What ethics and review rules should a professional services firm set before automating client work?

Automating client work changes the ethics of delivery

When AI supports client work, set review rules for the task and profession. A person responsible for the deliverable should check material facts and judgement before it reaches the client; data handling and disclosure depend on the engagement and the tool.

For each proposed drafting, summarisation, classification or routing task, identify the data involved, quality checks and responsible reviewer. Record how fairness, confidentiality and exceptions will be assessed before the task is approved.

Put the review requirements into the client-work procedure: who approves the task, who reviews the output and who handles an exception. Keep unresolved professional or data-handling questions with the responsible owner.

The safest rule is to automate support tasks before professional judgement

Assess drafting, extraction, classification and workflow routing against the task's data boundary, review standard and escalation path. Keep final advice, regulated judgement, client commitments and sensitive decisions under the responsible professional's control.

For each step, record permitted use, prohibited data, the named reviewer and the required audit trail. Resolve gaps in that record before approval.

Check where AI can safely improve client delivery

Start with a permitted-use list and a red-line list

Define which tasks are allowed, which require extra review and which are prohibited. Treat the examples below as categories to assess for the firm's approved tools and engagements, not permission for every use.

• Allowed: summarising internal notes, drafting first-pass client emails, extracting actions from meeting transcripts, checking document completeness and routing tasks.
• Allowed with controls: analysing client documents, comparing policy wording, producing recommendations, preparing client-facing reports and scoring risk.
• Proposed restricted activities to assess: use of privileged or confidential material, final professional judgement, billing changes and advice based on generated output. Have the responsible professionals set the actual prohibitions, review conditions and exception authority for the engagement.

This list should name the approved tools and settings. If the firm uses public AI tools, Copilot-style assistants or embedded AI features in existing platforms, the policy should explain what each tool may process and what it must not process.

Protect client confidentiality before testing productivity

Before approving a client-work task, record the data it may process, storage location, model-training use, output access and retention arrangements. Check these against the engagement's confidentiality requirements.

Ask the responsible professional and data-protection owners to review any privilege, commercial confidentiality or regulatory restrictions that apply. Keep that decision separate from the expected time saving.

Useful review questions include:

• Does this workflow need identifiable client data, or can it use a redacted version?
• Is the AI tool approved for the sensitivity of this matter?
• Are prompts, source files and outputs retained in a way the firm can inspect later?
• Can the client reasonably understand where AI has influenced the work?

Make human review specific, not symbolic

Define the checks the human reviewer must complete for the work in scope.

For client-facing outputs, the review rule should cover factual accuracy, source support, professional judgement, tone, missing caveats, bias, confidentiality and whether the output answers the client’s real question. For regulated or high-risk work, the reviewer should record the checks completed and any changes made.

A practical review matrix can separate work into three levels:

1. Low risk: internal summaries, formatting, routine drafts. Decide whether spot-checks and reviewer sign-off meet the firm's review standard for the task and data involved.
2. Medium risk: client-facing drafts, research synthesis, workflow recommendations. Require full human review before sending.
3. High risk: advice, decisions, risk scores, privileged matters, regulatory or financial impact. Require senior review, evidence capture and a clear escalation route.

Build fairness and bias checks into the workflow

Review potential bias in client triage, resource allocation, risk scoring, performance assessment and document review. Include any historic decisions used in the workflow's data review, and check recommendations against the firm's fairness criteria.

The firm should review whether automated recommendations affect which clients receive attention, which matters are escalated, which staff are assigned and which outputs are treated as high quality. Where AI influences treatment or prioritisation, the firm needs periodic sample checks and a way to challenge the recommendation.

Sample decisions, compare patterns and document exceptions. Use the findings to decide whether the workflow needs changes or further review.

Assign ownership for every automated step

Name the owners for tool approval, data protection, output quality, incident handling and client communication.

For a small firm, that might be the managing partner, operations lead or compliance owner. For a larger firm, it may involve engagement managers, information security, risk, data protection and practice leaders. Record who can approve a client-facing output and where the reviewer should refer an unresolved issue.

Put practical AI governance around your client workflows

Keep an audit trail that would make sense six months later

Decide which records are needed to reconstruct the work: source material, tool used, prompt or workflow version, output, reviewer, changes made, approval status and final client-facing version. Set access and retention rules for those records.

For regulated advice, financial analysis, claims handling, legal work, assurance activity or sensitive client communications, have the relevant owner confirm the required records. Include the review and approval decisions for the final output.

Record incidents such as hallucinations found, confidentiality near misses, biased outputs, inappropriate tool use and client concerns under the firm's incident procedure. Review them when deciding which controls need updating.

Tell clients enough to preserve trust

Decide what the client needs to be told about AI-supported analysis, drafting, decision support or delivery. Have the responsible owner check the engagement terms and applicable professional requirements before settling the disclosure.

Where disclosure is required or agreed, explain the tasks the approved tools support and the professional staff's review responsibilities. Address data handling and third-party processing where relevant to the matter; confirm the wording with the engagement owner.

A practical implementation sequence

Pilot a limited work type and use the review findings to decide whether to expand, restrict or stop it.

1. Map the client-work process and identify where AI is proposed.
2. Classify the data sensitivity and professional risk at each step.
3. Define approved tools, prohibited data and retention settings.
4. Set review rules for low, medium and high-risk outputs.
5. Create an audit trail before the workflow goes live.
6. Run a pilot on a limited work type and sample the outputs.
7. Document incidents, exceptions and reviewer feedback.
8. Decide whether to expand, restrict or stop the workflow.

Turn AI workflow rules into an implementation plan

Conclusion

Before introducing a client-work workflow, agree the permitted tasks, data boundary, review responsibilities and exception route.

Keep those decisions in the approval record, together with the required audit trail and client disclosure. Revisit unresolved tasks before rollout and update the record when the workflow changes.

Need a safer AI route for your firm?

For the client-work task being considered, record the permitted use, data boundary, reviewer and exception route. Resolve professional, supplier and disclosure questions before approving the workflow.

• Map AI risk and opportunity
• Put usable AI governance in place
• Roll out AI with privacy and supplier controls
• See AI support for legal services