Client trust is harder to repair than it is to protect
Check your engagement terms and the role AI plays in the matter. Tell clients in advance when it changes data handling, substantive work or the review they reasonably expect; seek advice on any specific disclosure or consent duty.
Separate a specific notice or consent duty from the firm's broader communication policy. Review whether AI changes client data handling, the work delivered or the review the client expects.
Resolve confidentiality and client-reliance questions before the affected work starts.
Disclosure is usually the stronger governance position
Review both internal productivity uses and substantive client work against the engagement terms. The role of AI in each task determines what needs to be assessed.
Disclosure is especially important where:
- client information is entered into an AI-enabled system
- AI helps generate draft analyses, reports, or recommendations
- the output supports regulated, financial, legal, or professional judgement
- contract terms limit subcontracting, data sharing, or technology use
- the client expects a particular review or staffing model
- errors or hallucinations could affect advice quality or accountability
Explain the process and seek any notice or consent required for the matter.
Assess where AI disclosure risk actually sits
What firms should disclose in practice
Describe the AI contribution and the controls that actually apply to the client's work.
Prepare answers to these questions:
- what role AI plays in the workflow
- whether client data is entered into any external or vendor-managed system
- what human review remains in place
- what confidentiality and security controls apply
- whether AI output is relied on directly or only used as a draft aid
- what limits or exclusions apply to higher-risk tasks
Keep the explanation consistent with the workflow and the review the firm can evidence.
Why silence can create more risk than disclosure
If a client discovers material AI use later, they may question what was agreed and how their information was handled. Address those points before starting the work.
Consider whether undisclosed use could lead to:
- loss of trust even where the actual controls were reasonable
- disputes over whether consent should have been obtained
- questions about confidentiality handling and vendor access
- pressure on fees if the client thinks automation was hidden
- difficulty defending the workflow if quality issues appear later
Agree how material AI use will be communicated and record any client instructions about it.
Build a client-safe AI governance model
When disclosure should be mandatory rather than optional
Check the duties that apply to the engagement before deciding whether notice or consent is required.
Use these circumstances to prompt that review:
- engagement terms require notice of new tools, subprocessors, or data handling changes
- sensitive personal, financial, legal, or commercially confidential data is involved
- AI is used in drafting substantive client-facing outputs
- the client has its own AI policy or procurement controls
- the work depends heavily on professional judgement and the workflow changes materially
- sector regulation or professional standards point toward transparency
Where a duty or engagement term requires disclosure, agree the wording and timing. In other cases, record the firm's communication decision and its reasons.
What good disclosure language sounds like
Explain the role of AI, limits on its use and the review that remains in place. Avoid promising a safeguard the actual workflow cannot support.
For example, firms may explain that AI is used to support drafting, summarisation, or workflow efficiency under human review, and that confidential information is handled according to defined security and governance controls. That gives the client something concrete to assess.
A simple decision rule for firms
Ask whether AI changes something the client would reasonably expect to know: data handling, substantive work or quality review. Check the engagement terms and obligations as well as that expectation.
Define the use case, review the risk and agree what to communicate before work begins.
Turn AI use policies into workable client-facing practice
Conclusion
Decide how to communicate material AI use from the actual engagement and workflow. Explain data handling and review arrangements, and record any notice, consent or client instruction needed for the matter.
Keep that decision under review if the tool's role or the client's instructions change.
Need a safer AI route for your firm?
If this article reflects a live decision in your practice, the useful next step is to map the workflows, confidentiality risks, supplier controls and governance gaps before tools spread informally.
