Where does client data go when UK consultants use AI, and what controls should firms require?

UK consulting, accountancy, legal and advisory firms should not approve an AI tool for client work based only on a product label or a general assurance about data protection. For each proposed use, check the engagement terms, identify the information involved and verify the settings and terms for the exact product and plan. If permission or a necessary control is unclear, keep the information out until the engagement owner resolves the question.

Start with the engagement and information

Check the signed engagement terms and any client-specific restrictions. Classify the material staff propose to use-for example, public information, internal material, confidential client records, personal data or information subject to heightened duties. A use that is suitable for public research may not be suitable for a confidential transaction or regulated advice. Where terms are silent or unclear, record the uncertainty and ask the engagement owner to decide.

Trace data through the exact product and plan

Record the product, plan, model provider and enabled features. Verify what may be sent through prompts, files, connectors and generated outputs; whether inputs may be used for training or service improvement; how long prompts and logs are retained; where processing occurs; and which provider personnel or subprocessors may have access. Check the applicable contractual terms and live administrative settings for that specific plan. Treat training, retention and access as separate questions.

Set proportionate controls before use

For each approved use case, document the purpose, permitted data categories, approved product and plan, accountable owner, access restrictions, any redaction or minimisation steps, retention requirements and response if information is entered into an unapproved service. Do not treat removing names as proof that a document is anonymous; surrounding context may still identify a person or engagement.

Keep professional judgement and review visible

Assign a qualified reviewer before use and match the review to the consequences of an error. Preserve enough evidence to reconstruct the work: the approved use case, product and data class, checks performed, reviewer, changes made and final decision. Apply any partner or specialist sign-off required by the firm’s own policies, client commitments and applicable obligations.

Make the decision repeatable

A concise register can connect each use case to its purpose, data class, verified product and plan, contractual basis, controls, reviewer, evidence location and next review date. Recheck it when a provider changes terms or features, an engagement changes or an incident occurs. This gives partners a practical basis to approve, restrict or stop a use case rather than relying on informal assumptions.

When to get help

If your firm cannot map data flows, verify supplier terms, assign owners or set meaningful review points, map the work and exposure before buying another tool. Pattrn Data’s AI Risk & Efficiency Audit can help identify where AI may help or add risk, and which controls and decisions need to be made visible. For a defined implementation, see Pattrn Data implementation services.

Source and provenance

Adapted from the source question, “Where does your data go when a consultant uses AI?”, and the source article Protecting your data when consultants use AI. Product terms, settings and client obligations should be verified for the specific engagement and product before use.