Key takeaways
- Disclosure and consent are different decisions. Most firms need the first and should be careful about promising the second.
- Never state that no AI touches a client's work. It is not true and you cannot enforce it.
- Write the answer once, before you are asked. The improvised version in a meeting is always worse.
- Clients are increasingly asking. A firm with a prepared, specific answer looks better than one that is surprised.
A partner takes a call from a client's general counsel who has just been asked by their board whether the firm's advisers use AI. The partner has thirty seconds, no prepared position, and a strong instinct to reassure. What comes out is some version of "not on your work", which is meant kindly, is almost certainly false, and has just become a representation the firm cannot support.
That call is coming to most professional services firms. The purpose of having a written position is that it removes the improvisation.
Disclosure is not consent
Firms conflate two separate questions and the conflation causes most of the difficulty.
Disclosure is telling clients how your firm works. It is a statement, it can be standing rather than per matter, and it sits comfortably in engagement terms alongside your descriptions of subcontracting, cloud storage and confidentiality practices.
Consent is asking permission. It creates an ability to say no, it usually has to be sought per client and sometimes per matter, and it turns a routine operational choice into a negotiation. Some clients and some professional rules do require it in specific circumstances, but seeking consent by default when only disclosure is needed makes the firm's own tooling contingent on the least comfortable client in your book.
For most firms the correct default is clear disclosure, with consent reserved for situations where a rule, a client agreement or an unusual data arrangement genuinely requires it.
The framing that lands well with clients: we use these tools to work more efficiently, no client information is used to train anyone's models, everything is reviewed by the professional responsible for your matter, and the judgement you are paying for remains human. That statement is true, complete and reassuring, and it does not require anyone's permission.
The promise never to make
Do not state that AI is not used in a client's work.
It is not true today in any firm. AI is embedded in the spam filtering on your email, the search in your document management system, the transcription in your video calls, the fraud detection in your payment processing, and the endpoint security on your laptops. A blanket denial is false on the day it is written.
It is also unenforceable. You cannot police what every professional does at eleven at night on a deadline, and a firm-wide absolute promise converts an individual's shortcut into a firm-level misrepresentation.
The alternative is to describe control rather than absence. What you use, what protections apply, what remains human, and how you would know if the rules were broken. That is a stronger position with a client precisely because it is credible.
The four places the question arrives
| Where | What to have ready | Common mistake |
|---|---|---|
| Engagement letter or standing terms | A short standing clause covering technology including AI | Silence, so every client asks separately |
| Client security questionnaire or outside counsel guidelines | A prepared five sentence answer plus settings evidence | Each partner drafting their own version |
| A direct question mid-engagement | The same five sentences, verbally | Improvising a reassurance you cannot support |
| A pitch or panel review | A positive description of how it improves the work | Treating it defensively when the client sees it as a strength |
Notice that only the first row is a drafting exercise. The other three are the same content delivered differently, which is why writing it once is worth the afternoon.
What a good standing clause covers
Have your own counsel draft the wording, but the substance most firms land on covers five things:
- That the firm uses technology including AI tools in delivering services, described as a normal part of practice rather than as a confession.
- That client confidential information is protected, specifically that it is not used to train third party models and is held under the firm's confidentiality obligations.
- That professional judgement and review remain human, with a named responsible professional for the engagement.
- That the firm remains fully responsible for the work regardless of the tools used, which is what the client actually cares about.
- A route to raise concerns, so a client with a specific restriction can tell you rather than assume.
What it should avoid is a list of named products, which dates immediately and forces a variation every time you change vendor, and any absolute prohibition on categories of use that your own people will not be able to follow.
Check the other direction too. Some clients now require disclosure of AI use in their supplier codes or outside adviser guidelines, and a firm that has said nothing may already be in breach of an obligation it agreed to. Read the guidelines of your five largest clients before drafting your own position. It occasionally changes the answer.
Answering the security questionnaire well
The questionnaire version deserves specific preparation because it arrives at inconvenient moments and is usually completed by whoever is available.
The five points that answer most of them:
- The specific tool and tier the firm uses, on a business or enterprise agreement.
- That client data is contractually excluded from model training, with the setting evidenced.
- Retention period and who can access it, with access managed by administrators and tied to employment.
- That all output is reviewed by the responsible professional before it reaches the client.
- That no automated system makes decisions about the client's matter.
Keep that paragraph, the settings screenshots and the date of last review in one place, owned by one person. Firms that do this answer a questionnaire in ten minutes. Firms that do not spend a week assembling it and give a different answer each time, which is itself a finding.
The competitive angle nobody mentions
Most of this article treats disclosure as a risk to manage, which is how firms tend to experience it. It is worth noting the other reading.
Clients are buying professional services from firms that will still be efficient in five years. A firm that can describe, specifically, how it uses these tools, what it protects, what it refuses to automate and why, is demonstrating something clients value: that it has thought about this rather than either ignoring it or being swept along by it.
The firms that struggle in panel reviews are not the ones using AI. They are the ones who cannot say clearly what they do.
Frequently asked questions
Do we have to tell clients?
Rarely as an absolute obligation, increasingly as an expectation, and often as a specific requirement in a client's own supplier or outside adviser guidelines. Most firms conclude that a standing statement in the engagement terms is easier and stronger than answering the question differently every time it comes up.
Should we ask for consent instead?
Usually not by default. Consent creates a right to refuse and makes your operating model contingent on your least comfortable client. Reserve it for cases where a professional rule, a client agreement or an unusual data arrangement genuinely requires it, and use clear disclosure everywhere else.
What should we never say?
That AI is not used in the client's work. It is false the day it is written, because AI is already embedded in your email filtering, document search, transcription and security tooling, and it is a promise you cannot enforce across every professional on a deadline. Describe your controls instead.
How do we handle a client security questionnaire?
Prepare five sentences once: the tool and tier, contractual exclusion from model training, retention and access control, human review of all output, and no automated decisions about their matter. Keep it with your settings evidence and a review date, owned by one person, and the questionnaire takes ten minutes.
Have the answer ready before the client asks
We configure the setup so the answers are true, evidence the settings, cap the spend, and hand you the written position and questionnaire response your firm needs, alongside task guidance for your people. Fixed price, live in 30 days or less.