Tell clients which kinds of work AI touches, that a named accountant reviews and answers for every output, and how their data is handled. Put the commitment in the engagement letter as a short clause, with a fuller client notice and a tool register kept outside the letter. Check your professional body's current guidance before finalising the wording.
Disclosure is easier than most partners fear, because it follows what the practice actually does. You cannot write an honest notice until you know the uses: who pastes what into which tool, on which plan. Start with an inventory, then build the notice, the clause and the data-handling record from it, in that order, so that nothing you send a client is ahead of what the team actually does. A small practice can work through the seven steps in a handful of sittings.
Step one: find out what the team already does
Most practices discover that AI use started before any policy. Someone drafts client emails in a free chat tool, another uses a note-taker on calls, a third pastes a trial balance into a spreadsheet assistant. The disclosure you write has to cover reality, so start with a ten-minute, no-blame survey.
Ask each person four questions: which AI tools they use for work, what they put into them (text only, documents, spreadsheets, client names), whether the account is personal or the firm's, and what they do with the output before it reaches a client. A tick-box sheet works; a conversation works better. The approach in surveying staff before an AI rollout has question wording you can borrow.
An illustrative inventory for a six-person practice
| Use | Tool type | Account | Client data in? | Disclosure needed |
|---|---|---|---|---|
| Drafting routine client emails | Chat assistant | Firm business plan | Names only | Notice |
| Summarising call recordings | AI note-taker | Mixed (two staff use personal accounts) | Full conversation | Consent, and move to firm account |
| Explaining variances in a management pack | Chat assistant | Firm business plan | Figures, anonymised | Notice |
| Reading supplier invoices | Extraction feature in bookkeeping software | Firm subscription | Full invoices | Notice plus data-handling line |
| Spelling and grammar in letters | Writing assistant | Personal | Possibly full text | Stop, or move to firm account |
The two uncomfortable rows are the point. A note-taker on personal accounts and a free writing tool receiving client letters are not things you can describe honestly in a notice, so you fix them first. Treat the inventory as the evidence behind every sentence you publish.
The Complete Excel Course with AI Integration
From formulas and pivot tables to Power Query, DAX, VBA and AI with Copilot, ChatGPT and Claude — hands-on from the first lesson.
By Sagnik Bhattacharya and Virginia Thorn, Primetime Emmy Award winner
Buy nowStep two: sort each use into notice, consent or stop
Not every use needs the same response. A simple three-way sort keeps the client conversation proportionate.
- Notice only: internal drafting and analysis where client data is minimal or removed, on a business-tier account that does not train on your content by default. The vendors of the main chat assistants say as much for their business plans; read the page for the exact plan you hold.
- Consent: anything that records or processes a client's own words or full documents, such as call recording and transcription, or that sends full client files to a third-party service. Ask first, in writing, and record the answer.
- Stop or replace: use on personal or free accounts with client data, tools you have not assessed, and anything the client has opted out of.
Where the line falls depends on your professional body's rules, your confidentiality terms and the data-protection law that applies. If you are unsure, take the safer category and ask a qualified adviser. The tutorial on AI note-takers in client meetings explains the recording question in a similar professional setting.
Step three: the client notice
The notice is the plain-language page or email that tells a client what you do. It should be short enough to be read: about 150 to 250 words, no jargon, and specific. Avoid vague claims about advanced technology. Say what, where and who checks.
A filled-in notice (illustrative)
How we use AI in your work.
We use AI tools for some preparation tasks: drafting routine correspondence, summarising documents and meeting notes, and explaining variances in management accounts. We do not use AI to make a final judgement on your tax position, your accounts or your advice. A named accountant reviews every piece of AI-assisted work and remains responsible for it.
Your information is handled only in business accounts that our supplier states do not train their models on our customers' content by default. We do not put your files into free consumer tools. We keep a list of the tools we use and update it every quarter; ask us for the current copy.
If you would rather we did not use AI on your work, or on a particular task, tell us and we will note it on your file. This may affect timing or fees, and we will say so before we proceed.
Test the notice against the inventory: every sentence must be true of every member of staff. If one person uses a personal account, the notice is false. Also avoid absolutes you cannot guarantee. "We never" is a promise; "we do not" with a policy behind it and a register is safer.
