Why AI disclosure needs a clear client policy
Disclosure depends on the engagement, client instructions, tool data flow and how material the AI contribution is. Use a documented tiering rule and confirm when notification or consent is actually required.
Tell clients how AI contributes where the engagement calls for it, and describe the safeguards and human responsibility that actually apply. Resolve notice and consent questions before the affected work starts.
The safest default is proactive disclosure for material AI use
Use proactive communication as a policy choice for material AI contributions, while checking the duties and terms of each engagement. Review document summarisation, sensitive-data analysis, client-facing drafts and decisions affecting clients.
For incidental internal tools, check whether the use affects confidential data, advice or the final output before choosing a lighter communication route. Do not assume that an internal task is exempt from the client's terms.
Map where AI touches client work
A practical three-tier disclosure model
The following tiers can organise a firm's policy. They do not establish when disclosure or consent is legally required.
- Tier 1: review incidental internal use. Consider grammar checks, meeting administration and formatting. Check the data submitted, effect on advice and engagement terms before deciding whether notice is needed.
- Tier 2: consider policy-level disclosure. For approved research, summarisation or internal drafting, review whether engagement terms or a client AI policy describe the use adequately, alongside human review.
- Tier 3: review matter-specific notice or consent. Examine sensitive data, regulated advice, substantive deliverables and third-party retention questions against the duties and terms of the engagement.
Record the tier selected and why it fits the task. Revisit the decision if the data flow or role of AI changes.
What clients should be told
Prepare answers to these questions:
- What type of AI tool is being used?
- What work is the tool supporting?
- Will client confidential data or personal data be processed?
- What human review, QA and accountability sit around the output?
- Can the client opt out, request more detail or require a different handling route?
The wording should be plain English. For example: "We may use approved AI tools to support document review and drafting. We do not rely on AI output without professional review, and we apply confidentiality, access control and data-retention checks before use on client material."
Governance controls that make disclosure credible
Use the example wording only if the workflow supports it. Keep evidence of the approved tool, data restrictions, review and exception process before making those statements to a client.
Review the tool list, prohibited uses, supplier terms, matter risks and output-review standards. Record who can approve an exception and who checks whether notice or consent is required.
Create an AI governance operating model
How to implement this without slowing every matter
Record the tool, purpose, data type, owner, supplier terms, retention and proposed disclosure tier in an AI use register. Use that record during matter opening, project scoping or client onboarding.
Use agreed wording for client communications and review exceptions. Include high-risk uses, opt-outs, incidents, supplier exceptions and unresolved policy questions in leadership reporting where relevant.
Conclusion
Set a disclosure policy that distinguishes incidental tasks from material client work. Check notice and consent against each engagement, and support the explanation with records of the data handling and human review.
Put AI disclosure controls into practice
Need a safer AI route for your firm?
If this article reflects a live decision in your practice, the useful next step is to map the workflows, confidentiality risks, supplier controls and governance gaps before tools spread informally.
