Decide what to tell clients about your firm’s use of generative AI

UK accountancy and professional-services firms should decide what to tell clients about generative AI by looking at the task, the information involved, the safeguards in place and how a qualified person reviews the work. A firm-wide approach helps staff explain actual practice consistently, while leaving room to consider the needs of each engagement.

Start with the AI use, not a blanket statement

List the tools staff use or plan to use, including AI features embedded in other software. For each use, record its purpose, the work it supports, the information entered and whether its output could affect client-facing analysis, advice or deliverables.

Distinguish administrative uses from uses that contribute to substantive client work. Set out which uses are permitted, which need approval and which are not to be used. Assign an owner to maintain the inventory as tools and workflows change.

Check information handling before use

Before entering client information, establish how the provider and the firm’s chosen settings handle it. Check the relevant terms and settings for storage, retention, model improvement, access, sharing, deletion and incident responsibilities. Record what you have checked and any unresolved questions.

Do not rely on a product label as proof that a particular workflow is suitable. If the firm cannot establish that the use is appropriate for the information involved, pause that use until the uncertainty has been resolved.

Define review and evidence

Treat AI output as material for professional review, not as a substitute for the firm’s judgement. Define who checks accuracy, completeness, source support, calculations, confidentiality and suitability for the engagement. Review underlying evidence as well as the wording of the output.

Keep proportionate evidence of the use and review where appropriate: the workflow, the reviewer, the checks completed and any corrections or decisions. Apply the firm’s normal quality procedures before work reaches a client.

Explain the approach clearly to clients

Where the firm decides to explain its use, describe what actually happens: the purpose of the AI use, the type of information involved, relevant safeguards, how a qualified person reviews the work and how a client can raise questions. Keep client-facing statements, engagement documents, staff guidance and practice aligned.

Do not assume one disclosure or consent approach applies to every firm, client or engagement. If duties or wording are uncertain, seek advice from a suitably qualified professional for the circumstances.

Prepare a practical implementation record

• Record the tools, embedded features and tasks in scope.
• Classify uses by client impact and information sensitivity.
• Set permitted, approval-required and prohibited uses.
• Document provider handling checks and unresolved issues.
• Name the human reviewer and the checks required before delivery.
• Set an owner and review trigger for changes to tools, terms or workflows.

If you need help assessing where controls or implementation work should focus, explore the Pattrn Data AI Risk & Efficiency Audit.

Source and scope

This practical framework draws on the source question, “Should I disclose my use of gen AI to clients?” from the CPAI education resource: Should I disclose my use of gen AI to clients? It is not a legal conclusion or advice for a particular engagement.