AI Readiness Checklist for Accountants, Solicitors, Consultants

Your firm is ready to pilot AI if you can tick at least 16 of the 20 checks below, including all five on client confidentiality. That means a business AI plan that doesn't train on client data, a written policy, engagement terms covering AI, a named reviewer for AI output and one documented process to start with.

A score of 10 to 15 is the most common result, and it is a to-do list rather than a verdict: usually the gaps are client terms and a policy, which take weeks to fix, not months. Below 10, spend the first month on governance and accounts before anyone uses AI on client work. Accountants, solicitors and consultants weigh some items differently, which the scoring section covers.

Follow me on Instagram@sagnikteaches

Client confidentiality and engagement terms

These five carry the most weight. A firm that fails any of them should fix it before piloting, whatever the total score.

Connect on LinkedInSagnik Bhattacharya

1. Your engagement terms say how you use AI. Why: clients increasingly ask, and some expect to be told. Verify: open your current engagement letter template and find the clause. If there isn't one, the item is a no. Mentioning AI use in client contracts has wording.
2. You have read your largest clients' own terms. Why: corporate clients' supplier terms and NDAs sometimes forbid sending their information to third-party processors, which can include AI vendors. Verify: list your ten largest clients and note, for each, whether their terms restrict AI or sub-processors.
3. You know which clients have opted out. Why: one client saying "not on our work" must reach every person who touches that file. Verify: the opt-out is recorded on the client record in your practice system, not in someone's inbox. Record which engagement it covers, too. A director who opts out on their personal return hasn't necessarily opted out their company, and a company's finance manager can't opt out the directors' own files. When it's unclear, ask the client which work the request covers and note the answer.
4. Your firm's professional duties have been checked against AI use. Why: solicitors' confidentiality and privilege, accountants' confidentiality rules and consultants' NDAs all apply to what goes into an AI tool. Verify: a partner has read your regulator's or professional body's current AI guidance and written a one-paragraph note on what it means for the firm.
5. Your professional indemnity insurer has been asked. Why: some insurers ask about AI use at renewal, and you don't want to find out about an exclusion after a claim. Verify: an email to your broker asking whether AI-assisted work changes your cover, and the reply on file.

Item 2 is where firms are most often surprised. A quick way to do it is to paste the relevant sections of each client's terms into a business AI plan with a fixed prompt:

Subscribe on YouTube@codingliquids

Below are the confidentiality, data and subcontracting clauses from
a client's terms of engagement with us. Tell me, quoting the exact
words: (1) whether we may send their information to third-party
software providers or sub-processors, and on what conditions;
(2) whether AI, automated processing or machine learning is
mentioned; (3) any requirement to notify or get consent first.
If the clauses don't address a point, say "not addressed". Don't
interpret beyond the text.

[paste clauses]

Illustrative output: "(1) Clause 9.3: 'The Supplier shall not subcontract or disclose Confidential Information to any third party without the Client's prior written consent.' No exception for software providers. (2) Not addressed. (3) Prior written consent required under 9.3."

That result means AI use on this client's files needs its written consent, even though AI is never mentioned. The model quoted the clause correctly here, but always check the quote against the original document before relying on it; and if a clause is genuinely ambiguous, that's a question for your own solicitor, not the assistant.

Data, accounts and systems

6. Client files live somewhere with permissions. Why: AI tools that search your files inherit whatever access staff already have, including access they shouldn't. Verify: pick three client folders and check who can open them.
7. Staff use a business AI plan, not personal accounts. Why: business plans such as ChatGPT Business, Claude Team and Microsoft 365 Copilot don't train on your content by default; consumer plans can unless the user opts out. Verify: ask every person, anonymously if needed, what they actually use.
8. Multi-factor sign-in is on for every account that can reach client data. Why: an AI tool connected to your mailbox is only as secure as the password in front of it. Verify: check your Microsoft 365 or Google admin console.
9. Staff know how to strip identifying details when a task doesn't need them. Why: most drafting tasks work just as well with "Client A" as with a real name. Verify: ask two staff to show you how they'd prepare a document. Anonymising client data before you paste it into AI explains the method.

