GLBA Compliance for Generative AI: Safeguards, Vendors, Prompts

Short answer: GLBA compliance for generative AI comes down to one idea. The Gramm-Leach-Bliley Act does not mention AI, and it does not need to. Any prompt, retrieval index, chat log, fine-tuning file or agent tool call that contains a customer's nonpublic personal information is "customer information" under the Safeguards Rule. Any AI vendor that receives it is a service provider you must vet, bind by contract and keep assessing. And any new use of that data has to fit what your privacy notice and Regulation P allow. Nothing about AI is exempt, and nothing about AI is banned.

This guide is for owners, CFOs, CTOs and compliance leads at lenders, tax and accounting firms, wealth managers, insurers, credit unions, fintechs and community banks. You will get five things:

• the five paths by which customer data gets into an AI system;
• a clause-by-clause map from the Safeguards Rule to AI controls;
• a side-by-side of what the major AI platforms say they do with your data (as of October 2026);
• the notification clocks an AI incident can start;
• a 30-day plan you can run with your existing team.

It is not legal advice. Confirm specifics with your counsel or compliance team.

Does GLBA apply to generative AI at all?

GLBA starts from a broad policy. Under 15 U.S.C. 6801(a), every financial institution has "an affirmative and continuing obligation" to respect customer privacy and protect the security and confidentiality of customers' nonpublic personal information (NPI). Regulators then turned that policy into two sets of rules.

1. Safeguards rules. These require a written information security program. The FTC's version is 16 CFR Part 314. Banks follow the Interagency Guidelines, credit unions follow NCUA's Part 748 guidelines and SEC-registered firms follow Regulation S-P.
2. Privacy rules. These cover notices, opt-outs and limits on sharing NPI with outside parties, mainly the CFPB's Regulation P (12 CFR Part 1016).

Neither set is technology-specific. Both apply as soon as AI touches covered data, because of how the key terms are defined:

• Customer information is "any record containing nonpublic personal information about a customer of a financial institution, whether in paper, electronic, or other form, that is handled or maintained by or on behalf of you or your affiliates." A prompt is a record. So is a vector embedding of a loan file, a stored conversation thread or a test set built from real tickets.
• Service provider means anyone that "receives, maintains, processes, or otherwise is permitted access to customer information" by providing services to you. An AI model API, an AI note-taker in client meetings, a chatbot platform and a consultancy building your retrieval system all qualify once real data flows to them.
• Information system includes systems "connected to a system containing customer information." An AI agent with an API key into your loan origination system is part of your information system, even if the model itself runs elsewhere.

Who counts as a financial institution

The FTC rule reaches more businesses than most owners expect. Part 314 lists mortgage lenders, payday lenders, finance companies, mortgage brokers, account servicers, check cashers, wire transferors, collection agencies, credit counselors and other financial advisors, tax preparation firms, non-federally insured credit unions, investment advisers not required to register with the SEC, and finders. It also covers customer information you received from other financial institutions, not just records about your own customers.

Key takeaway: The question is never "is this AI tool allowed under GLBA?" It is "which customer information reaches this tool, which provider holds it, and which control in our written program covers that path?"

Five ways customer financial data gets into an AI system

Most GLBA failures with AI come from data paths nobody drew. Teams secure the chat window and forget the retrieval index, or they negotiate no-training terms and miss that a stored-conversation feature keeps everything until someone deletes it.

1. Prompts and uploads. Staff paste a customer's statement into a chatbot to summarize it, or upload a tax return for extraction. This is the path most AI policies address, and the one shadow AI uses.
2. Retrieval indexes. Retrieval-augmented generation (RAG) works by copying documents into a search index, often as vector embeddings, so the model can look them up. That index is a new store of customer information. It needs the same need-to-know access rules as the source system, or the assistant will happily answer one customer's question with another customer's file. Our RAG chatbot cost guide covers how these indexes are built.
3. Logs and vendor retention. Prompts and outputs can persist in abuse-monitoring logs, conversation threads, uploaded file stores, evaluation datasets and your own application logs. Each has its own retention clock.
4. Training and evaluation data. Fine-tuning a model on real customer interactions, or building a test set from them, creates long-lived copies. If a vendor can use your data to improve its own models, that is also a privacy-rule question, covered below.
5. Agent tool access. An AI agent that can call your CRM, core banking or document management system through APIs reads and sometimes writes customer information without a human in each loop. Its permissions, credentials and logs fall under the same access-control and monitoring rules as an employee's.

