Make ownership visible before AI reaches client work
Name the professional accountable for the client deliverable, then separately name who checks the AI-assisted step and who explains any material use to the client.
For most professional services firms, that owner should be a named senior professional with the authority to set the use case, approve controls, stop unsafe use and require remediation. The role may sit with a partner, director, regulated manager or practice lead, depending on the service and risk. It should never be left as an informal shared responsibility between an IT team and individual users.
The accountable owner remains responsible for the final professional judgement
The named owner does not need to perform every review personally. They do need to define what a competent review looks like, assign it to people with the right expertise and retain accountability for the resulting client communication. AI output should be treated as working material until a human reviewer checks accuracy, context, assumptions, confidentiality and suitability for the client matter.
Assign the decision about using AI-assisted material to someone with the right authority for that service and engagement. Use the firm's existing sign-off rules to choose that person; the role need not be identical in every profession. Where work crosses teams, record a primary owner and the handover point so each reviewer knows what remains to be checked.
Assess the controls around your highest-value AI use cases
Set out the owner, reviewer and escalation path in the operating model
The accountable owner sets the permitted task and review standard. A delivery lead can maintain the process and training, while a competent reviewer checks an individual output against the client brief and relevant standards. Bring in security, legal or data-protection specialists where the data, retention, supplier terms or processing arrangements need their expertise.
Document the boundaries in a short control record. State the approved purpose, input restrictions, output checks, client disclosure position, escalation triggers and the named owner. For regulated work, link the record to existing quality management, complaints, incident and oversight processes rather than creating an isolated AI policy.
Build a practical AI governance operating model
Keep evidence that the review happened
Keep enough evidence to explain the review of a material output: the use case, tool, relevant input restrictions, reviewer, checks, material changes and final approver. Match the detail to the consequences of the advice, valuation, recommendation or communication. Refer to source records where possible instead of creating unnecessary copies of client material.
Use a risk-based approach. Low-risk internal drafting may need a light review note and an approved-tool check. Higher-risk client deliverables may need a structured checklist, retained evidence and a second reviewer. If the tool fails, produces a questionable answer or is used outside the approved workflow, the owner should know who pauses the process, who assesses impact and how clients are protected where necessary.
Give clients a clear, accurate explanation
Check the disclosure position against the engagement, applicable duties and the material role AI played. Where disclosure is required or appropriate, explain which work was AI-assisted and what the professional reviewed. Describe the actual confidentiality and quality checks without implying that the supplier has taken over responsibility for the client work.
The same owner who approves the workflow should approve the standard client wording. That keeps sales, delivery and risk teams aligned, while allowing engagement teams to adapt the explanation to the client, contract and service context.
Start with the work that needs the clearest control
Begin with client-facing tasks already using AI features or external tools. For each priority task, name the accountable professional and reviewer, permitted inputs, expected evidence and escalation route. Resolve missing ownership or review steps before expanding that use.
Turn approved AI use cases into an implementable control plan
Need a safer AI route for your firm?
If AI-assisted work crosses teams, check who approves the final deliverable and who explains its use to the client. Record the handover and escalation route before another output moves through that gap.