Question 1

What do you do with my data when AI is involved?

Accepted Answer

What do you do with my data when AI is involved? You should only use it for the agreed purpose, keep it out of public training sets, limit vendor access and leave an audit trail showing who reviewed the output.

Question 2

Who should review AI output before it reaches a client?

Accepted Answer

Who should review AI output before it reaches a client? A named human owner should check accuracy, confidentiality, tone and risk before anything client-facing is sent, because accountability cannot be delegated to the tool.

Question 3

Who is responsible for firm-wide AI governance?

Accepted Answer

Who is responsible for firm-wide AI governance? The board and senior leadership stay accountable, but day-to-day control needs a named owner, clear policy ownership and evidence that teams follow the rules.

Question 4

How to create audit trails for AI-assisted workflows without spreadsheet work

Accepted Answer

How to create audit trails for AI-assisted workflows without spreadsheet work: capture the evidence automatically at the point of use. Log the input, tool, data source, reviewer, decision and version in the workflow system itself, with policy checks for confidential or regulated work.

Question 5

Which AI tools should you inventory for EU AI Act readiness?

Accepted Answer

Which AI tools you need to inventory for EU AI Act readiness depends on use, risk and data context, not whether the tool is fashionable. Start with every AI-assisted workflow that affects staff, customers, decisions or regulated records, then classify each one and record the controls.

Question 6

How should professional services firms connect AI governance to workflow controls?

Accepted Answer

Professional services firms should connect AI governance to workflow controls by mapping each AI use case to an owner, approval step, evidence record and human review. The goal is a traceable operating model, not a separate policy document.

Question 7

What should boards ask to balance AI adoption with risk oversight?

Accepted Answer

Boards should ask whether each AI use case has a named owner, a clear risk rating and evidence that controls work. The safest route is a board-level question set that links ambition to data protection, accountability and review.

Question 8

What should an AI vendor due diligence questionnaire ask beyond standard security questions?

Accepted Answer

An AI vendor due diligence questionnaire should go beyond cyber controls and ask how the model is built, tested, governed and monitored, because AI failures include inaccurate outputs, prompt injection, training data risk and unclear accountability.

Question 9

Can a very small business realistically use AI inventory management?

Accepted Answer

A very small business can use AI inventory management if it starts with one clear stock problem, clean sales data and human review. The safest first step is low stock alerts or reorder suggestions, not fully automated buying.

Question 10

What should boards ask to balance AI adoption with risk oversight?

Accepted Answer

Boards balancing AI adoption with risk oversight should ask where AI creates value, where it can harm customers or clients, and who is accountable for controls. The answer is a board-level operating rhythm, not a one-off AI policy.

Question 11

What AI policy, audit log and verification rules should chambers set before barristers use AI in client work?

Accepted Answer

AI policy for barristers using AI in client work should set approved uses, confidentiality controls, audit logs and mandatory verification before any output is relied on. Chambers need records, training and review so AI use supports professional duties rather than weakening them.

Question 12

What ethics and review rules should a professional services firm set before automating client work?

Accepted Answer

Before automating client work, a professional services firm should set clear rules for confidentiality, bias checks, human review and accountability. AI can support delivery, but client-facing outputs need documented oversight and escalation routes.

Question 13

When does an AI use case need a data protection impact assessment before launch?

Accepted Answer

An AI use case needs a DPIA before launch when it is likely to create high privacy risk, especially if it handles client, employee or special category data, monitors people, makes material recommendations, or relies on a third-party AI vendor. Treat the DPIA as a launch gate, not paperwork after the tool is live.

Question 14

How financial services firms should connect AI governance to risk and controls frameworks

Accepted Answer

Financial services firms should connect AI governance to existing risk and controls frameworks by mapping each AI use case to accountable owners, data controls, testing evidence, human review and audit records before it goes live.

Question 15

Which EU AI Act duties should an SME map before deploying an AI system?

