legal basis, a contract, data minimisation, permissions and security.

Does it reduce liability?

No. The firm retains responsibility for the service it provides and for its decisions.

Summum IA can design an AI copilot for professional practices with sources, permissions and evaluation, integrated with document processing, without replacing professional judgement.