AI readiness review
A review of where AI is used today, what data it touches and the risks, with a prioritised plan. Offered as a Family CFO project.
AI, used safely
Designed so AI prepares the work and a named person signs it off.
AI-native tools, designed to be deployed read-only first, with named human review, approval thresholds and audit trails on every decision.
The five controls
Every piece of AI-assisted work is designed to pass through them, in this order.
Every engagement is designed around five AI controls: read-only first, named human review, approval thresholds, dual sign-off on payments and full audit logs.
Read-only first
AI tools are designed to start with view access to the data a task needs, with no way to move money, change records or send messages on their own.
Named human review
Each output will have one named reviewer, set out in your engagement letter, who checks it against source documents before it is used.
Approval thresholds
Your family will set the limits. Above each one, a more senior person, or the family itself, will need to approve.
Dual sign-off on payments
Two people will approve every payment, in separate steps, however the request arrived.
Full audit logs
What the AI prepared, who reviewed it, what changed and who approved it will all be recorded, and you will be able to see the record.
Can an AI take control of our accounts?
No. Our AI tools are designed so that they cannot move money, and so that nobody using one can either.
No credentials
AI tools are designed never to be given a bank login, a payment token or an API key with payment rights. They will read from a view-only feed that the bank itself restricts.
No path to execute
The AI is designed to draft the payment run, not to submit it. Every payment will be released inside the bank's own platform by two named people, in separate steps, with their own credentials and multi-factor login.
Your thresholds
Above the limits your family sets, the principal will approve. Those limits are designed to sit in the bank's platform and in our process, so an AI cannot change them.
Payee verification
A new payee, or a change to bank details, will be confirmed with a known contact on a known number before anything moves. That will apply even when the request appears to come from the principal.
Separation of duties
The person who prepares a payment will never be one of the two who approve it. Access will be reviewed when roles change and at every quarterly review.
Everything logged
What the AI prepared, who reviewed it, what changed and who approved it will be recorded, and the family will be able to see the record.
An AI tool that reads emails and documents can be fed instructions hidden inside them. Because our tools are designed only to draft, the worst a hidden instruction could produce is a draft that a named person rejects. That is the point of starting read-only.
An illustrative example
A capital call, from notice to payment.
This example is illustrative and shows how our controls are designed to work. The amounts, thresholds and roles are not a real client's, and your own are agreed when you engage.
- AI, read-only
A fund's capital call notice for $480,000 arrives. The AI reads it, matches it to the family's commitment records, checks the cash forecast and drafts the payment.
Read-only first - Your Avestix CFO
The named CFO checks the notice against the fund documents and confirms the bank details through a known contact, not the details in the email.
Named human review - The family
The amount is above the family's $250,000 threshold, so the principal is asked to approve it.
Approval thresholds - Two approvers
The payment is released only after two people approve it in the banking platform.
Dual sign-off on payments - The record
The notice, the draft, the review, both approvals and the payment confirmation are kept together in the audit log.
Full audit logs
Approval thresholds
An example of how thresholds can be set.
| Action | Amount | Who approves |
|---|---|---|
| Recurring bills already approved in the budget | Up to $25,000 | Avestix CFO and a second approver |
| One-off payments and new payees | Up to $250,000 | Avestix CFO and a family-appointed approver |
| Capital calls, investments and large transfers | Above $250,000 | The principal, then two approvers |
| Changes to bank details or payees | Any amount | Confirmed by a known contact, then two approvers |
AI Governance Services
Policies, controls and audit trails for AI use across the family office.
For family offices with their own team, we put the same discipline we have designed for our own work in place for the AI tools your people and your family already use.
Policy and controls
An AI use policy, an approved-tools list, access rules and the five controls, written for your office.
Vendor review
Checks on each AI provider: security, where data goes, how long it is kept and whether it is used to train models.
Safe AI for principals
Many principals already ask AI tools for investment, legal and tax views. We set up approved tools and agree with counsel what should never go into them.
Second opinion
Send us AI-generated analysis and a named person on our team reviews it before you act on it.
Training
Practical sessions for staff and family members on what AI does well, where it fails, and AI-enabled fraud.
Security and data
What we hold, where, and who can see it.
| Question | Our answer |
|---|---|
| Where is family data held? | Family data will be held in cloud accounts that Avestix controls, hosted by Amazon Web Services in the United States (us-east-1, Virginia). Bank and custodian data is designed to reach us through read-only feeds and not to be copied into AI tools beyond the task in hand. Nothing will be held in consumer accounts. |
| Which AI providers do you use? | We will use Anthropic's Claude, under an Enterprise agreement, for drafting, reconciliation and review work. No other AI provider will see family data. Any new provider will pass the same vendor review we offer clients: security, where data goes, how long it is kept and whether it trains on it. |
| Is our data used to train AI models? | No. Our Enterprise agreement with Anthropic will exclude our data from model training, and chats and files will be deleted after 30 days. Family data will not be used to train any model, by us or by the provider. |
| Who can see our data? | Only the people named in your engagement letter will see it, with access reviewed when roles change and at every quarterly review. AI tools will see data through read-only access and will never hold a bank login or payment permission. |
| What certifications do you hold? | Avestix Wealth does not hold a certification of its own and does not claim one. The providers we have chosen to hold family data and run our AI tools, Amazon Web Services and Anthropic, hold SOC 2 Type II and ISO 27001 certifications. We will say here when that changes. |
Answers reviewed November 2026. We will update this page when a provider or setting changes.
Bring AI into your family office safely.
Start with an AI readiness review, or talk to us about Family CFO.