Before AI output reaches a client, someone must own the review
The person accountable for the client work should review an AI-assisted output before it is sent. The checks and evidence should match the risk: source accuracy, client context, confidentiality and any professional judgement in the draft.
Name the reviewer before the draft moves to the client. The accountable professional may delegate checks within the firm's sign-off rules, but the reviewer needs the competence and authority to assess that particular output.
The safest reviewer is the person accountable for the client work
The reviewer should usually be the fee-earner, adviser, manager or delivery owner who would have been accountable if no AI tool had been used. They do not need to reperform every step from scratch, but they do need enough context and authority to say: this is accurate, appropriate and safe to send.
A good review covers five things:
- Accuracy: does the output match the file, source data, instructions and known facts?
- Confidentiality: has client, personal, privileged or commercially sensitive data been handled inside approved boundaries?
- Professional judgement: is the conclusion appropriate, or has the tool overreached?
- Tone and context: does it fit the client relationship, risk level and channel?
- Evidence: can the firm show who reviewed it, when, and what changed before sending?
Map where AI output reaches clients before it is reviewed
Do not let review become a vague instruction
A policy that says "human in the loop" still needs to identify the reviewer, required checks and escalation point for each task. Tell teams what record is needed for that level of risk rather than leave the phrase to individual interpretation.
Use risk tiers rather than one blanket rule. Low-risk internal formatting may only need a quick sanity check. Client-facing advice, regulated communications, financial analysis, legal drafting, claims handling, vendor recommendations or complaints should require a named reviewer with the right competence.
Use a routing table with task type, permitted tools, allowed data, reviewer role, required checks and escalation path. That lets staff find the review route for the work in front of them.
What the review should catch
A client-facing AI review should catch errors that generic quality assurance often misses:
- made-up citations, cases, figures, policy references or contract terms;
- client facts blended with assumptions from another matter;
- confidential information placed into an unapproved tool;
- draft wording that sounds authoritative but has not been checked;
- recommendations that cross from admin support into professional advice;
- unapproved commitments, guarantees, pricing statements or service promises;
- outputs that need specialist review by legal, risk, compliance, data protection or a partner.
If the reviewer cannot explain why the output is safe, it should not go to the client.
Build the review into the workflow, not into memory
Place the review at the point where the output moves into client work. For a material client update, that might mean a review status, named owner, source reference and retained approved version. Use the firm's normal quality process where it already provides those checks.
Choose the record fields needed to explain the decision: the tool, input boundary, reviewer, checks, material changes and approval may be relevant. A low-consequence task may need less detail than advice or a financial judgement. Set access and retention so review evidence does not create unnecessary copies of confidential material.
Set practical AI review rules for client-facing teams
What leaders should put in place
Leadership should make three decisions before AI-assisted work scales:
- Name the owner. Decide who is accountable for AI-assisted outputs in each service line or workflow.
- Define review thresholds. Separate low-risk internal work from client-facing, regulated, confidential or judgement-heavy work.
- Keep review evidence. Make the audit trail easy enough that people actually use it.
Check the thresholds against a real task before rolling them out. If the team cannot identify the reviewer or the escalation route, resolve that gap before the output is used.
Conclusion
Assign review to someone competent for the client task, under the accountable owner's sign-off rules. Match the checks and retained evidence to the consequence of an error. Where a source, assumption or commitment cannot be justified, pause the output and escalate it.
Turn AI review rules into a usable workflow
Need a safer AI route for your firm?
If an AI draft can reach a client without a clear review step, map that handover first. Name the competent reviewer, the checks required and what happens when the draft cannot be justified.
