Why AI disclosure is now a conduct question
Decide whether to tell a client about AI use by looking at the work, the client's instructions, confidentiality and any applicable professional or data-protection duties. A general notice may suit routine internal support; consequential use may need a matter-specific conversation.
Review the relevant RICS, SRA, ICAEW or ICO requirements for the work and jurisdiction concerned. Keep the disclosure decision alongside the assessment of confidentiality, review responsibility and the evidence needed to explain the output.
The safest answer is selective, documented disclosure
Set a route for deciding whether AI use needs disclosure, agreement or an internal record. Assess that question before work proceeds where the use involves client data, influences advice, changes review arrangements or introduces third-party processing.
A policy can distinguish internal administration, matter support and higher-risk uses. For document summaries or first-pass analysis, define the review and matter record. For use involving professional judgement or sensitive personal data, ask the relevant compliance lead to assess disclosure, approval and data-protection requirements before proceeding. These categories are a starting point for the firm's assessment.
Check where AI disclosure and audit trail risk sits in your firm
How the regulatory threads fit together
For legal work, assess supervision and confidentiality alongside competence and the client's interests. Identify who checks any AI contribution to advice and how that check is recorded. The applicable SRA requirements need to be confirmed for the proposed use.
For valuation, survey, assurance or client reporting work, keep a record of the source data, assumptions and limitations, with the review behind the final output. Check the relevant RICS standards, including any disclosure or conflict requirements, for that service.
For accountancy and audit work, examine review, independence and the evidence retained, then confirm the applicable ICAEW requirements. Where personal data is involved, assess lawful basis and transparency with the relevant data-protection lead. Include minimisation, supplier checks and security in that assessment, and trace what data leaves the firm and where it is stored. Any applicable ICO requirements need to be checked for the use and jurisdiction.
A client disclosure policy that works in practice
Record where the firm permits AI use and where it does not, with a named approval owner. Give teams matter-level questions such as:
- Will any client, employee or third-party personal data enter the tool?
- Will the AI output influence advice, valuation, audit work, claims handling or a client recommendation?
- Is the tool approved, contracted and checked for retention, training and security terms?
- Does the client engagement letter, privacy notice or matter plan already cover this use?
- Who reviews the output, and what record will show what they checked?
Keep the answers with the disclosure decision so partners, managers and compliance leads can review the basis for it. Similar questions may be useful across services, but the applicable duties and client instructions still need checking for each use.
Build a practical AI governance operating model
What to say to clients
Explain the proposed tool and purpose in plain language. Describe the data controls and review arrangements that actually apply, who is accountable and how the client can raise questions or give instructions about use. Avoid claiming that AI is always safe or supervised.
Record relevant client instructions and any disclosure or agreement with the matter file, particularly where the use involves sensitive information or advice. If the assessment concludes that disclosure is unnecessary, keep the reasons and who reviewed them. That record supports later review; it does not by itself establish compliance or client consent.
Implementation checklist
- Map the approved AI tools and the data each one may process.
- Define assessment triggers for client data, professional judgement and third-party processing.
- Update engagement letters, privacy notices or service descriptions where needed.
- Create a matter-level AI use record for higher-risk work.
- Train reviewers to check outputs for accuracy, bias, missing context and unsupported assumptions.
- Review insurance, supplier contracts and processor terms before scaling use.
Turn AI disclosure rules into working controls
Conclusion
Link the disclosure decision to the proposed AI use, client instructions and the applicable duties. Keep the assessment and the review record together, and revisit them when the use changes. The decision needs to reflect the particular matter rather than a generic assurance about AI.
Need a safer AI route for your firm?
If this article reflects a live decision in your practice, the useful next step is to map the workflows, confidentiality risks, supplier controls and governance gaps before tools spread informally.