Accepted Answer

SMEs deploying AI should map the system, role, risk class, provider instructions, oversight owner, input data controls, monitoring, logs, transparency duties and incident routes before launch, because the EU AI Act gives deployers their own operational obligations.

Question 16

What should a law firm review before using AI with confidential client data?

Accepted Answer

A law firm using AI with confidential client data should review the tool, the task, the contract and the supervision record before any matter data is entered. If confidentiality, training use or human review cannot be evidenced, keep the data out of the tool.

Question 17

What client-data boundaries should a professional services firm set before using AI?

Accepted Answer

Client-data boundaries for AI should be set before any client work enters a tool: define which data is prohibited, restricted, approved, or anonymised, then tie each rule to human review, confidentiality, vendor checks, and incident reporting.

Question 18

How should a firm decide which AI tools are approved, supervised, restricted, or prohibited for client work?

Accepted Answer

To decide which AI tools are approved for client work, classify each tool by data sensitivity, task risk, vendor controls and supervision needs. The safe answer is a tiered register: approved, supervised, restricted or prohibited, with evidence for each decision.

Question 19

When does uploading privileged legal material to a public AI tool risk destroying confidentiality?

Accepted Answer

Uploading privileged legal material to a public AI tool risks destroying confidentiality when the tool stores, reviews, reuses or exposes the material outside the lawyer-client circle. Treat public AI tools as external recipients unless a secure, approved setup says otherwise.

Question 20

What supervision record should lawyers keep when AI contributes to legal advice?

Accepted Answer

What supervision record lawyers should keep when AI contributes to legal advice is a matter of privilege, confidentiality and professional accountability. Record the tool, input limits, lawyer direction, checks, final judgement and client-impact review.

Question 21

What should a CPA firm ask before putting client data into an AI provider?

Accepted Answer

A CPA firm should ask how the AI provider stores, processes, trains on, shares and deletes client or taxpayer data before any upload. The safer route is a written vendor review, contract limits, human review and documented consent where tax rules require it.

Question 22

When should an accounting firm disclose AI use to clients?

Accepted Answer

An accounting firm should disclose AI use when the tool interacts with clients, influences advice, handles client or taxpayer data, or could affect a client decision. Lower-risk internal drafting may not always need separate notice, but it still needs human review, data controls, and clear engagement-letter wording.

Question 23

Which EU AI Act obligations apply to an SME as a deployer?

Accepted Answer

Which EU AI Act obligations apply to an SME as a deployer depends on the role, use case and risk level, but support schemes do not remove the duty to comply. Start with role mapping, usage records, human oversight and supplier evidence.

Question 24

What client-confidential information should be kept out of AI tools?

Accepted Answer

Client-confidential information should be kept out of AI tools unless the tool is approved, contractually controlled, and the use is necessary. Matter facts, personal data, privileged advice, deal details and client files need partner-approved guardrails before use.

Question 25

What should our AI governance checklist include before teams scale beyond pilots?

Accepted Answer

An AI governance checklist before scaling pilots should prove what tools are allowed, where client data goes, who reviews outputs, and what evidence is kept. The aim is not paperwork; it is controlled adoption that protects confidentiality, professional standards, and client trust.

Question 26

Which AI tools can touch client-confidential data?

Accepted Answer

Which AI tools can touch client-confidential data depends on whether the tool is approved, contractually controlled, technically restricted and auditable. If you cannot prove confidentiality, data handling, retention and human review, do not approve it for client matter data.

Question 27

What AI governance evidence should a buyer expect to see?

Accepted Answer

A buyer should expect clear, reviewable evidence that AI use is governed, risk-assessed and monitored. That means policies, inventories, DPIAs or risk assessments, vendor checks, human review controls and board-level ownership.

Question 28

What governance controls should be documented?

Accepted Answer

What governance controls should be documented? Any organisation using AI should document the controls that govern approval, data use, review, accountability, and monitoring, because undocumented controls are hard to apply consistently. If a control only exists in conversation or custom, it will usually fail under pressure.