For item 9, a before-and-after makes the standard clear. A request as a junior might first type it:

"Draft a reply to [client's full name], director of [company name], [street address]. Their director's loan account is overdrawn by $12,437.18 at 31 March and they want to know if they can clear it by the end of next year instead."

And the same request prepared properly:

"Draft a reply to a client, the director of a small manufacturing company. Their director's loan account is overdrawn by roughly $12,000 at the year end and they want to know if they can repay it over the next year. Explain in plain words the points we need to discuss with them, and leave [placeholders] for anything that depends on their figures."

The draft is just as useful, the name and address never leave the firm, and the exact figure goes back in when the reviewer finalises the letter. Staff who can do this without being asked pass item 9; staff who need the policy open in front of them need another session.

People and supervision

10. One named person leads AI, with time set aside. Why: without an owner, rules decay within a quarter. Verify: a name and about two hours a week in their diary.
11. Every AI-assisted piece of client work has a qualified reviewer. Why: professional responsibility for advice doesn't move to the software. Verify: your policy names the reviewer role, and your file notes record who reviewed.
12. Reviewers know what AI gets wrong in your field. Why: solicitors need to catch invented case citations; accountants, figures that don't reconcile; consultants, confident claims with no source. Verify: each reviewer has checked at least five AI drafts and can describe the errors they found. A practice exercise for accountants: give reviewers an AI summary that says "turnover rose 12% to $1.34m and gross margin held at 38%, giving gross profit of $470,000". A good reviewer does the sum in their head (38% of $1.34m is about $509,000), spots that the figures don't reconcile, and goes back to the accounts rather than to the summary.
13. Staff have had basic AI training. Why: people use tools better, and more safely, once they understand how they fail. If you have clients in the EU, the EU AI Act also expects firms that deploy AI to take measures supporting staff AI literacy. Verify: a training record, even a simple one.

A first process worth trying

14. One repeatable process is written down step by step. Why: AI helps with processes, not with vague intentions. Verify: a one-page procedure someone new could follow.
15. You know how long it takes now. Why: without a baseline you can't tell if AI helped. Verify: time logged on the task for at least two weeks.
16. The first use is low-risk. Why: start with internal drafting, meeting notes or client chasers, not with advice. Verify: the output of the first process is always reviewed before any client sees it.
17. You've decided what success looks like. Why: "it seems quicker" isn't a result. Verify: a written target, such as "cut first-draft time on engagement summaries from 40 to 20 minutes with no increase in partner corrections".

Items 15 and 17 fit on one line of a sheet once the timings exist. From an illustrative consultancy's two-week log of proposal first drafts: eight drafts timed at 95, 110, 80, 130, 100, 90, 120 and 115 minutes, an average of about 105, with the partner sending back three of the eight for substantial rework. The written target became "first drafts under 60 minutes on average, with no more than three in eight sent back". Now both halves can be checked at the end of the pilot: speed, and whether the partner's red pen got busier.

Governance paperwork

18. A written AI policy exists and staff have read it. Verify: the document, and a sign-off or meeting note. An AI acceptable use policy for a professional firm gives a starting draft.
19. There is a register of approved AI tools. Why: you need to know what is in use to answer client and insurer questions. Verify: a list with tool, plan, who approved it and what data is allowed in it.
20. Staff know what to do when something goes wrong. Why: the damage from a misdirected upload or a wrong figure grows with every hour it goes unreported. Verify: a named person and a same-day reporting rule in the policy.

Items 1 and 19 are the two firms most often leave blank because they don't know what "done" looks like. Here is a plain engagement-letter clause of the kind many firms use, as a starting point for your own adviser to adapt (illustrative wording, not legal advice):

"We may use business-grade software tools, including artificial intelligence tools, to help prepare drafts, summaries and correspondence. These tools are provided under terms that do not permit your information to be used to train them. All work is reviewed by a qualified member of our team before it is sent to you, and responsibility for our advice remains ours. If you would prefer us not to use AI tools on your work, please tell us and we will record this on your file."

