How does your firm use AI on our engagement, and what happens to our data?

Answer for the work being done, not for the firm in general. Identify the AI tools and features that may touch the client’s information, what staff use them for, and what happens to the information at each step. If you have not verified a detail, say so and check it before giving a definite assurance.

Build an answer around the engagement

Start by mapping the work where AI is used or being considered. Include both dedicated AI tools and AI features inside software the team already uses. A general AI policy does not answer whether a tool is used on this engagement or what information it receives.

Use these checks to prepare an engagement-specific answer, not as a legal test or a universal disclosure rule. For each use, record:

• the task, such as transcription, drafting, summarising or analysis;
• the information entered, including client documents, personal information, commercially sensitive material or anonymised extracts;
• the tool, account type, relevant settings and people who can access the output;
• what the team checks before relying on or sharing the output.

Distinguish current use from proposed use. If staff may use a tool but you have not confirmed whether it has been used on the engagement, do not imply either that it has or that it has not.

Verify what happens to the data

Check the terms and settings for the specific product, account and feature in use. Do not rely on a provider’s general description or assume that settings for one plan apply to another. Where relevant, establish:

• whether prompts, files, transcripts or outputs are stored, and for how long;
• whether data may be used to improve or train models, and what controls or exceptions apply;
• which provider personnel or other organisations may process or access the data;
• where processing and storage take place, if that matters to the engagement;
• how access is controlled and what happens when information or an account is deleted;
• whether connected services, integrations or meeting tools create additional copies.

Keep the exact terms, settings or provider responses you checked, along with the date and product version. If a provider’s answer is unclear, record the uncertainty instead of turning it into a promise.

Check the engagement before you explain or change the workflow

Compare the proposed use with the engagement terms, any client instructions and the firm’s own commitments. Consider whether the information can be minimised, redacted or handled through a different process. Check who in the firm is authorised to approve the tool and the use case.

Do not assume that every use of AI needs the same form of client permission, or that a general policy settles the question. The answer may depend on the information, the service, the agreed terms and the applicable requirements. Where those are unclear or the information is particularly sensitive, pause the use and ask the appropriate internal lead or a qualified adviser to assess it.

A useful client explanation states what is used for this engagement, what information is involved, the relevant handling arrangements, and any limits or human checks. If the firm does not use AI on the engagement, say that narrowly and explain whether that means no use by the team, no use with client information, or no use in a particular part of the work.

Keep a record that supports the answer

Maintain a concise record that can be checked when the workflow or provider changes. Include the engagement and use case, tool and account, information categories, settings and terms reviewed, decision-maker, date checked, client instructions considered, and any unresolved points. Note when the decision should be reviewed again, for example after a material change to the tool, its terms or the work.

This record helps the team give a consistent answer. It does not by itself establish that a use is appropriate; the underlying terms, settings and engagement context still need to be checked.

Discuss the decision

If you are weighing up an AI tool or need to explain its use on client work, get in touch to discuss the decision and whether a useful next step makes sense.