Step four: the engagement letter clause
The letter is the contract, so the clause should be shorter and firmer than the notice, and it should point to the fuller documents. Three ideas belong in it: AI may be used in preparing work, responsibility stays with the firm and its named staff, and client information is protected by the same confidentiality terms as everything else.
Illustrative clause wording
Use of technology. In providing our services we may use artificial intelligence tools to assist with drafting, summarising and analysis. All such work is reviewed by a member of our team before it is relied on, and responsibility for the work remains with us. We apply the same confidentiality obligations to information processed by these tools as to any other client information, and we use only business-tier services under terms that we have reviewed. Our current list of tools and a short notice describing their use are available on request. Please tell us in writing if you do not wish AI tools to be used on your work.
Keep the clause generic and the register specific. If the clause names a tool, you owe an amendment every time you change a supplier. A register that you update quarterly does the same job with no paperwork. For the rest of the letter, the tutorial on AI engagement letters for accountants covers scope and drafting, and mentioning AI use in client contracts and proposals gives a wider set of examples.
Have your professional indemnity insurer or a qualified adviser read the clause. If your insurer asks what controls surround AI use, a signed register plus a review rule is a good answer. Do not copy wording from another practice without checking it against your own body's rules; yours may expect particular phrases about confidentiality or about the use of third-party service providers.
Step five: the data-handling checklist
This is the evidence behind the promise. Work through it once per tool, and record the answer in the register.
- Which plan? Individual, team or enterprise. Training on content, retention periods and admin controls differ by plan. Consumer plans generally let a user switch off training in settings; business plans are described as not training on your content by default. Read the vendor's page, not a summary of it.
- Where does the data go? Does the vendor use sub-processors, and does your data stay in a region your clients expect? If you have clients in the EU, check the vendor's data-processing terms.
- How long is it kept? Find the retention period for chats and uploaded files, and whether deleted items are really deleted. On Claude's consumer plans, for example, Anthropic's privacy centre says chats used for model improvement may be kept in de-identified form for up to five years, while for users who have not opted in it gives no fixed period, only that data is kept as long as reasonably necessary (deleted chats leave its back-end systems within 30 days). Claude's Team plan, by contrast, does not train on your content by default. That gap is exactly why the plan matters.
- Who can see it? Admin access, shared projects and shared links. A shared chat or project that reaches the wrong colleague is a confidentiality problem inside your own walls.
- What is excluded? Decide categories that never go in, such as identity documents, bank credentials, health data, or the details of clients who opted out. Write them down.
- Minimise the input. Replace names with labels ("Client A"), strip account numbers, and paste only the cells needed. A variance explanation does not need the client's name.
- Log and sign. Keep a dated note of the tool, plan and the checks you made, and re-check every quarter.
One register entry, filled in (illustrative)
| Field | Entry |
|---|---|
| Tool and plan | Business-tier chat assistant, firm workspace, annual billing, four seats |
| Approved uses | Drafting routine correspondence; summarising documents the client supplied; first-draft variance commentary |
| Client data allowed | Figures and document text with names replaced by labels; never identity documents, bank credentials or opted-out clients |
| Training | Vendor's pricing page states no training on business content by default; screenshot saved with the check date |
| Retention | Vendor's stated deletion schedule noted; working chats deleted at job close by the preparer |
| Sharing | Client projects shared only with the client team; no public links |
| Owner and next check | Managing partner; next review in three months |
Seven lines per tool is enough. When a client asks whether their data trains a model, the answer is already written, dated and owned by a named partner, and when a supplier changes its terms you edit one row rather than every engagement letter.
For the questions to ask a supplier before you sign up, see questions to ask before buying AI that touches client data.
Step six: what the reviewer does and what the client sees
The statement "a named accountant reviews every output" is only credible if the review is real. Define it so it can be checked.
For drafted correspondence, the reviewer reads every line and confirms every figure against the file. For summaries, the reviewer checks key facts against the source document. For explanations of variances, the reviewer recomputes the headline numbers. Record who reviewed, and when, in the job notes. Nothing leaves the practice with the label "AI-assisted" and no reviewer.
