April 24, 2025

Client Consent Basics for AI-Assisted Work

Professional obligations around confidentiality did not change when AI tools arrived. What changed is that a new category of third party, the AI vendor, now potentially touches client information, and that triggers the same consent questions a firm would ask about any other third party.

The baseline obligation

Sharing client information with any third party, including a software vendor, generally requires either client consent or confidence that the arrangement falls within the ordinary course of engaging support services under existing confidentiality and engagement terms. Firms should not assume AI tools are automatically covered by old engagement language written before those tools existed.

What to actually tell a client

Plain language, in the engagement letter or a related communication: what tools are used, what categories of information they touch, and what protections are in place. Clients generally do not object to a firm using modern tools; they object to finding out after the fact that they were not told.

Where firms most often get this wrong

Adopting a tool firm-wide and only updating engagement language months later, or never, is the most common gap. The fix is straightforward: update standard engagement letter language once, at the point of adopting a new category of tool, rather than treating it as a one-off decision buried in an internal memo nobody outside the tech team reads.

A short script for the client conversation

Most clients respond well to a brief, direct explanation: 'We use AI-assisted tools for research and first drafts on engagements like yours, under an agreement that keeps your information out of any public model training, and every deliverable is reviewed by a named person before it reaches you.' This is a short paragraph, not a long disclosure, and it tends to build confidence rather than raise concern, because it demonstrates the firm has already thought through the question the client might otherwise have to ask.

Handling a client who wants more detail

A small number of clients, particularly in regulated industries, will ask follow-up questions beyond the short standard explanation, which specific tools, whose infrastructure, what certification. Having a slightly longer, more technical version of the disclosure ready for this smaller group, without needing to lead with it for every client, keeps the standard conversation short while still being fully prepared for the clients who need more detail.

Where this leaves a firm

None of this is complicated in principle, which is exactly why it gets skipped under deadline pressure. The question worth returning to before treating handling client data and AI risk with real discipline as settled is what a careful reader would actually notice if the firm got it right. On the point raised above under “the baseline obligation,” the answer is usually specific rather than clever: sharing client information with an ai vendor is a third-party disclosure question, like any other vendor. Firms that build this expectation into how they train new associates find it easier to sustain once experienced staff move on, because the standard lives in a documented habit rather than in one person's memory. The gap between a firm that talks about handling client data and AI risk with real discipline and a firm that actually practices it shows up over several quarters, not in any single engagement, and it tends to show up most clearly in the small, unglamorous checks that a client never sees directly but benefits from anyway.

It also helps to name, plainly, who is responsible for keeping this working once the novelty of a new tool wears off. Someone should own the point raised under “what to actually tell a client,” check it periodically rather than assume it stays true on its own, and be the person a colleague asks when a new situation does not fit the pattern described here. Put simply: update engagement letter language at the point of adoption, not months later as an afterthought. That kind of ownership, named and specific, is a small addition to a firm's process, and it is usually the difference between a good idea that is followed for a month and a standard that actually holds up over a year of real client work.

None of this needs to be elaborate to be effective. A short, dated note in a shared file, reviewed at the next quarterly check-in, is usually enough to keep the responsibility from quietly disappearing when the person who first cared about it moves on to something else.

VIPMarketing Editorial