AI Legal Landmines: Protecting Privilege and Client Data, with Matt Bisanz of Mayer Brown

In the AI: Trust but Verify podcast, our host, Alec Crawford (@alec06830), Founder and CEO of Verapath (https://www.verapath.com), interviews guests about how they are using AI in business, where you can trust AI, and where you need to put up guard rails.

About Our Guest

This episode's guest is Matt Bisanz, a bank regulatory partner at Mayer Brown in Washington, DC, and host of Mayer Brown's Credibly Challenged podcast on risk management for financial institutions. A CPA before he became a lawyer, Matt has spent about 14 years in regulatory law, with earlier work at the SEC, CFTC, DOJ, FDIC and a Big Four accounting firm. He and Alec dig into what banks and wealth managers need to do now that regulators have narrowed their focus to material financial risk: from Reg S-P and employees uploading client files to free AI tools, to AI-driven consumer harm, AI-assisted attacks through vendors, and why asking AI for legal advice can cost you attorney-client privilege.

Top 5 Themes

• Shadow AI and vendor risk: Reg S-P puts it on the firm. Under the SEC's amended Reg S-P, if advisors upload client files to free ChatGPT, that's the firm's problem, not the employee's. Matt says firms often rank their vendors' risk backwards, treating their law firm as a big data risk while ignoring free AI tools with no contract at all. Give staff a secure, approved AI tool instead.
• Which data is actually a "material financial risk"? With the OCC and FDIC now focusing exams on material financial risk, banks need to rethink their data. Access to wire transfer or custody systems is clearly material. A consumer data breach still triggers 50-state notice requirements. Rank data by financial impact, not just by which laws cover it.
• AI supercharges consumer harm, so keep a human on the loan approval. One bad decision can now repeat across thousands of customers in hours, like a mispriced home equity loan or an AI quietly cutting off borrowers over 65. Let AI prepare the loan file, but have a person make the credit decision.
• AI-assisted attacks through your vendors. After Anthropic's Mythos model showed it could automate cyber attacks, Treasury Secretary Scott Bessent called in bank CEOs. AI makes it far easier to find weak spots in the third-party software banks rely on: if your CRM vendor is hacked, your bank is hacked. Limit access so an intruder can't instantly reach everything.
• Don't ask AI for legal advice: it isn't privileged. What executives ask public AI tools ("Am I allowed to do this?") can be subpoenaed, and asking your lawyer to confirm the AI's answer afterwards doesn't protect it. Call your lawyer first, or at least use an internal model with a short retention policy.

Resources

Here are a few of the companies, organizations and resources mentioned during the episode:

• Matt Bisanz, Mayer Brown: Matt's bio. https://www.mayerbrown.com/en/people/b/bisanz-matthew
• Credibly Challenged: Matt's monthly podcast on bank risk management. https://www.mayerbrown.com/en/insights/podcasts/overview/credibly-challenged
• Verapath: Secure, private AI for banks and wealth managers. https://www.verapath.com
• SEC Regulation S-P: The customer data breach and incident response rule for advisors and broker-dealers. https://www.sec.gov/news/press-release/2024-58
• OCC and FDIC final rule on material financial risk: The rule refocusing bank exams on material financial risk. https://www.independentbanker.org/w/regulators-issue-final-rule-prioritizing-material-financial-risks
• Financial Services AI Risk Management Framework: Treasury's February 2026 release of the AI framework Alec describes, supported by the Cyber Risk Institute. https://home.treasury.gov/news/press-releases/sb0401
• NIST AI Risk Management Framework: The broader framework the financial services version builds on. https://www.nist.gov/itl/ai-risk-management-framework
• Bloomberg Law: "Bessent Urgently Summons Bank CEOs to Discuss Anthropic's New AI": The April 2026 Mythos meeting. https://news.bloomberglaw.com/banking-law/bessent-urgently-summons-bank-ceos-to-discuss-anthropics-new-ai

Copyright (c) 2026 Artificial Intelligence Risk, Inc. All Rights Reserved