An illustrative failure and how the check caught it
Say a tool summarises a lease for a client's year-end accruals and states a rent review date a year late because it read a clause in a schedule instead of the main body. The reviewer, following the rule to confirm key dates against the source, opens the lease, finds the correct clause, and corrects the accrual before anything is posted. The practice's notice promised review; the review earned it. Without the rule, the figure would have been wrong in the client's accounts.
Step seven: handling the awkward conversations
Three conversations come up. Prepare a short answer for each and share them with the team so the practice speaks with one voice.
"Are you charging me less because it is faster?" Be ready to explain your fee basis. Many practices price on value and responsibility, not time, and say so; others pass on part of the saving. Decide before the client asks, and see the tutorial on charging when AI speeds up work for the options.
"Did AI write my advice?" The honest answer is that a tool may have helped draft, the accountant read and adjusted it, and the accountant signed it and answers for it. Do not claim that nothing was drafted by AI if that is not true.
"Has my data been used to train a model?" Answer from the register: which plan, what the vendor states, and when you last checked. If you do not know, say you will confirm in writing and then do so within a week.
Worked example: a six-person practice writes its disclosure in a week
Say a practice with four accountants and two administrators wants its disclosure in place before the next engagement letter round, covering 120 clients. Day one: the survey and inventory, as in the table above, taking about 90 minutes of staff time in total. Day two: the managing partner sorts the uses into notice, consent and stop, and moves the two note-taker users onto the firm account. Day three: draft the notice from the template and the clause, and send both to the professional indemnity insurer and the practice's adviser. Day four: apply the data-handling checklist to the three tools in the register, spending about 45 minutes per tool on vendor pages. Day five: update the letter template, add an "AI opt-out" field to the client record, and brief the team for 20 minutes.
The cost is mostly time: roughly 12 to 15 hours of partner and staff effort across the week in this illustration, plus any business-plan upgrade. ChatGPT Business and Claude's Team plan both list a standard seat at $25 a user a month billed monthly or $20 billed annually, from two seats. For 120 clients, issuing the new clause with the usual letter round adds no extra mailing cost. The saving is harder to count but real: no scramble when the first client asks, and no letter that says one thing while the team does another.
Keeping the disclosure true after launch
Put four recurring jobs in the practice calendar. Quarterly: re-read the vendor terms and privacy pages for each tool in the register, and update the dates. Quarterly: check your professional body's guidance for changes. On every new tool: no use until it is on the register with its checks done. On every leaver and joiner: remove leavers from the business workspace on their last day, and walk each joiner through the register before they open a tool.
A short internal rule helps: "No client information goes into a tool that is not on the register." It gives staff something simple to follow and gives the practice something to point to. A wider policy should also say how a new tool gets approved, which accounts staff may use and what happens after a slip, such as a client file pasted into a personal account: who is told, what is deleted and whether the client hears about it.
If you would like help listing the uses and writing the register with someone who has done it before, that is what my AI implementation consultation covers, and you can reach it through the contact page. The core of the answer does not change: tell clients what you do, who answers for it, and how their information is protected, and make sure each statement is true on the day you send it.
What clients tend to ask next, and how to answer
After the notice goes out, expect a small number of follow-ups, and a smaller number of clients who will want more detail than you offered. A good practice is to prepare one page, held internally, that answers the technical questions without being sent to everyone: the register of tools with their plans, the date each vendor's terms were last checked, the categories of data that never go into a tool, and the name of the partner responsible. When a larger client or a client with its own procurement rules asks for assurance, you can send that page rather than writing a bespoke reply each time.
Some clients will want to see a version in their own contract language, and a few will want to change your clause. Decide in advance how far you will go. A sensible line is to accept stricter handling for their data (no AI on named categories of work, deletion of working copies at a set date, notification if a tool changes materially) and to decline anything that would make the practice responsible for the vendor's systems. Record every agreed variation against the client record so that a new member of staff opening the file sees the restriction before they open a tool.
Finally, remember that a disclosure is a snapshot. A tool that was a drafting aid in January may have a recording feature, an agent mode or a connection to your document store by June. Add one question to every software renewal: has this product added any AI feature since we last checked, and does it touch client data? That single question catches the quiet changes that most often make a notice out of date.