Question 29

Which tools are approved for which tasks?

Accepted Answer

Which tools are approved for which tasks? Every organisation using AI should define that explicitly, because tool approval without task boundaries creates avoidable risk. If teams do not know which tools are allowed for drafting, analysis, client data, or sensitive decisions, governance exists on paper only.

Question 30

Which risks did it flag because they appear in template memoranda across all deals, and which risks did I actually discover by talking to the management team?

Accepted Answer

Which risks did it flag because they appear in template memoranda across all deals, and which risks did I actually discover by talking to the management team? That distinction matters because AI often surfaces repeated reporting patterns faster than genuine situational insight. If a system cannot separate boilerplate risk language from interview-led discovery, analysts may overrate pattern recall and underrate real diligence judgement.

Question 31

Should I disclose my use of gen AI to clients?

Accepted Answer

Should I disclose my use of gen AI to clients? Usually yes when AI affects how client work is performed, reviewed, handled, or risk-managed, because disclosure supports trust and sets clear expectations. If confidential data, judgement-heavy tasks, or regulated outputs are involved, the need for clarity is even stronger.

Question 32

How much direction, documentation, and control are required for an AI platform to function as an agent of counsel, such that privilege or work product attaches?

Accepted Answer

How much direction, documentation, and control are required for an AI platform to function as an agent of counsel? A lot more than most teams assume: privilege or work product is more likely to depend on a tightly defined legal purpose, controlled inputs, documented supervision, and confidentiality safeguards. If the tool is used casually or without legal oversight, protection is much harder to defend.

Question 33

Does the platform retain user inputs?

Accepted Answer

Does the platform retain user inputs? Often yes, at least for some period, unless the vendor's architecture, settings, and contract terms say otherwise. Before deployment, firms should confirm what is stored, for how long, who can access it, and whether retention can be limited or disabled.

Question 34

What datasets were used to train or fine tune the models in your service?

Accepted Answer

What datasets were used to train or fine tune the models in your service? Buyers should ask for a specific answer, because training data affects bias, auditability, sector fit, and legal risk. If a vendor cannot explain dataset sources, exclusions, and limitations clearly, the model is not ready for high-trust use cases.

Question 35

Is customer data used to train or fine tune the model?

Accepted Answer

Is customer data used to train or fine tune the model? It should not be assumed either way, because some vendors exclude customer data by default while others allow training unless contract terms and settings say otherwise. Before rollout, firms should confirm retention, opt-out controls, and confidentiality safeguards in writing.

Question 36

How should firms evaluate AI vendors before buying?

Accepted Answer

How should firms evaluate AI vendors before buying? Start with governance, security, implementation fit, and evidence of real operational value, otherwise you risk purchasing a tool that creates more overhead than benefit. Any shortlist should also be tested against confidentiality, auditability, and accountability requirements.

Question 37

What exception handling, escalation, and logging controls should teams add before automating a messy workflow with AI?

Accepted Answer

Before automating a messy workflow with AI, teams should define exception paths, escalation thresholds, and decision logging first, otherwise errors get amplified instead of contained. The safest setup keeps a human review point for edge cases, policy breaches, and low-confidence outputs.

Question 38

What approval gates should marketing teams keep when AI speeds up content production?

Accepted Answer

What approval gates should marketing teams keep when AI speeds up content production? Keep human review for anything that can create brand, legal, or claims risk, and let low-risk formatting or repurposing skip to lightweight QA. If AI is touching regulated claims, competitor comparisons, or customer promises, a named approver should still sign it off.

Question 39

What governance, audit trail and approval checks should teams complete before using AI in a regulated workflow?

Accepted Answer

What governance, audit trail and approval checks should teams complete before using AI in a regulated workflow? Start with clear ownership, documented approval gates and a tamper-evident audit trail, because regulated use fails fastest when decisions cannot be explained, challenged or reproduced.