What the Safeguards Rule requires when AI touches customer information

The amended FTC rule (16 CFR 314.4) is the most detailed GLBA safeguards standard. Banks and credit unions work under principles-based guidelines that ask for similar things. The table below maps each element of 314.4 to what it means for an AI deployment. You can use it as a gap assessment: one row per AI use case, one column per element.

Two details are easy to miss.

First, the small-institution exception is narrow. Under 16 CFR 314.6, institutions holding customer information on fewer than 5,000 consumers skip four items: the written risk assessment, the testing schedule in (d)(2), the written incident response plan and the board report. Access controls, encryption, MFA, disposal, monitoring, vendor oversight and FTC notice still apply. A three-person tax practice using an AI document tool is still on the hook for how that tool is configured and contracted.

Second, outsourcing does not move responsibility. The rule lets a service provider fill the Qualified Individual role, but you "retain responsibility for compliance." The FTC's own business guidance puts it plainly: if a service provider runs your program, "the buck still stops with you."

Key takeaway: Most firms already have the controls the rule requires. The AI gap is coverage. Retrieval indexes, AI logs, agent credentials and model endpoints are new systems that need to be in the inventory, the risk assessment and the test scope.

The privacy side: Regulation P, service providers and model training

Security is half of GLBA. The other half governs when you may disclose NPI to "nonaffiliated third parties", meaning outside companies, and that is where AI vendor terms matter most.

Under Regulation P, sharing NPI with an outside company normally requires a privacy notice and an opportunity to opt out. Three exceptions cover most AI use.

• The service provider exception (12 CFR 1016.13). You can give NPI to a company that performs services for you without an opt-out if you provide the initial privacy notice and sign a contract that "prohibits the third party from disclosing or using the information other than to carry out the purposes for which you disclosed the information."
• The processing and servicing exceptions (1016.14). These cover disclosures necessary to effect, administer or enforce a transaction the customer requested, or to service their account.
• Other exceptions (1016.15). These include fraud prevention, security of your records, and compliance with law.

Then comes the reuse limit in 1016.11(c). A third party that receives NPI under an exception may use it only "in the ordinary course of business to carry out the activity covered by the exception under which it received the information."

Here is why that matters for AI. An AI vendor that processes your customers' data to answer your staff's questions is acting as your service provider. A vendor that may also use that data to train or improve models it sells to everyone is using it for its own purposes. Whether that second use fits an exception, needs notice and opt-out, or is off-limits is a question for your counsel. Most firms avoid it entirely by choosing tiers and contracts where the vendor does not train on their data. That is one reason "no training on customer content" is the first clause compliance teams ask for.

Two more privacy points come up often:

• Privacy notices. Your notice must list the categories of NPI you disclose and the categories of third parties you disclose it to. Disclosures made only under the 1016.14 and 1016.15 exceptions are excluded from that list. Disclosures made only under the 1016.13 service provider exception need a separate statement of categories. If AI changes what you share or why, review the notice before launch.
• Changing your own terms. If you collected customer data under one set of privacy promises, using it for AI under looser terms can be its own problem. An FTC Office of Technology post from February 2024 warned that adopting more permissive data practices for AI training through a "surreptitious, retroactive amendment" may be unfair or deceptive. The same logic applies to the AI vendors you hire: check their terms for clauses that let them change data use unilaterally.

How the major AI platforms handle your data (October 2026)

Vendor review is where GLBA compliance for generative AI is won or lost. The table summarizes what four platforms state in their own documentation as of October 2026. Terms change often, so re-read them at contract time and at every renewal.

What to take from it:

• Enterprise and API tiers are not consumer apps. All four exclude your business data from model training by default. Consumer chat accounts may not, which is why shadow AI matters (see below).
• "Zero retention" is a feature list, not a switch. OpenAI's documentation shows ZDR covers some endpoints and not others. Stored conversations, files and vector stores persist until you delete them. Your engineers need to know which features they are using.
• The most capable models can carry stricter retention. Since June 9, 2026, Anthropic has required at least 30 days of prompt and output retention for designated Covered Models, on every platform where those models are offered. Its help center says zero data retention is not available for those models in workspaces, Claude Enterprise organizations or third-party platforms, though eligible customers get a temporary ZDR option for Fable 5 and 5.1. If your risk assessment assumed zero retention, that assumption breaks when a team switches to one of these models. That is a change-management event under 314.4(c)(7).
• Data location is a configuration choice. Azure's documentation is explicit that Global deployments may process prompts in any geography where the model is deployed. If you or your customers expect US-only processing, pick deployment types to match. OpenAI also offers regional processing in some regions.

For the full vendor questionnaire, including model supply chain and subprocessor questions, use our AI vendor risk assessment template.