Questions practices ask about AI disclosure
Do we need client consent to use AI on their data?
It depends on your professional body's rules, your confidentiality terms and the data-protection law that applies to the client. Many practices treat notice as the minimum and consent as the safer route for anything beyond internal tools. Check your body's current guidance and ask your insurer or a qualified adviser.
Should the engagement letter name specific AI tools?
Name the category and the controls, and keep a separate, dated register of tools that you can update without reissuing every letter. Naming one product in the letter forces an amendment each time you switch supplier, which most practices will not keep up with.
What if a client asks us not to use AI at all?
Record it in the client file and honour it for their data. Agree what that covers, such as drafting, summarising or transcription, and tell the client if it changes the timetable or the fee. A clear opt-out flag in the practice system makes it workable.
Does using AI change who is responsible for the work?
No. The signing accountant remains responsible for the work product, whoever or whatever drafted it. That is the line to state plainly in the clause, and the reason every AI-assisted output needs a named reviewer.
How often should the notice be reviewed?
Every quarter at first, then twice a year. Tool terms, features and professional guidance move quickly, so set a calendar reminder and give one partner the job of checking the vendor terms and the body's guidance.
Further reads
- Best AI Tools for Chartered Accountants: Seven for a Small Practice — Seven tools to consider before you write the register.
- AI Readiness Checklist for Accountants, Solicitors, Consultants — Check the practice is ready before you promise controls.
- Accounting Firm Standard Operating Procedures With AI: Record to Publish — Write the review step into your procedures.
- AI Note Takers for Financial Advisers: Compliant Meeting Records — Record-keeping rules for note-takers in advice meetings.
- Can Solicitors Use ChatGPT Without Breaching Confidentiality? — How another profession handles confidentiality questions.
- How to Roll Out an AI Policy So Staff Actually Follow It — Build the wider AI policy behind the register.
- Best AI for Accountants in Australia: Tools, Privacy and ATO Checks — Which AI tools suit an Australian accounting practice, what the Privacy Act and TPB guidance expect, and the human checks before anything reaches the ATO.
- Double (Formerly Keeper): AI Bookkeeping Features and Cost per Client — What Double charges per client on Core, Plus and Scale, which AI features each tier adds, and a 40-client monthly bill worked through line by line.
- Professional Indemnity Renewal: Prepare the Proposal Form With AI — What insurers ask or may ask about AI at renewal, plus a claims summary, an AI-use register, a controls list and broker questions you can prepare.
- AI Chatbot for Accountants: Website FAQs Without Giving Tax Advice — Scope a website chatbot to fees, documents and dates, with refusal wording, a hand-off flow and a weekly log review for a small accountancy practice.
- AI Chatbot for Finance Firms: Client Questions Without Advice Risk — What a finance firm's website chatbot may answer, what must go to an adviser, and the disclosure, logging and sign-off a compliance lead will expect.
- AI Marketing for Accountants: LinkedIn, Newsletters and Local Search — A five-hour monthly plan for an accounting practice: newsletter, LinkedIn and Business Profile posts, with rewrites that keep tax claims out.
- AI Tax Return Review vs Software Diagnostics: What Each One Catches — Ten planted errors and two decoys on one sample return show what diagnostics catch, what an AI review adds and what both still miss.
- Automate BACS Payments in an Accountancy Practice: Where AI Fits — A step-by-step BACS payment run for a practice: file build, AI checks on changed bank details, dual approval, submission and reconciliation.
- Companies House ID Verification: A Client Chaser Workflow for Accountants — A tracking sheet, a five-status chase sequence and email templates for getting every director and PSC verified, with AI kept away from ID documents.
- Confidential Information Memorandum AI: A Business Broker's Workflow — A broker's workflow for drafting a CIM with AI: outline, financials into narrative, a line-by-line fact-check and confidentiality rules, plus Flippa's builder.
- AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.
Sources: OpenAI's business pricing page and Data Controls FAQ, Anthropic's Claude pricing page and its privacy centre article on data retention, checked 4 November 2026; check your own professional body's current guidance, which this tutorial does not quote.