When clients need to be told that AI was used
Check engagement terms, client instructions and the role AI played in the matter. Explain material use in plain language where required or where it changes data handling or the service the client reasonably expected.
Ask whether a client or file reviewer would expect to know how AI influenced the work. Use that question to assess the engagement, rather than as an automatic disclosure trigger. Record the decision and the human review; explain the use in plain language when disclosure is required or appropriate.
The safest answer is proportionate disclosure plus a file note
Assess material use when client information enters a tool, AI assists advice drafting or evidence analysis, or external retention, training and access settings affect data handling. These are reasons to examine the disclosure decision, not a rule that every use must be disclosed. Check what the client agreed to and how the assistance affected the work.
Where disclosure is needed, describe the task the tool assisted with and who made the final professional judgement. Keep a file record of the tool and its approval, the information entered, the reviewer, the checks and any changes made before delivery. Only describe controls that the record supports.
Check where AI use needs disclosure and evidence
What counts as material AI use?
Client-confidential information, personal data and privileged material need particular attention, as do regulated advice, audit evidence, valuation, claims handling and financial recommendations. Assess how AI affected confidentiality, quality and the work the client will rely on. The involvement of one of these categories does not, by itself, settle what the client must be told.
Examples to assess include summarising a client file, drafting advice from matter facts, transcribing client calls or using embedded AI in a practice, CRM or document platform. Tool approval should identify the permitted use and data. The matter owner still needs to decide on disclosure and review for the actual task.
How to decide what the client should be told
Use a short decision tree. First, did client data or client context enter the tool? Second, did AI influence advice, judgement, drafting, evidence analysis or a client-facing deliverable? Third, would the client reasonably expect a human professional to have done that part of the work unaided? Fourth, do the contract, engagement letter, professional rules or regulator guidance require a particular standard of transparency?
Record the engagement-specific disclosure decision and its approver. If disclosure is required or agreed, describe the task and actual review accurately. Include a no-training statement only where checked terms and settings establish it for that use, and document any limitation.
What the internal record should contain
Record the tool, purpose, information category, confidentiality controls, reviewer, checks and final decision. Include a decision not to use AI where data or judgement risk made the proposed use unsuitable. This gives the matter owner a record to examine alongside any disclosure.
A structured entry in the matter file or approval log can hold the record. It should let a later reviewer trace the data entered, the checks and the accountable person. A completed field is not proof that every control worked.
Build an AI disclosure and review operating model
How this differs by professional context
For the specific engagement, identify who will assess confidentiality, privilege, client communication, independence, evidence and professional judgement. For financial or insurance activity, include the reviewer responsible for customer outcomes and decision records. Document which disclosure requirements actually apply and why.
Explain sensitive-data handling and professional review in terms the client can understand. The explanation should reflect what happened on the matter and leave responsibility for the advice with the professional.
A practical disclosure rule for firms
A firm can group uses into internal productivity, controlled assistance and higher-risk client work. Formatting non-confidential notes, summarising approved documents and drafting material advice need different scrutiny. Set the review and disclosure decision for each category against the engagement and data involved; do not make the category label a substitute for that decision.
Agree a review schedule and revisit the categories when tools or permitted uses change. Procurement, IT, risk and fee-earners should identify approved tools, allowed information and client communications that need a disclosure decision.
Conclusion
Decide what the client should be told from the engagement, data handling and AI's contribution to the work. Keep the explanation specific and supported by the file note. Escalate higher-risk matters before the team proceeds with the proposed use.
Implement AI review and disclosure controls
Need a safer AI route for your firm?
If this article reflects a live decision in your practice, the useful next step is to map the workflows, confidentiality risks, supplier controls and governance gaps before tools spread informally.