Contract terms that make vendor answers enforceable

The Safeguards Rule requires you to put safeguards in the contract, not just in a questionnaire. For AI vendors that handle NPI, ask for at least these terms:

1. Use limitation. Customer information may be used only to provide services to you. No training, fine-tuning or improvement of the vendor's models or anyone else's without written permission. This also supports your Regulation P position.
2. Retention and deletion. Named retention periods for prompts, outputs, logs, files and indexes, deletion on request and at termination, and written confirmation of deletion.
3. Security program. Safeguards appropriate to the information, with independent evidence such as a SOC 2 Type II report, and your right to review it.
4. Incident notice. A defined deadline for telling you about incidents affecting your data. SEC-registered firms need this to support Regulation S-P's 72-hour rule. Banks need it for service provider notice under the computer-security incident rule.
5. Subprocessors and model changes. Advance notice of new subprocessors, new hosting regions and changes to the underlying model or its retention terms.
6. Assessment and cooperation. The right to assess the vendor periodically, and cooperation with your regulators and examiners.
7. No unilateral loosening. Material changes to data-use terms require your written agreement, not a website update.

New York's financial regulator suggests going further. In its October 16, 2024 AI guidance, NYDFS said that if third-party service providers are using AI, covered entities should consider additional representations and warranties about secure use of NPI. The letter adds no new requirements beyond NYDFS's cybersecurity regulation, but it shows what examiners will look for.

Shadow AI: when staff paste customer data into public chatbots

The fastest way to break GLBA with generative AI involves no project at all. An employee opens a free chatbot on a personal account and pastes in a client's account history to draft a letter. No vendor review, no contract, no logging, and possibly training enabled.

Under the FTC rule, a notification event is "acquisition of unencrypted customer information without the authorization of the individual to which the information pertains." Unauthorized acquisition is presumed when there was unauthorized access "unless you have reliable evidence" otherwise. Whether a particular paste is a reportable event depends on the facts: what was pasted, the tool's terms and settings, whether the data can be deleted and how many consumers were affected. That is a judgment for counsel. Your incident response plan should treat it as a security event from the first minute, not something to quietly delete.

Prevention beats analysis. The controls that work:

• Give people a sanctioned tool that is good enough. Staff turn to consumer AI because it helps them. An enterprise tool under a proper contract, with single sign-on, removes most of the reason.
• Block or restrict consumer AI on managed devices, and use data-loss prevention rules that flag account numbers, Social Security numbers and similar patterns in browser uploads.
• Write the rule down. An acceptable use policy should say which tools are approved for which data classes, with examples. Our AI acceptable use policy template is built for regulated firms.
• Train with your own scenarios, as 314.4(e) requires. "Don't paste NPI" lands better with an example from your own loan files or client letters.
• Make reporting safe. An employee who reports a mistaken paste within minutes gives you options. One who hides it does not.

AI agents and least privilege

Chat assistants read what you give them. Agents go and get it. An agent that can query your CRM, pull documents and update records is an authorized user of your information systems in every way that matters. The FTC rule defines "authorized user" as "any employee, contractor, agent, customer, or other person" authorized to access your systems. Treat the agent's service identity the same way.

• Separate identity per agent, never a shared admin key. Credentials in a secrets manager, rotated, and removed when the agent is retired.
• Scope to the task. A dispute-intake agent needs to read one customer's recent transactions, not export the ledger. Write permissions should be narrower still, and high-impact actions should need human approval.
• Pass the user's permissions through. When an agent acts for a staff member, it should see only what that person may see, which is the 314.4(c)(1)(ii) need-to-know standard.
• Log every tool call with the requesting user, the records touched and the result, as 314.4(c)(8) requires for authorized users.
• Defend against prompt injection. Documents and emails an agent reads can contain instructions. Test for this before launch and include it in penetration test scope.

If your agents connect through the Model Context Protocol, our MCP server security controls cover authentication, scoping and logging in detail.

The notification clocks an AI incident can start

AI incidents are security incidents. When one involves customer information or disrupts operations, several deadlines can run at once, depending on who regulates you.

• FTC-covered institutions must notify the FTC as soon as possible, and no later than 30 days after discovery, of a notification event involving at least 500 consumers (16 CFR 314.4(j)). An event counts as discovered once any employee, officer or agent other than the person responsible knows about it. In its August 2026 paperwork notice, the FTC said it received about 163 breach notifications in 2025.
• Banks must notify their primary federal regulator no later than 36 hours after determining that a "notification incident" has occurred (12 CFR 304 subpart C, with matching OCC and Federal Reserve rules). That rule is about incidents that materially disrupt or degrade operations, not data exposure as such. Bank service providers, including AI vendors that perform covered services, must notify the bank as soon as possible when an incident materially disrupts those services for four or more hours.
• SEC-registered firms must, under amended Regulation S-P, have policies requiring service providers to notify them within 72 hours of a breach affecting a customer information system the provider maintains. They must notify affected individuals as soon as practicable and within 30 days. Larger entities had to comply by December 3, 2025, and smaller entities, including registered advisers with less than $1.5 billion in assets under management, by June 3, 2026, according to Sidley Austin's summary.

