When AI use needs to be part of the client conversation
Decide disclosure from the engagement, client instructions, nature of the AI contribution and data handling. Record the decision and verify every claim about approved tools and confidentiality before telling a client.
For legal, audit, advisory and valuation work, consider what the client expects alongside the engagement terms and the AI contribution. Record the assessment. An expectation question helps identify an issue to review; it does not establish a universal disclosure duty.
The practical answer is materiality, confidentiality and reliance
Assess disclosure when AI handles client-confidential material, contributes to analysis or drafting, or changes the agreed service. Check the engagement and client policy for disclosure or consent requirements, and confirm any professional obligations that apply to the matter.
Where disclosure is appropriate, explain the task AI assisted with and the professional's role in the final decision. Describe the data safeguards and review only as far as the matter record supports them.
Check where AI disclosure is already a risk in your workflows
A useful disclosure threshold
Use these questions to assess the work, data handling and engagement. Each identifies a reason to examine disclosure or approval; a yes answer does not automatically settle the requirement:
- Client data is entered into a third-party or embedded AI system. This raises confidentiality, privilege, data protection and retention questions.
- AI contributes to professional analysis. Examples include legal research, audit evidence review, valuation assumptions, regulatory interpretation or advice drafting.
- The client may rely on the output. Consider how AI shaped a recommendation, filing, report or opinion, then decide what explanation the engagement and the client's reliance call for.
- The engagement terms say so. Check for restrictions on public tools, prior-consent requirements and specified systems before the proposed use.
- The regulator, insurer or professional body would expect evidence. Check the applicable requirements and keep a record of the user, material, approval and review. Do not assume the same disclosure standard applies in every context.
What the client actually needs to hear
Use specific wording that matches the task and the controls actually applied. The example below is usable only if its statements about tool approval, confidential material and review are true for the matter:
"We used an approved AI-assisted tool to support [specific task]. We did not use it to make the final professional judgement. No client-confidential material was entered into an unapproved public tool. The output was reviewed by [role/name] before being included in the advice."
If confidential data entered an approved system, explain the relevant contract terms, retention settings, access controls and limits on training or onward use only after checking them. Unapproved use needs an incident assessment and a decision on notification, rather than an assurance the firm cannot support.
Governance records matter as much as the wording
Keep the approved use case, tool, data category, reviewer, checks and final decision together. The partner or matter owner can then trace the work when a client or later reviewer asks how AI was used.
Maintain an approved-tool and use-case register, a review standard for client work and a route for staff to raise unusual matters. Connect the disclosure decision to those records.
Put a working AI governance routine around client disclosure
Examples by work type
- Low-risk admin: using AI to tidy an internal meeting note may not need client disclosure if no client data leaves approved systems and the note is not client advice.
- Client-facing draft: record AI assistance with advice, report sections or client emails and assess disclosure against the engagement and the role of the draft in the delivered work.
- Regulated judgement: assess AI support for legal analysis, audit conclusions, claims, valuation or compliance advice against the engagement and applicable professional requirements before deciding on disclosure.
- Confidential or privileged material: if privileged, personal, commercially sensitive or regulated data is involved, do not rely on informal disclosure after the event. Get the governance position right first.
Conclusion
Make the disclosure decision from the actual work and engagement. Where an explanation is needed, describe the task, checked controls and human review. Keep the supporting record with the matter.
Build the disclosure and review workflow into day-to-day delivery
Need a safer AI route for your firm?
If this article reflects a live decision in your practice, the useful next step is to map the workflows, confidentiality risks, supplier controls and governance gaps before tools spread informally.