Who should review AI output before it reaches a client?

Before AI output reaches a client, someone must own the review

AI can speed up drafting, research summaries, call notes, risk reviews and client updates. The risk is not that the tool writes badly. The risk is that an unchecked output leaves the firm with inaccurate advice, confidential data exposure, weak evidence, or a client-facing promise nobody meant to make.

For professional services firms, the answer is simple: AI output should not reach a client until a named human reviewer has checked it against the task, the source material, the client context and the firm’s policy.

The safest reviewer is the person accountable for the client work

The reviewer should usually be the fee-earner, adviser, manager or delivery owner who would have been accountable if no AI tool had been used. They do not need to reperform every step from scratch, but they do need enough context and authority to say: this is accurate, appropriate and safe to send.

A good review covers five things:

• Accuracy: does the output match the file, source data, instructions and known facts?
• Confidentiality: has client, personal, privileged or commercially sensitive data been handled inside approved boundaries?
• Professional judgement: is the conclusion appropriate, or has the tool overreached?
• Tone and context: does it fit the client relationship, risk level and channel?
• Evidence: can the firm show who reviewed it, when, and what changed before sending?

Map where AI output reaches clients before it is reviewed

Do not let review become a vague instruction

Many AI policies say “human in the loop” but never define the loop. That is not enough. Teams need a practical rule that says which outputs require review, who can review them, what they must check and what evidence must be kept.

Use risk tiers rather than one blanket rule. Low-risk internal formatting may only need a quick sanity check. Client-facing advice, regulated communications, financial analysis, legal drafting, claims handling, vendor recommendations or complaints should require a named reviewer with the right competence.

The most useful policy is not a ban on AI. It is a routing table: task type, permitted tools, allowed data, reviewer role, required checks and escalation path.

What the review should catch

A client-facing AI review should catch errors that generic quality assurance often misses:

• made-up citations, cases, figures, policy references or contract terms;
• client facts blended with assumptions from another matter;
• confidential information placed into an unapproved tool;
• draft wording that sounds authoritative but has not been checked;
• recommendations that cross from admin support into professional advice;
• unapproved commitments, guarantees, pricing statements or service promises;
• outputs that need specialist review by legal, risk, compliance, data protection or a partner.

If the reviewer cannot explain why the output is safe, it should not go to the client.

Build the review into the workflow, not into memory

The best control is a workflow step that teams cannot easily skip. For example, a client update drafted with AI should move through a review status, require an owner, record the source material used and keep the final approved version.

This does not need heavy bureaucracy. A lightweight record is often enough: tool used, data boundary, reviewer, date, risk tier, material changes and final approval. The point is to make responsible AI use visible and repeatable.

Set practical AI review rules for client-facing teams

What leaders should put in place

Leadership should make three decisions before AI-assisted work scales:

1. Name the owner. Decide who is accountable for AI-assisted outputs in each service line or workflow.
2. Define review thresholds. Separate low-risk internal work from client-facing, regulated, confidential or judgement-heavy work.
3. Keep review evidence. Make the audit trail easy enough that people actually use it.

Without those decisions, AI use becomes informal. Informal use is where shadow AI, missed checks and weak accountability usually appear.

Conclusion

AI output should be reviewed by the person or team accountable for the client outcome, supported by clear policy, workflow gates and evidence. The control should be proportionate, but it should be explicit. If a firm cannot show who checked a client-facing AI output, it has not really controlled the risk.

Turn AI review rules into a usable workflow