For an AI deployment, the practical point is that your vendor contract has to produce the information you need inside your clock. A vendor that takes two weeks to confirm whether your prompts were in a compromised log store leaves an SEC-registered firm out of time.

What regulators have said about AI and customer data

No federal GLBA rule has been amended for AI. A Federal Register search we ran on October 24, 2026 found only paperwork renewals for Regulation P and the Safeguards Rule in 2025 and 2026, not substantive changes. Regulators have, however, explained how existing rules apply:

• NYDFS (October 2024) listed exposure or theft of NPI and third-party dependencies among the main AI cyber risks. It noted that AI products often gather large datasets and that NPI used for AI must still be disposed of when no longer needed.
• The U.S. Treasury (March 2024) interviewed 42 financial services and technology companies for its report on AI-specific cybersecurity risks. It called for a standardized description of vendor-provided AI systems, including how submitted data is used. Treasury stated the report imposes no requirements.
• The FTC keeps applying the Safeguards Rule without AI carve-outs. Its staff has warned that changing data terms quietly to enable AI training can be unfair or deceptive.

For banks, AI governance under SR 26-2 sits alongside GLBA rather than replacing it. Our guides to SR 26-2 model risk management and AI governance for community banks cover that side.

A 30-day plan for GLBA compliance with generative AI

This plan assumes you already have a GLBA information security program. It extends that program to AI rather than building a parallel one.

Week 1: Find the AI.

• Inventory every AI tool in use, sanctioned or not. Check expense reports, single sign-on logs, browser extension lists and network logs for AI domains.
• For each tool, record which of the five data paths carry customer information.
• Add AI systems, indexes and log stores to your 314.4(c)(2) inventory.

Week 2: Close the obvious gaps.

• Block or restrict consumer AI on managed devices and turn on data-loss prevention for common NPI patterns.
• Move approved use to enterprise or API tiers under contracts with no training and named retention.
• Turn on single sign-on with MFA for every approved AI tool.
• Publish or update your AI acceptable use policy.

Week 3: Paper the vendors.

• Run each AI vendor that touches NPI through your service provider process: due diligence, contract terms, periodic assessment.
• Confirm actual retention for the features in use (stored conversations, files, indexes), not just the headline policy.
• Have counsel confirm each data flow fits your privacy notice and a Regulation P exception.

Week 4: Test and report.

• Update the written risk assessment with AI risks and add AI scenarios to the incident response plan.
• Test permission-aware retrieval and prompt injection on any assistant or agent that reads customer records.
• Brief the Qualified Individual and include AI in the next board or senior officer report.

Key takeaway: Thirty days will not make an AI program perfect. It will give you an inventory, contracts, controls and a paper trail, and those are what an examiner or the FTC will ask to see first.

Common mistakes

• Treating "enterprise" as a compliance certificate. No-training terms are necessary but not enough. Retention, stored features, data location and access controls still need configuring.
• Forgetting the retrieval index. Teams secure the source system and then copy everything into a vector store that anyone using the assistant can query.
• One shared API key. It defeats need-to-know access, makes logs useless and turns one leaked key into full exposure.
• Never re-reading vendor terms. Retention requirements for frontier models changed in 2026. Make terms review part of model and vendor change management.
• Logging prompts forever. Your own application logs are customer information too. The two-year disposal rule in 314.4(c)(6) applies to them.
• Leaving compliance out of the pilot. A pilot on real customer data is a production data flow. Our guide to moving AI pilots to production covers how to build controls in from week one.

Bottom line

GLBA compliance for generative AI is not a new compliance program. It is your existing safeguards and privacy program applied honestly to new data paths: prompts, retrieval indexes, logs, training data and agent access. The hard parts are knowing where customer information actually flows, picking vendor tiers and contracts that keep it from being reused, and logging enough to prove what happened.

If you are planning an assistant or agent that will touch customer financial data, Fleurant AI builds AI for regulated industries with these controls designed in, and we offer a free discovery call. You can also browse our custom AI development work or the rest of the Fleurant AI site. When you are ready, talk to a specialist about your use case and the rules that apply to it.