cyber-safe ai roadmap

A cyber-safe AI roadmap
for family offices.

A cyber-safe AI roadmap is five decisions, taken in order. Find where staff already use AI, decide which documents may ever reach a model, choose where the platform runs, set access by role and document, and keep an audit log the office can read. Each decision belongs to the principal and the COO, with IT doing the work.

inventory · classify · place · permit · recordWritten by , Founder, Super Chain. Last updated .
where it starts

Why the roadmap starts with what staff already do.

AI usually reaches a family office before any policy does. A note-taking app joins the investment committee, a free assistant drafts a letter to the bank, a browser add-on reads every page it is shown.

A roadmap that begins with platform selection skips that reality. The first stage is an honest list of what is already in use, made without blame, so the rest of the plan rests on facts.

five stages

Five stages, and who runs each.

Each stage ends in a written decision, dated, that the next stage relies on.

  1. Inventory, run by the COO with each team lead. List every AI tool in use, including personal accounts, phone apps and browser add-ons.
  2. Classify, decided by the principal and the COO. Sort the office’s documents into those that may go into a hosted tool, those that may not, and those to decide case by case.
  3. Place, run by the COO with IT. Decide where the platform for sensitive work runs: a private cloud tenancy or the office’s own servers. Choose the model provider and write down the fallback.
  4. Permit, run by IT and signed off by the COO. Set access by role, down to the single document, and remove access the day someone leaves.
  5. Record and review, owned by the compliance lead. Keep an audit log the office holds, and review it with the vendor terms on a fixed schedule.
what the regulator describes

What the FCA describes as good practice.

The FCA’s review of AI in financial services, published on 19 October 2026, describes firms adopting AI architecture that reflects the sensitivity of each use case, and keeping logs and audit trails of AI interactions. It names reliance on a single AI provider without exit options as an area for improvement. (Source: FCA, October 2026.)

Most family offices are not FCA-regulated firms. The review is still a useful checklist, because it describes what careful financial firms already do.

where a platform fits

Where a platform fits in the roadmap.

Super Chain covers stages three to five. It runs on the office’s own private cloud or servers, sets access by role down to the single document, and records each query in an audit log the office holds.

Each office configures the model the platform uses, which supports the written fallback. The first two stages belong to the office. See also how to protect family office data when using AI and on-premise AI for wealth management.

who it is for

Who this is for, and who it isn’t.

This roadmap is for single and multi-family offices beginning to formalise how they use AI. It suits a principal or COO who wants a plan to sign, not a list of tools.

It is not for an office with a mature security function. That office will fold these stages into its existing controls.

delivery

How Super Chain is put in place, and who does what.

  • iScope. The office names one owner and chooses one vehicle for the 30-Day Office Memory Pilot. Together we agree where the platform will run: the office’s private cloud or its own servers.
  • iiDeploy. Our team installs Super Chain on that infrastructure and configures roles, document permissions and the model the office chooses.
  • iiiLoad and check. The office loads that vehicle’s documents, not a tidied sample. We review the first answers with the owner against the cited pages.
  • ivUse. For 30 days the team asks real questions. Every query is recorded in an audit log the office holds.

Super Chain is accountable for the platform and its configuration. The office remains accountable for which documents go in, who may see them, and the terms of the model provider it chooses.

// what can go wrong
  • The process moves mid-way, for example a new custodian. We re-scope against the new process and tell the office what that changes.
  • No owner inside the office. We pause until one person can decide.
  • A model or vendor changes its terms. We check terms at selection and re-route to another model when they change.
  • Some documents must stay in-house under the office’s policy. We scope the deployment to that policy before any document moves.
  • The best answer turns out not to be AI. We say so, and rank it alongside the AI options.
// track record

Super Chain is built by Super Cat Technology. The same team built a fully on-premise retrieval system for a Big 4 firm, where every answer returns with its source paragraph.

“The roadmap I give a family office starts with what staff already paste into AI tools, not with a vendor shortlist. Then pick a platform you could switch to another model without starting again. On a private-markets search build, my team moved entity grouping to a model about 90% cheaper, and nothing else had to change.”

What Cat is seeing in October 2026.

  • October 2026When a family office asks me where to begin, it usually has no security team to hand the question to. The first useful step is the inventory, and it costs nothing but an afternoon of honest answers.
  • October 2026The question I now suggest asking any AI vendor is how you would leave them. The FCA’s good-practice page of 19 October 2026 names reliance on one AI provider without an exit plan as an area for improvement (FCA, October 2026).
  • October 2026Probing a small firm with AI agents has become cheap. Reuters reported on 19 October 2026 that one operator used agents to break into more than 100 company websites (Reuters, October 2026). Offices with lean IT are asking me what that means for them.
questions

The questions offices ask, plainly answered.

What belongs in a cyber-safe AI roadmap for a family office?

As of October 2026, Super Chain suggests five steps. List where staff already use AI, and decide which documents may ever reach a model. Choose where the platform runs, set access by role and document, and keep an audit log the office can read. Each step is a decision for the principal and the COO, not for IT alone.

Who should own AI security in a family office?

The principal or the COO, with IT doing the work. As of October 2026, Super Chain’s view is that the decisions in an AI roadmap concern the family’s information, so they sit with the person accountable for it. IT runs the deployment and permissions, and a compliance owner reviews the audit log and vendor terms.

How does a family office avoid depending on one AI provider?

Choose software that can run with more than one model, and write down the fallback. The FCA’s October 2026 good-practice review names single-platform dependence without exit options as an area for improvement. As of October 2026, Super Chain lets each office configure the model it uses, so the model can be changed per office.

Where should a family office start with AI security?

With an inventory of what staff already use. AI often arrives before any policy does: free assistants, note-taking apps, browser add-ons. As of October 2026, Super Chain suggests listing them, deciding which documents may ever reach them, and only then choosing a platform for the work that needs the family’s own documents.

To run stages three to five on one vehicle first, Start the 30-Day Office Memory Pilot →
// the next step

The 30-Day Office Memory Pilot

We load one vehicle’s documents onto your infrastructure. Your team asks real questions of them for 30 days, and each answer comes back cited to the page it came from.

Choose a time below to scope the pilot with us. If you would rather see the platform first, book a private demonstration.

Open the scheduler →