And a register with its first three rows filled in (illustrative):

The "Pending" row is the useful one. Writing down that a tool isn't approved yet stops people assuming it is.

Item 20 is easiest to judge by imagining the call. An illustrative case: at 3pm a junior realises they pasted a client's full bank statement into a personal chatbot account that morning, to have the transactions sorted. Under a same-day rule, they tell the named person by 3.15pm. The chat is deleted, the account's retention and model-training settings are checked and noted, and a partner records what went in and when. Whether the client needs to be told is then a question for the firm's data-protection adviser, decided that week rather than discovered at the next audit. A firm that passes item 20 can describe who does each of those steps. A firm where the junior would keep quiet for fear of blame has not passed it, whatever the policy says.

Scoring your firm, and how the sectors differ

The same checklist leans differently by profession:

For deeper sector detail, see whether it is safe for an accountant to use ChatGPT with client data and whether solicitors can use ChatGPT without breaching confidentiality.

Three firms scored

A six-person accountancy practice: 13 out of 20. It had a Microsoft 365 business plan with MFA, files in SharePoint with sensible permissions, and a documented process for year-end client chasers with a timed baseline. It failed items 1, 5, 18, 19 and 20, plus 11 and 13: no AI clause in the engagement letter, no word to its insurer, no policy, register or reporting route, and no named reviewer rule. None of these needed technology. The practice manager drafted the policy and the letter clause in two weeks, a partner emailed the broker, and the practice started its chaser pilot in week five.

A four-solicitor practice: 8 out of 20. Two trainees had been drafting letters in a free chatbot at home, one with a client's name and matter details. Nobody had read the professional body's guidance, and no clients had been told. The partners' first move was the right one: stop personal-account use on client work that day, move everyone to a business plan with training off by default, then work through confidentiality and terms before any pilot. Their mistake to learn from was assuming that "nobody uses AI here" was true because nobody had mentioned it.

A seven-person engineering consultancy: 17 out of 20. Strong on systems and supervision, with a written procedure for turning inspection notes into short reports. It missed item 2: two public-sector clients' contracts required written consent before any subcontracting of data processing. It asked both, one agreed with conditions and one declined, and the consultancy flagged that client's projects as AI-free in its project system. Only then did it start the pilot.

If your own score lands somewhere in the middle, the general 20-minute AI readiness checklist is a useful cross-check for the non-professional parts of the business, such as sales and operations.

Questions partners ask after scoring their firm

How long does it take to fix a low score?

Most gaps are paperwork and habits, not technology. A firm scoring around 10 can usually close the terms, policy and account gaps in four to six weeks with a partner spending two or three hours a week. Documenting a first process and taking a baseline adds a week or two. The slow item is usually client contracts, because you need to read them.

Do we need an outside assessment?

Not to use this checklist. Scoring it honestly as a partner group takes about an hour. An outside assessment helps when partners disagree about the answers, when you hold unusually sensitive client data, or when you want someone to test whether staff actually follow the rules you think are in place.

Should we wait until our professional body publishes firmer rules?

Waiting rarely helps, because staff are often using AI already on personal accounts. Read the guidance that exists, apply it to a small, low-risk pilot under partner review, and update your policy when the guidance changes. Controlled use is safer than unmanaged use.

Further reads

• Signs Your Business Isn't Ready for AI Yet and What to Fix First — What to fix first when the score comes back low.
• What Is an AI Readiness Assessment and What Does It Involve? — What an outside readiness assessment adds to this checklist.
• AI for Small Law Firms: What to Automate First — First processes worth piloting in a small law firm.
• Why AI Adoption Stalls in Accounting Firms, and How to Restart It — Why accountancy practices stall after a good start.
• How to Stop AI Inventing Case Law: A Small-Firm Checking Routine — The checking routine behind item 12 for solicitors.
• Does Your Business Insurance Cover AI Mistakes? — More on the insurance question in item 5.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: OpenAI and Anthropic business plan data-use statements; EU AI Act Article 4 as amended by the Digital Omnibus on AI; vendor documentation cited in the body. Checked September 2026. Firm scores in the examples are illustrative.