The Machine in the Room: Drafting an AI Clause for UK Engagement Letters

UK advisory firms enter 2026 with an engagement-letter problem that did not exist in the same form a decade ago. Clients now use artificial intelligence tools to draft instructions, summarise board papers and test the advice they receive. They also expect their advisers to use similar tools to work faster and more thoroughly. Yet many engagement letters remain silent on AI. That silence is no longer comfortable. It leaves open questions about confidentiality, data handling, human review and reliance — questions a client may ask only after something has gone wrong.

The answer is not a lengthy technology policy bolted onto the letter. A short, carefully drafted clause can set boundaries without turning every engagement into a procurement exercise. The aim is to make the firm’s position clear before work begins, so that neither side has to guess.

Why silence carries risk

Three pressures make the gap conspicuous.

First, confidentiality. Professional firms hold sensitive information: transaction documents, tax affairs, employment disputes, board papers. If a member of the team pastes client material into a public AI tool without proper controls, the firm may face questions under the UK GDPR and the Data Protection Act 2018, and potentially under professional confidentiality duties. Legal advice privilege can also be compromised if confidential material is handled carelessly. The engagement letter will not solve poor practice on its own, but it should not imply that anything goes.

Second, reliance. A client may receive a document that has been drafted with AI assistance and assume it has been checked by a qualified person. Or a client may send the firm AI-generated instructions containing errors and expect the firm to spot every one. Without an agreed position, responsibility becomes blurred.

Third, expectations. Some clients will want reassurance that AI is not used at all. Others will want the firm to use it aggressively to reduce fees. Neither blanket position is usually sensible. A clause should allow sensible use while preserving professional judgement.

The three questions the clause must answer

A workable AI clause does not need to describe the technology in detail. It needs to answer three practical questions.

• What may the firm use AI for, and on what terms?
• What client information may be input into those tools?
• Who reviews the output, and what reliance may the client place on it?

A fourth question is often worth adding: what are the client’s own responsibilities if they use AI to prepare instructions or materials for the firm?

A workable clause

The wording below is deliberately concise. It can be adapted for legal, accountancy or consultancy engagements, and should be read alongside the firm’s privacy notice and internal AI policy. Bracketed text allows firms to calibrate the position.

Artificial intelligence. We may use artificial intelligence tools in the delivery of the Services, including for document review, drafting assistance, research and data analysis. We will not input Client Confidential Information into any AI tool unless (a) the tool is operated under terms that impose confidentiality and data-protection obligations no less protective than those in this letter; (b) the information is minimised to what is necessary for the task; and (c) the use is consistent with our professional obligations and any specific instructions you give us. AI output will be reviewed by a qualified member of our team before it is relied upon or communicated to you as advice. We remain responsible for the professional advice we give. You should not treat any AI-generated material we send you as a substitute for our considered advice. If you use AI tools to prepare instructions or materials for us, you are responsible for checking their accuracy and for ensuring that you do not disclose third-party confidential information without authority. We may update our internal AI policy from time to time; any material change affecting the Services will be notified to you.

Several features of that wording matter. It permits use but does not permit uncontrolled use. It ties data handling to the firm’s confidentiality and data-protection standards. It preserves human review and firm responsibility. It also puts a sensible obligation on the client without turning the client into the firm’s compliance officer.

What to avoid

A clause that bans all AI is difficult to police and may be untrue in practice, because common office software now contains AI features. A clause that says the firm “may use AI” without more is almost useless. A clause that transfers all responsibility to the client is likely to be resisted and may not reflect the firm’s professional duties.

Firms should also avoid over-specific promises. Naming a particular tool or model is risky when products change quickly. Promising that no client data will ever be processed by a third-party provider may be impossible to substantiate across the firm’s software stack.

The better approach is to describe principles and controls, not brand names.

Putting the clause into practice

An engagement letter is only one part of the picture. Firms should align the clause with their internal AI policy, their privacy notice and their record-retention arrangements. They should train fee-earners on what may be input into which tools, and keep a record of approved tools and any restrictions. Professional indemnity insurers are increasingly likely to ask about AI governance, so the clause should reflect what the firm actually does.

It is also worth discussing AI at onboarding. A short conversation — “here is how we may use these tools, here is what we will not do, and here is what we need from you” — is more effective than leaving the client to discover the clause at the back of a PDF.

A boundary, not a substitute for judgement

No engagement-letter clause can replace sound professional judgement. It cannot cure a team that inputs sensitive material into an unapproved tool, or a reviewer who signs off AI output without checking it. What a good clause can do is set expectations, allocate responsibility and create a documented starting point if a client later asks how their information was handled.

In 2026, that question is likely to come. It is better to have a clear answer in the engagement letter than to improvise one after the event.