Beyond the AI Hype: How to Safely Deploy Customer Support AI in Regulated Industries

A recent Deskpro survey of over 220 support and IT leaders found that while 37% of organizations have deployed some level of AI across multiple support functions, 52% are still in exploration or pilot phases, and 11% have no current AI adoption plans. The gap between AI hype and deployment has been especially pronounced in regulated industries, such as financial services and healthcare, where strict data security and legal requirements mean AI pilots are more likely to get shut down or never get approved in the first place.

The risk of security breaches, compliance violations, fines, and reputational damage means security is non-negotiable for most organizations in regulated industries. However, organizations that delay or avoid AI initiatives in customer support are missing out on significant opportunities, including:

• Improving the agent experience by automating routine tasks and reducing cognitive load through suggested responses, summarization, and ticket deflection.
• Increasing self-service adoption so customers can resolve straightforward issues quickly and agents can focus on more complex or emotionally charged issues.
• Personalizing issue resolution for customers using context from past tickets or interactions.
• Reduced customer and employee service costs due to reduced load on human agents, productivity improvements and reduced customer and employee churn.

The challenge that support leaders now face is deploying AI that benefits their customers and organizations without compromising their data.

The barriers to implementing customer support AI in regulated industries

81% of customer support leaders in regulated industries rate security as “very important” or “critical,” and 43% will not proceed with an AI project at any level without strong security guarantees, according to Deskpro’s survey. Unfortunately, the majority of SaaS vendors don’t meet these strict security requirements because they rely on public AI services, such as OpenAI or Anthropic, hosted by the public cloud hyperscalers, AWS, Microsoft Azure and Google Cloud models.

When support organizations expose their data to AI models running in the public cloud, they may lose control over how that data is stored, processed, or reused—raising concerns about exposing sensitive or proprietary information. Using public services may also breach data protection laws that require organizations to store data on servers within specific geographic boundaries. For example, if a US-headquartered company rolled out a public cloud-based AI help desk, it could be blocked by the company’s European subsidiaries due to data being processed outside the EU (a violation of GDPR).

Failing to meet data protection requirements is one of the most common reasons AI projects get shut down by compliance, security, and legal teams. Gartner estimates that through 2026, organizations will abandon 60% of AI projects unsupported by AI-ready data.

One precaution organizations can take is to limit the data sources connected to their AI software. However, this limits the usefulness of the technology, creating a poor customer experience. For instance, if a customer begins chatting with an AI-powered chatbot about a ticket they submitted earlier, that chatbot might lack the necessary context to help them resolve the issue, leading the customer to get frustrated and escalate the issue to a live agent.

The private AI path: Adopting AI while reducing risk

Due to the uncontrolled nature of AI models hosted in public clouds, many support teams in regulated industries are struggling to meet security requirements and get their AI initiatives off the ground. However, there’s an alternative route that allows organizations to benefit from AI while maintaining control of their data.

Support organizations in regulated industries can deploy AI in their own controlled environments: in private or sovereign cloud environments, or on-premise in their own or co-located data centers. This means they control where their data is processed and stored, ensuring they meet sovereignty and other data protection requirements, such as GDPR, the EU AI Act, HIPAA and PCI DSS. Compliance teams can audit where the data lives and who has access to it, making it easier for them to sign off on the AI initiative.

Deploying AI in a private environment also means that the organization can index and use their proprietary data with a large language model (LLM)–from conversation transcripts to knowledge base articles to ticket histories–without fear of exposing sensitive information. In the cases where an organization is training their own LLMs, support teams can tune the model to align with their brand voice and provide more personalized service (using context from previous interactions and drawing on the organization’s knowledge base), leading to a better customer experience.

What regulated support teams need to consider before implementing AI

Before investing in a new AI project, support leaders should work with their security, compliance, and legal teams to ensure that their organization–and its data–are ready. Here are a few key considerations:

• Data readiness. Support leaders should work with their compliance and legal teams to audit the data sources that will be connected to their AI. This includes documenting what data is public, what is internal only, and what contains PII to determine what an AI model can safely access and where data processing needs to happen. Understanding these data requirements will help determine whether to use a public or private AI model.
• Regional requirements. Support leaders must understand the data protection laws of every country or region in which their organization does business. Any AI projects they launch will need to comply with the requirements, which may include storing data within specific geographic boundaries.
• Organizational readiness. While not strictly a security requirement, support leaders should also work with their teams to make sure they understand why the organization is implementing AI, how they should use it, and how it will help rather than replace them.

Regulated support teams benefit from secure AI

Surveys confirm support leaders in regulated industries want to implement impactful AI strategies but struggle to get approval from their legal and compliance teams. The path forward is to prioritize data control, security, and compliance from the outset of the AI project and choose a solution that can meet those requirements. With the right infrastructure and guardrails in place, AI can improve both agent efficiency and customer experience without introducing unacceptable risk.

Learn more from Deskpro's CEO