Signing With Confidence: Interrogating AI Terms in UK Professional Engagement Letters

An engagement letter is a modest document doing a great deal of work. It fixes scope, fee basis, liability caps, confidentiality and the point at which the relationship ends. Until recently, most of these terms were settled long before signature. Artificial intelligence has changed that, because the way a firm delivers its work can now change materially without any visible change to the letter's other provisions.

In 2026, the AI clause is frequently the shortest paragraph in the pack and the least examined. That is an uncomfortable combination.

Why the letter matters more than the policy

Many firms publish an AI policy, and many more describe their approach in a pitch. Neither is the contract. A policy is an internal statement that the client cannot enforce and which the firm may revise at will; the engagement letter is the instrument that governs the work.

Where the letter is silent, the client is left relying on implied duties of confidentiality and reasonable skill and care, alongside data protection law. Those duties are real but general. They rarely answer the specific questions a client actually needs answered.

First: what client information will enter an AI system?

'We may use AI tools' is not an answer. The useful question is which categories of client information will be processed by a model or an adjacent service, and in what form.

Inputs, prompts, outputs and metadata all carry risk. Some tools retain prompt history by default, some log for quality assurance, some retain nothing. Ask for the answer in writing, ideally as a schedule appended to the letter, and ask whether the firm treats its AI vendors as sub-processors. If it does, UK GDPR requires appropriate contractual terms, and the client should know that the chain exists.

Second: where is the processing and where does the data rest?

Residency is not a technicality. Ask which vendor and which model the firm uses, whether the tenancy is enterprise-grade, whether client data is used for model training and how to opt out, and how long inputs and outputs are retained before deletion.

Where processing occurs outside the UK, the transfer needs a lawful mechanism and a documented assessment. A firm that cannot say where the processing happens is not necessarily careless — the supply chain is genuinely complex — but it should be able to say how it satisfies itself.

Third: who reviews the output, and how is that recorded?

'Human in the loop' has become a phrase that ends conversations rather than starting them. Press further. Which outputs are reviewed, by whom, at what stage, and what record exists?

A credible answer names a role rather than a team, describes the review step in the letter or a short schedule, and confirms that drafts, versions or provenance records are retained. For work that may later be relied on by a third party, an auditor or a court, the audit trail is part of the deliverable, not an internal nicety.

Fourth: who carries the liability when something is wrong?

Most firms will say they remain responsible for the work regardless of the tools used. That statement should appear in the letter, not only in conversation.

Three practical checks follow. Does the professional indemnity policy respond to AI-assisted work, or does it contain an exclusion or a notification requirement the firm has yet to satisfy? Does the liability cap still make sense given the volume of output a single engagement can produce? And if the client relies on the work through a reliance letter or third-party rights clause, does the AI provision alter that position?

A warranty that no AI-generated error will ever occur is neither realistic nor particularly useful. A firm commitment to reasonable skill and care, coupled with a defined review process, is a stronger and more honest construction.

Fifth: what will be disclosed, and to whom?

Disclosure runs in several directions at once. The client may want to know when AI has been used and for what. Regulators and auditors may ask. Litigation can require the firm to explain how a document was produced.

Ask how the firm records AI involvement, whether it will notify the client of a change of tooling mid-engagement, and how it would respond to a disclosure request about AI-assisted drafting. For regulated firms, the answers should be consistent with the expectations of their supervisor, whether that is the SRA, the FCA or a professional accountancy body.

Drafting notes for firms

Specificity is the whole game. A clause that permits AI use 'where appropriate' gives the firm room to manoeuvre but gives the client nothing to rely on, and it tends to surface at exactly the wrong moment.

The stronger approach is short and concrete: the categories of tooling in use, the review step and who performs it, the position on training and retention, confirmation that professional responsibility is unaffected, a mechanism for the client to raise an objection, and a route for revising the terms when tooling changes materially. Unilateral variation clauses are tempting; they also undermine the assurance the clause is meant to provide.

Firms should also reconcile the letter with their insurance notification obligations and with the guidance issued by their regulator. A well-drafted clause that the firm's indemnity cover quietly contradicts is worse than no clause at all.

A practical negotiation sequence

Put the five questions in writing before signature. Ask for the answers as an appendix rather than in correspondence. Agree a review date — annually, or on any material change of tooling — and record the answers where they can be found again. If a dispute arises two years from now, that appendix will be the first document anyone reads.

The test before the pen

One question summarises the rest: if the firm's AI arrangements changed tomorrow, would this letter tell me? If the answer is no, the terms are not yet fit for signature.