In regulated work, the question isn't "does this help" — it's "how exposed am I"

Sell efficiency to a practice principal and you get polite interest. Sell certainty about exposure and you get a calendar invite.

That's not because efficiency doesn't matter in regulated settings. It's because it isn't the thing keeping anyone awake. In allied health clinics, legal support teams and NDIS providers, the honest position for most organisations is: staff are probably already using these tools, on the free tier, and nobody has written anything down. The principal knows this. What they don't know is the size of it.

Why this sector is different

Three features stack up.

The workforce is large, casual and turning over. Particularly in disability and care settings. Every new support worker is a new person deciding for themselves what's acceptable to paste into a chat window, and the induction that would have told them otherwise hasn't been written.

**The documentation is the compliance.** In NDIS work especially, what you can demonstrate at audit is what exists in writing. Documentation quality isn't an administrative nicety — it's the evidence base. Which makes it both the highest-value place to improve and the place where an unreviewed AI output does the most damage.

Someone else decides whether you were careless. An auditor, a regulator, a professional body, a complaints commissioner. The standard isn't "did it work out" — it's "was this reasonable, and can you show it".

That third point is why the sequencing has to change. In a trade business you can start with the work and write the rule later. Here, the rule comes first, because training people to use a tool before you've established what's permitted is asking them to take a risk on your behalf.

The conversation that actually happens

It usually opens with a version of "we can't use AI, our information is confidential", and it usually means one of three quite different things:

• We have an obligation and I don't know whether this breaches it. A real question with a real answer, and it's about your account tier and your consent position more than the tool. We wrote about why the same tool gives two different answers about your data.
• Someone told me this was risky and I haven't had time to work out whether they were right. Very common, and usually resolvable in one conversation.
• I suspect it's already happening and I'd rather not confirm it. The most consequential of the three, and the one where waiting is the expensive option.

Separating those three is most of the first call. They lead to genuinely different engagements: an advisory conversation, a policy session, or an audit followed by a rule followed by training.

What we won't do

The boundary here is published rather than discovered halfway through. Clinical judgement, legal advice, financial advice and safety sign-off stay with the qualified person. Not as a liability shield — because a wrong output in those areas is a regulated harm rather than an inconvenience, and no amount of careful prompting changes that.

We also won't write your privacy content for a clinical setting without it being reviewed by someone qualified in your field. The allied health privacy module is the one place where being confidently wrong does real damage, and it's also where being right is the entire competitive advantage. Getting that reviewed is not a delay; it's the product.

What improves, concretely

Once the rule exists, the work that opens up is substantial and almost entirely outside the confidentiality problem:

• Policies, procedures and position descriptions, which are always out of date.
• Induction and training material for a workforce that keeps changing.
• Audit preparation: turning what you do into what you can show.
• Progress and service reports written from de-identified inputs.
• Client-facing letters that explain a process, with no client in them.
• Incident write-ups structured consistently, drafted by the person who was there and checked by the person accountable.

That last one is the pattern worth noticing: drafted by whoever has the facts, checked by whoever carries the responsibility. That division is what makes this defensible, and it's the structure the NDIS and disability provider track is built around, as it is for allied health clinics and legal support teams.

The cost of waiting

Every month without a written rule is a month of use you can't see, by people who are doing their best with no guidance, on accounts you don't control, producing documents that may end up in front of an auditor.

The training is the easy part. Finding out where you stand is the part that's worth doing this quarter.