Could AI use compromise privilege or audit independence?
AI may introduce different risks to a legal matter and an audit engagement. For legal work, check confidentiality and privilege before sending information to a provider. For audit work, test the tool's effect on evidence quality and any applicable independence rules.
The safest answer in practice
Before using AI on a matter, file, audit or client deliverable, check that the tool is approved for the data and task. Review the provider's retention and training terms and settings, and name the professional accountable for the final judgement.
For legal work, the concern is confidentiality and privilege. For audit and assurance work, the concern is independence, evidence quality and whether the audit file can show how conclusions were reached. For each use, define the permitted inputs, review and record needed for that work. Escalate uncertain use cases before the output reaches the client.
Check where AI creates privilege or audit-file risk
Where privilege and independence risk usually appears
Check informal use as well as approved workflows. A fee earner, analyst or auditor pastes client facts into a public AI tool to speed up drafting, summarise documents or test a conclusion. That action can move confidential information outside the controlled matter environment and may leave no useful audit trail.
Also check AI features in document platforms, practice-management systems, CRMs, meeting assistants and analytics tools. Include them in the review even if staff are not using a standalone chatbot. The question is whether the data handling, retention, training, access and review settings match the professional obligation attached to the work.
Controls that should be in place before sensitive use
- Approved tool list: name which AI tools can be used for client work, internal work and non-sensitive experimentation.
- Data boundary: state which information must never be entered into public or unapproved AI tools, including privileged, confidential, special category, audit evidence and regulated client data.
- Vendor evidence: keep contract terms, retention settings, training terms and any available opt-outs, sub-processor details and security reviews with the vendor file.
- Human review: name the professional responsible for checking accuracy, source use, client confidentiality and any independence requirements relevant to the work, and for the final judgement.
- Decision record: log the tool, purpose, input category, reviewer, changes made and reason the output was accepted or rejected.
Put proportionate AI governance around client work
How legal and audit teams should apply the rule
Legal teams should start from the matter risk. If the work involves privileged analysis, litigation strategy, personal data or commercially sensitive facts, the default should be no public AI input unless the firm has specific approval and evidence for that tool. Even then, the lawyer should record what was checked and keep the final advice as their own professional judgement.
For audit and assurance work, identify the source evidence and record the AI-assisted step, reviewer, checks performed and basis for the conclusion. This applies to tasks such as summarising, classification, sampling, anomaly spotting and drafting. Review the AI output against the source evidence before relying on it.
A practical review checklist
- Identify the AI tool or feature being used.
- Classify the data involved: public, internal, confidential, privileged, regulated or audit evidence.
- Check the vendor terms, retention, training and sub-processor position.
- Decide whether the use is permitted, restricted or prohibited.
- Assign a human reviewer and record the review.
- Update the firm policy if the same use case is likely to recur.
Use the checklist to record which tools and tasks are permitted, restricted or prohibited, and who can resolve an uncertain case.
Conclusion
Check confidentiality, privilege, applicable independence requirements and evidence quality before using AI in professional work. Record the approved use, vendor checks, reviewer and decision. Where a question remains unresolved, escalate it before using the output in client work.
Build the workflow controls for safe AI adoption
Need a safer AI route for your firm?
Before approving AI for a matter or audit file, identify the data involved, supplier terms, professional review and unresolved confidentiality or independence questions.
