Family Office AI Readiness Self-Check: 10 Questions to Determine If You Can Use AI Safely

Title

Family Office AI Readiness Self-Check: 10 Questions to Determine If You Can Use AI Safely

Meta Description

How can family offices determine if they're ready to use AI? This 10-question self-check requires every "yes" to be backed by documentation or test records, covering written policies, training clauses, permission testing, report traceability, and deletion verification, with interpretation for score ranges 0-10.

Article Content

Family offices' interest in AI is rapidly heating up, but there's a whole set of governance evidence separating "want to use" from "can use." Prakshal Jain and Alexander Morris, co-founders of Private SuperIntelligence, offer a 10-question self-check with a single core criterion: every "yes" must be backed by documentation or test records.

Why Family Offices Need This Checklist

According to Citi's 2025 Global Family Office Report, 22% of family offices have already deployed AI for operational tasks or investment analysis, up significantly from 13% the previous year; 16% have used it for investment performance reporting, more than double the prior year. That said, 57% of respondents cited "lack of internal expertise to evaluate" as the biggest obstacle—tools are in use, but no one is confident assessing them.

The risk side looks grimmer. IBM's 2025 Cost of a Data Breach Report shows that 63% of surveyed victim organizations had no AI governance policy or were still developing one, one in five experienced a breach involving shadow AI, and only 37% had policies to manage or detect shadow AI. The original article explicitly notes that IBM's data describes surveyed victim organizations and is not specific to family offices.

Put the two datasets together and a typical scenario emerges: employees start using AI before policies exist, and management has neither policy nor evaluation capability. The original article offers a direct trigger—if your office meets any two of the following, this check is worth ten minutes: employees use AI without authorization; no one internally can judge tool quality; no written AI policy exists; unapproved tools are present; reporting work is the first task you'd most like to delegate.

Structure and Logic of the 10-Question Checklist

Scoring is one point per question: each "yes" that can be supported by current documentation or test records earns one point; "no" and "uncertain" both score zero. Total score ranges from 0 to 10, and all questions point in the same direction—whether evidence exists.

Start with Task and Owner (Questions 1-2)

Question 1 requires writing down one specific task and its owner. Citi's observation is that successful AI applications in family offices tend to be everyday tasks: document summarization, meeting transcription, email management, report automation. Starting with one of these and assigning an owner keeps subsequent checks concrete.

Question 2 requires written rules defining which records can enter AI tools. Citi calls data privacy a non-negotiable baseline for family offices, and IBM's data showing 63% of victim organizations lack AI policies indicates this rule is far from universal in practice.

Least Privilege is a foundational design principle of information security: any subject (user, program, service account) should receive only the minimum access necessary to complete its intended task, and only for the necessary duration. OWASP, in its security guidance for LLM applications, specifies this as two points—execute operations with the end user's identity and context (rather than using an over-privileged service account to run all requests), and place authorization decisions in downstream business systems rather than at the model layer, because the model itself can be manipulated by prompts and cannot serve as a trusted enforcement point for permission boundaries. For family offices, this means an assistant used for document summarization should not simultaneously hold write access to investment ledgers; the narrower the permissions, the smaller the blast radius of any single error or manipulation.

Training and Retention Are Two Different Things (Questions 3-4)

Question 3 requires being able to explain the training terms of the specific plan the office uses. The original article emphasizes that terms vary by plan: OpenAI states that data sent to its API is not used to train models by default unless customers opt in—but this itself does not apply to personal chat accounts.

Question 4 requires distinguishing "not trained on" from "not stored." The original article notes that OpenAI's API does not use customer data for training by default, but still retains abuse monitoring logs (which may contain prompts and responses) for up to 30 days, and currently excluding content from these logs requires prior approval from OpenAI. The answers to these two questions are often conflated, yet they are completely different in compliance terms.

Zero Data Retention (ZDR) is a common contractual form in enterprise AI procurement: the provider commits not to persist prompts and model outputs after request processing is complete, retaining only necessary billing and security metadata. It is an independent switch from "not used for training"—the former constrains data retention duration and accessibility, the latter constrains whether data enters model iteration. Most mainstream APIs enable "no training" by default but disable ZDR by default, requiring enterprises to apply separately and obtain approval after review. Even with ZDR enabled, providers typically still retain short-term abuse monitoring logs (commonly 30 days) to detect violating content and account risks. Therefore, due diligence should confirm item by item: training switch status, log retention duration, log content scope (whether it includes the prompt text itself), and the approval process for exemptions—all four are essential.

Data Flows and Permission Testing (Questions 5-7)

Question 5 requires being able to name every service provider that touches task data: the assistant itself, the model provider, and the third parties they in turn pass it to. The original article warns that the brand name on the contract cannot answer this question—each additional recipient adds another set of terms to verify.

Questions 6 and 7 turn to practical testing. Question 6 requires testing permission isolation with fictional records, verifying expected results for each role. OWASP recommends least privilege, operating with the user's own context, and enforcing authorization in downstream systems rather than at the model layer—a polite refusal in the chat window does not count as passing the test. Question 7 requires testing whether send operations require the expected approval; OWASP's typical example is that an email assistant that only needs to read emails should not have send or delete capabilities, and high-impact actions should require human approval.