Question 40

What should insurers ask vendors before approving AI for underwriting or claims?

Accepted Answer

What should insurers ask vendors before approving AI for underwriting or claims? Start with governance, data provenance, testing, explainability, monitoring and accountability, because customer-impacting AI is only safe to approve when controls are evidenced and decision risk stays reviewable.

Question 41

What should insurers ask an AI vendor before signing?

Accepted Answer

What should insurers ask an AI vendor before signing? Start with where your data is stored, how decisions can be explained, and what happens when the system fails, because those three areas expose the biggest operational and regulatory risks. If the answers are vague, do not proceed without contractual controls, human review, and clear incident handling.

Question 42

How should firms monitor AI-assisted customer journeys under Consumer Duty?

Accepted Answer

How should firms monitor AI-assisted customer journeys under Consumer Duty? Firms should track outcomes, friction points and vulnerable-customer signals continuously, because early warning data is what lets you fix emerging harm before it becomes a conduct problem, especially where AI influences decisions or communications.

Question 43

Which AI governance controls should an accounting firm verify before approving a vendor for client-facing work?

Accepted Answer

Which AI governance controls should an accounting firm verify before approving a vendor for client-facing work? Start with security, confidentiality, human review, auditability and clear contractual limits, because client-facing use raises regulatory and reputational risk quickly. If the tool touches client data or outputs advice, QA and policy controls should be explicit before approval.

Question 44

What governance controls and response SLAs should clinical AI teams publish for high-risk output exceptions?

Accepted Answer

What governance controls and response SLAs should clinical AI teams publish for high-risk output exceptions? They should publish named escalation paths, severity-based response times, audit logging, and human review rules, because vague assurance language is not enough when patient safety is at stake. Any workflow should also spell out documentation, QA, and clinical accountability requirements.

Question 45

What should a clinical AI audit trail capture?

Accepted Answer

A clinical AI audit trail should show what the system reviewed, what it recommended, who checked it, what changed and why the final decision was trusted. The record needs enough context for clinicians, auditors and governance leads to reconstruct the decision later.

Question 46

Can using AI tools waive legal professional privilege, and what firm guardrails prevent that?

Accepted Answer

Using AI tools can waive legal professional privilege if privileged material is disclosed to a third party or reused beyond the confidential lawyer-client relationship. Prevent it with an approved AI stack, strict ‘no client data in public AI’ rules, and logging, redaction, and access controls.

Question 47

How should CPA firms manage generative AI risk (governance, privacy, disclosure and liability)?

Accepted Answer

How should CPA firms manage generative AI risk? Treat it like a new high-impact tool: set clear governance and approved use cases, keep client data out of public models by default, and document when and how AI was used to protect quality and liability.

Question 48

How should automated workflows handle exceptions without creating manual rework?

Accepted Answer

Automated workflows should route exceptions by risk, urgency and ownership instead of dumping everything into a manual backlog. The useful design is clear triage, visible evidence, human review for edge cases and feedback loops that reduce repeat exceptions over time.

Question 49

What should an AI audit trail include? (A practical checklist)

Accepted Answer

A useful AI audit trail lets you recreate a decision end‑to‑end: who did what, when, with which model, which inputs, and what humans changed. This checklist covers the minimum you need for investigations, compliance, and continuous improvement.

Question 50

What AI governance controls should insurers require for third-party AI vendors (audit rights, incident reporting, data use, and model changes)?

Accepted Answer

If you’re buying AI from a third party, governance has to travel with the contract. Insurers should require audit rights, incident reporting, data-use limits, model-change control, security evidence, and ongoing monitoring so risk stays controlled after go-live.

AI Governance and Automation Questions for UK Professional Services

How to use this AI questions hub

AI governance basics

Client confidentiality and data protection

Tool approval and Shadow AI

Financial services and insurance

Accountancy and legal

Implementation and controlled automation

Vendor due diligence

The commercial question behind every AI question

Still not sure what applies?