How to Approve AI Tools for Confidential Client Work

Approve an AI tool for client work only for a defined combination of tool, plan, configuration, information category and use case. Before use, map what information it will receive, verify the provider terms and technical controls that apply to that plan, set client and access boundaries, name the accountable owner, and keep evidence of review. A firm policy is not proof that a system enforces those boundaries.

Map the proposed use before approving a tool

Start with a real task. Illustrative examples include summarising an audit document, preparing a legal matter chronology, drafting an insurance submission or analysing advisory material. Record the intended users, client or matter, purpose, information accessed, output, recipient and human review point. The same product may be suitable for one task and unsuitable for another.

Classify information by what it contains and what could happen if it is exposed or used incorrectly. Consider client identifiers, financial records, legal matter material, privileged or otherwise sensitive communications, employee information, credentials, internal risk assessments and third-party data. Define which categories are allowed, restricted or excluded for this use, and whether minimised or de-identified inputs could meet the need.

For retrieval or connected applications, check the actual access path. Confirm whether a user or AI feature can search across clients or matters, whether access follows existing permissions, and whether outputs could include material from another client. Do not treat a written instruction to keep clients separate as a technical boundary unless the configuration and tests demonstrate that separation.

Verify terms and controls for the exact plan

Review the current contract, product terms, privacy and security materials, and settings for the specific plan being considered. Establish what happens to prompts, uploaded files and outputs: how they are retained or deleted, whether they may be used for model improvement, who may process them, what subprocessors are involved, and what processing locations are stated. Check whether administrative controls, audit records, identity management, retention settings and support commitments apply to that plan, and retain the source and date of each check.

Separate contractual statements from observed technical behaviour. A provider term describes an agreed or stated practice; it does not by itself show that a firm has configured access correctly. A successful test shows behaviour under the tested conditions; it does not establish every provider practice or future behaviour. Record both, along with open questions and the person responsible for resolving them.

Test realistic boundary cases before approval. Use appropriate test data to check that users cannot retrieve another client's material, that excluded information is not included in prompts or connected searches, and that generated drafts do not disclose content from unrelated files. Check access and change records where available. If a needed safeguard cannot be verified, narrow the use, exclude the affected information, or do not approve that use case yet.

Set ownership, review and pause criteria

Name a business or professional owner for the use case and an operational owner for the tool configuration. Specify who can grant access, who reviews outputs, who approves client-facing communication, and who monitors changes to provider terms, product plans, integrations and settings. Review by a person should be meaningful: the reviewer must be able to check source material, correct errors and decide whether the work is fit for its intended purpose.

Keep a concise approval record with the tool and plan, configuration, permitted task, data categories, client or matter boundary, provider terms reviewed, tests performed, reviewer and owner, approval date, evidence location and review date. Define pause triggers in advance, such as a plan or terms change, a new integration, an unexpected cross-client result, missing access records, an unexplained retention setting, or a reviewer finding that cannot be resolved. State who can suspend the use and how affected access will be checked.

Apply the same discipline to staff using personal accounts and to client or third-party sharing. Make the approved route clear, limit sharing to a defined set of information, assign an owner, and ensure access can be reviewed and ended. Client communication about AI use should be considered in the context of the firm's own engagement and communication processes; this article does not determine what any firm must disclose.

Choose a practical next step

If your firm needs to identify where AI could help or hurt, and what controls and evidence are missing, start with a focused review before expanding access to client information.

Explore the AI Risk & Efficiency Audit or explore AI governance consulting.