Fintech, health, and legal teams face the same temptation: the copilot writes tests in minutes, so someone suggests switching it on across the whole pipeline. In a regulated sector, one violation costs millions in fines and operational sanctions that stall product for months. Deciding when AI should not touch the code protects more value than any speed gain.
Regulated sectors come first
Fintech answers to the central bank and, in Brazil, to cybersecurity rules such as Resolution BCB 4.893. Health handles sensitive data under the LGPD and stacks ANVISA requirements on top. Legal carries professional privilege backed by statute; loop counsel in at the start, because sector rules shift by jurisdiction. A 30% productivity gain evaporates in front of the first fine or intervention.
Where the data leaks
Two paths dominate. Prompts carry real customer data to third-party APIs. And training or fine-tuning on your repository continues whenever the provider contract allows it. Treat the prompt as data: it travels outside the company just like an API payload. Both cases grow out of habit rather than malice.
Self-hosted models on your own GPUs
Llama, Mistral, and Qwen on GPUs you own trade raw capability for control. For unit test generation, isolated module refactoring, and internal documentation, the open models of 2026 cover the job. Dedicated hardware costs less than an LGPD fine; run that math against your inference volume. For complex architectural reasoning, a gap remains and the policy needs to acknowledge it.
Read the contract to the end
Enterprise tiers advertise zero retention. Confirm what the clause covers: prompts, completions, telemetry, abuse reports. Several providers retain data for abuse investigation even on paid plans, and that exception sinks the guarantee in a regulated context. Get the retention policy attached to the contract in writing, away from the marketing deck.
Synthetic fixtures for everyday work
Domains that demand isolation call for development against fake data shaped like production: same formats, same volumes, same edge cases. Libraries such as Faker and synthetic data generators assemble that material in minutes.
A policy in three zones
Close the document with a model that fits in a table:
- Green zone: external tools cleared for public code and public data.
- Yellow zone: approved tools with masked or anonymized data.
- Red zone: no external models; work stays on in-house infrastructure.
Assign a zone to every repository in the first month. Policy that fits in a table fits in the team's head.