Shadow AI refers to the phenomenon where employees use generative AI tools to process work data without approval from IT or compliance departments. It is dangerous not because the tools themselves are malicious, but because data leaves the organization's visibility and control boundaries: inputs may enter unreviewed third-party retention, training, or cross-border transfer paths, and the organization has neither logs nor traceability. IBM's 2025 report shows that only 37% of organizations have policies to detect or manage shadow AI, meaning most organizations are blind to their data exfiltration paths. Common governance practices include: establishing an approved tool whitelist, identifying and blocking unauthorized AI domains at the network layer, routing approved tools through enterprise accounts rather than personal accounts, and clarifying in onboarding training "which records must never be pasted into a chat box."

Report Traceability and Exception Handling (Questions 8-10)

Question 8 requires that reviewers can trace numbers in reports back to recognized sources, and sample reports must retain source, period, and approver. The original article cites Addepar's automated validation mechanism as a reference, while noting that any AI drafting reports should go further and show the provenance of every number.

Question 9 requires designating qualified personnel to handle missing or conflicting evidence; open items must have an owner and cannot quietly become "accepted answers." Citi notes that family offices keep final decisions (especially investment decisions) in the hands of experienced people.

Question 10 addresses situations where deletion cannot be directly verified: the office needs to document what can be checked, what relies on contracts or third-party attestation, and who decides whether this gap blocks use. The original article warns that a single search returning no results does not prove data has been deleted.

How to Read Score Ranges

The original article explicitly states these ranges are editorial suggestions, not research conclusions:

• 0-3 points: Write policies first, choose one task. Designate an owner, permitted records, and approver; do not let real family information enter the system before policies are in place.
• 4-7 points: Close all open answers. Every "no" or "uncertain" needs an owner and a date; while verifying terms, permissions, and retention, test with fictional records.
• 8-10 points: Review the evidence itself rather than the total score. Have the responsible operations lead, security lead, and legal counsel read the open limitations before any real pilot; reporting work also requires involvement of the report owner or accountant.

The original article emphasizes that regardless of total score, a single unresolved answer on access permissions, unauthorized sending, or data handling is sufficient to halt. "Yes" elsewhere cannot offset it. The check should be re-run when providers, plans, tasks, or data change.

Boundaries of This Checklist

In the FAQ, the original article proactively defines its scope: this check is a planning aid, not a validated test or certification, and a score of 10 does not mean the AI configuration is secure. Its division of labor with the team's other "AI Data Exposure Check" is—the latter examines where data flows under providers' public terms for tools employees are already using, while the former examines whether the office itself has evidence before connecting AI to real records.

The right person to execute the check is whoever will own AI decision-making in the future, typically the COO, chief of staff, or general counsel, with the family principal reviewing results.

One detail: the original authors' firm, Private SuperIntelligence, provides private AI deployment services specifically for family office scenarios, and questions 7 and 8 in the article correspond to send approval and report traceability, which are exactly its product features. This background does not negate the checklist's reference value—most of the ten questions (written policies, permission testing, data flow inventory) are universal items any governance framework would include—but readers should factor the commercial position into their consideration when weighing its conclusions.

Third-party attestation refers to formal reports issued by independent auditors regarding the effectiveness of a service provider's controls, commonly including SOC 2 Type II (covering trust services criteria such as security, availability, and confidentiality, examining control operation over a period rather than at a point in time) and ISO/IEC 27001 certification (information security management systems). The value of such reports is that when data deletion, encryption, access logs, and similar matters cannot be directly verified by the customer, they provide a reliable external evidence chain. But their boundaries are equally clear—reports cover the provider's stated control scope and audit period, are not specific to a particular customer's configuration, and do not guarantee that a specific piece of data has been thoroughly erased. Therefore, in the context of Question 10, the correct approach is to record the report name, coverage scope, audit period, and version, and clarify who determines that the evidence is sufficient to support the use decision.

One-line Summary

Family office AI readiness 10-question self-check: every "yes" must be backed by documentation or test records.

Paragraph Summary

The article centers on a 10-question AI readiness checklist for family offices proposed by two founders of Private SuperIntelligence. Background data comes from Citi's 2025 report—22% of family offices already use AI, but 57% lack internal expertise to evaluate it; IBM 2025 data shows 63% of victim organizations have no AI governance policy, and shadow AI breaches are common. The checklist uses one-point scoring with evidence as the core criterion: every "yes" must be supported by current documentation or test records, and "no" and "uncertain" both score zero. The ten questions cover tasks and owners, rules for records that can enter AI, the distinction between training terms and data retention, data flow inventory, permission isolation and send approval testing, report traceability, exception handling owners, and deletion verification gaps. The article provides interpretation guidance for score ranges 0-3, 4-7, and 8-10, and emphasizes that any unresolved access permission, unauthorized sending, or data handling issue is sufficient to halt—a high score cannot offset a single-point risk. The end also notes that the authors' company provides related commercial services, and readers should factor the commercial position into their consideration.