The two rails: confidentiality and liability, as policy

Samsung leaked its own property and could decide for itself how much that hurt. A consulting firm in the same position leaks its client's property - and trust is the product the firm sells. That is the whole translation, and it is why this rail outranks every productivity gain in the course: a firm that is 25% faster and untrusted is not a firm.

The timeline, compressed to the version you will retell:

The architecture answer has two layers. Layer one is contractual. Consumer tiers of both major vendors may train on your conversations unless you opt out - their own terms say so, and note that Anthropic's consumer tiers train unless opted out under its September 2025 terms. Enterprise and API tiers do NOT train on business data by default, contractually - OpenAI's enterprise privacy page and Anthropic's commercial terms both state it. The rule shape to memorize: consumer tiers may train unless opted out; commercial/enterprise/API tiers do not train by default.

Layer two is behavioral. Even inside approved enterprise tools, client-identifying material gets anonymized before it enters a prompt. The contract protects you from the vendor; anonymization protects you from everything else - screenshots, misrouted chats, the tool you forgot was consumer-tier.

A firm could, in principle, run on consumer tools with every employee's opt-out toggled. Do not. A behavioral guarantee degrades one new hire, one reset device, one forgotten toggle at a time - and you will not know it degraded until the incident. A contractual guarantee degrades only if the contract changes, which is visible, negotiable, and somebody's job to watch. When your policy names approved tools in Part 3, the tier is the point: you are buying the contract, not the model.

What the incident cost was not the refund - A$97,000 is a rounding error for a big-four firm. It was the headline: a global brand attached, in public, to fabricated citations in government work. Every procurement officer who read that story now asks every consulting firm the same question, and your firm needs a better answer than "we tell people to be careful."

The rail: a named human owns every citation, quote, and number that reaches a client. AI-supplied facts are leads until source-verified - a lead is useful, a lead in a deliverable is a liability.

And the disclosure half is becoming structural: disclosure clauses in client and government contracts - stating whether and how generative AI was used - are the emerging norm. Deciding your firm's disclosure posture BEFORE a client asks is Part 3's section four; deciding it after they ask is called an apology.

Precision matters when you retell this story to your partners, because the exaggerated version is easier to dismiss. Deloitte never said the whole report was AI-written; it attributed specific errors to generative AI use it later disclosed, and the revised report named the tool. The strategy was not the finding at issue; the production details were. Told that way, the story is not "AI wrote a bad report" - it is "fluent, unverified production details survived every internal read and a client-side academic caught them." That version is harder to wave off, because every practice ships production details every week.

And the leader's clause that makes the other five real: no exceptions for rainmakers. The first time a top biller gets a pass on the data rules, the policy converts from a rail into a suggestion - and everyone watching knows it.

Policy on paper is half the system; reflexes are the other half, and those live in the consultant track. Session b3 builds the research discipline that treats AI-supplied facts as leads. Session b8 runs the confidentiality drill against a live gate: a draft that scores 87 on prose quality alone gets capped at 15 the instant client-identifying material appears in it, and the alarm lists the leaks. If you lead a practice, have your consultants run both - a team that has watched the gate slam once writes section 2 into its own muscle memory.