Where professional services firms should draw the AI scope line
AI can support reversible, reviewable tasks on approved data. Put client-specific judgement and sensitive inputs through a separate approval lane, and keep unreviewed external decisions out of scope.
The scope line should be clear at the point of work. Staff need to know whether a task is permitted, needs separate approval or must stay with the responsible professional.
The safest answer is a tiered scope model
Start with internal support work on approved inputs, with a competent person checking the output. Set separate boundaries for sensitive information, advice preparation and external actions according to the engagement and sector. Approval to help prepare work should not be treated as permission to make the final professional judgement or send it without review.
A simple starting point is to split work into three groups: allowed, controlled and prohibited. That gives fee earners and delivery teams a fast decision route without asking them to interpret a long policy every time.
Map safe AI use cases before rollout
Work AI can normally support
For an initial scope, consider support tasks that staff can check and revise before anyone relies on them. Examples include:
- summarising public source material or non-confidential internal notes
- drafting first-pass outlines, checklists, meeting agendas and training material
- turning approved knowledge into plain-English internal guidance
- helping staff compare document versions, provided client confidentiality rules are respected
- creating internal templates where a qualified person reviews the final output
These uses still need guardrails. Staff should know which tools are approved, what data may be entered, how outputs must be reviewed, and where records of AI-assisted work are kept.
Work that should sit in a controlled approval lane
Some work can involve AI, but only after a use-case review. This includes any activity involving client-identifiable data, matter strategy, pricing, risk assessment, compliance analysis, due diligence, financial modelling, claims handling or advice preparation.
The review should answer four questions: what data is being used, what the tool does with it, who checks the output, and what happens if the output is wrong. If those answers are unclear, the work should stay out of scope until the control design is fixed.
Set up the governance lane for approved AI use
Work that should be out of scope by default
As a starting policy, keep the following uses out of scope unless a separate review establishes what is permitted for the engagement and sector:
- making final decisions on client advice, eligibility, liability, audit opinion or claims outcome
- submitting work directly to clients, courts, regulators or counterparties without human approval
- processing special category data, privileged material or highly sensitive commercial information in unapproved tools
- using client documents to train, fine-tune or improve third-party models without explicit contractual permission
- operating without audit trails, version control or named human accountability
Record the boundary against the task, not just the tool. A reviewer may allow help preparing a document while keeping its final judgement and release with the responsible professional.
How to turn the boundary into an operating control
A scope policy only works if it becomes part of daily workflow. The firm should maintain an approved-tool list, a use-case register, plain-language staff guidance, and a route for teams to request new AI uses. Reviews should cover data protection, professional duties, vendor terms, security, quality assurance and client disclosure where relevant.
For uses needing closer review, document the purpose, data types, affected group, output checks, likely failure modes, monitoring owner and approval date before launch. Separately check whether a formal impact assessment is required; this short record is not a substitute for it.
Conclusion
Write the scope so a team can check a task before starting. Name the approved inputs, the review point and who may release the work. Where the task falls outside that permission, request a separate decision rather than extending approval from a similar use.
Build the workflow and controls around approved AI use
Need a safer AI route for your firm?
If teams are extending AI into client work, map the permitted support tasks and the points where a professional must review or release the work. Use that map to make the scope and exception route visible.