How Should UK Professional Services Firms Assess AI Vendor Tenant Isolation?

What should a professional services firm check before putting client work through an AI vendor?

A firm should be able to explain how one customer's prompts, uploaded documents and outputs are kept separate from another customer's data at the point the AI service calls a model. A general statement that the platform is secure is not enough: ask for the specific tenant-isolation design, who can access each data path, and what evidence the vendor can provide.

How to assess tenant isolation at the model call

Start by mapping the full request path: the firm's user or application, the AI vendor's service, any foundation-model provider, and the systems that retain prompts, outputs and logs. Ask the vendor to identify where tenant identity is checked, how it is carried into each model request, and how the service prevents one customer's context or records from being exposed to another.

Ask whether model calls use per-customer credentials or deployments, or shared credentials protected by logical controls. Neither label proves safety on its own. Request an architecture explanation that covers the boundary, the controls applied to shared infrastructure, the people and service accounts able to cross that boundary, and how access is logged. Ask what changes if the vendor changes a model provider or adds a sub-processor.

Then request evidence appropriate to the sensitivity of the work: a current architecture or data-flow diagram, a description of tenant-separation tests, relevant independent assurance, and the contract or data-processing terms governing prompts, outputs, retention and model-provider access. Evidence should relate to the AI feature and service tier your team will actually use, not only to the vendor's wider platform.

Map AI vendor and client-data risks in an AI Risk & Efficiency Audit

What evidence should the review retain?

Record the vendor and product version, the data classes involved, the model providers and sub-processors identified, the isolation design described, the evidence reviewed, unanswered questions and the decision owner. Note whether prompts or outputs are retained, which features can access them, how long they remain available, and how a firm can retrieve or delete relevant records.

For client-facing or regulated work, also check how the service records who initiated a request, which model or feature handled it, what policy applied and where a reviewer can obtain the audit evidence. Confirm that the firm's own access controls and review points remain effective. A questionnaire answer is a starting point; verify material commitments in the applicable contract and product configuration.

When should a firm pause adoption?

Pause before entering confidential client material if the vendor cannot describe the model-call boundary, gives no usable evidence for its separation controls, or cannot explain its model-provider and retention arrangements. A refusal or material gap is a finding to document and resolve, not an assurance. Consider a lower-sensitivity use case, a controlled test with synthetic data, or a different service configuration while the gap is assessed.

This is a risk-based procurement check, not a guarantee that any architecture eliminates disclosure risk. The decision should reflect the actual work, client and regulatory obligations, contractual terms, available evidence and the firm's ability to monitor changes.

Make the control decision part of implementation

Assign an owner to approve the use case and evidence, set a review date, and define triggers for reassessment such as a new model, feature, sub-processor or contract term. Tell staff what information may be used, which tools and settings are approved, and where to escalate an exception. Keep a record of the decision and the human review required before AI-assisted work reaches a client.

Set ongoing AI governance and review controls

For a broader assessment of where AI can help or create risk, Pattrn Data's AI Risk & Efficiency Audit can map the work, data, owners, handoffs and controls before tool spend. Where the decision is to proceed, an AI implementation project can put the agreed controls into practice.