Guide
A client consent and disclosure template for AI use in legal work (adapt before use)
Client consent for AI use: when a lawyer should disclose, adaptable engagement-letter wording and how to record client AI preferences on the matter.
By Raghav R Handa, practising lawyer15 min read
TL;DR
- Whether you must tell a client about AI use, or obtain consent, depends on your regulator, the tool, the data and the client's instructions.
- Think in three levels: no disclosure needed, general disclosure in the engagement letter, and specific informed consent for a particular use.
- Where disclosure is wise, put it in plain words and offer a way to opt out, then record the client's choice on the matter so workflows respect it.
- Do not use the wording below as is. Adapt it to your rules, your tools and your practice. It is a template for a lawyer to adapt, not legal advice.
Whether you must tell a client about AI use depends on your jurisdiction's rules, the tool, what data goes into it and whether it affects the work or the fee. Where disclosure is wise, put it in the engagement letter in plain words and offer a way to opt out. The wording below is a template for a lawyer to adapt, not a form to copy, and not legal advice. Check your regulator's guidance and your insurer's requirements first.
Three levels of disclosure
| Level | When | What you do |
|---|---|---|
| 0. None needed | AI is used only on non-client material (templates, public research) or on firm administration | Nothing specific; your policy still applies |
| 1. General disclosure | AI tools may be used on client matters in ordinary, lower-risk ways with reasonable safeguards | A short paragraph in the engagement letter, with an opt-out |
| 2. Specific informed consent | Confidential or sensitive client information will be entered into a particular third-party tool, or AI will materially shape the work | A specific explanation and written consent before use |
A decision tree
- Does your regulator or the client's guidelines require disclosure or consent? If yes, follow them.
- Will client information be entered into a tool operated by a third party? If no, level 0 may suffice.
- Is the information sensitive (privileged analysis, health, immigration, financial, criminal)? If yes, lean toward level 2 or do not use AI on it.
- Will AI materially shape the advice or the fee? If yes, tell the client and consider consent.
- Has the client asked? Answer honestly and record it.
- Otherwise, a general disclosure in the engagement letter, with an opt-out, is a sensible baseline.
When to disclose
- Your regulator's guidance says to, or says it may be needed.
- Client confidential information will be entered into a third-party AI tool.
- AI materially shapes the work product or the fee.
- The client has asked, or has outside-counsel rules that address it.
Adaptable wording: general disclosure (level 1)
Use of technology and artificial intelligence. We use secure, reputable software and, in some cases, artificial intelligence tools to help with tasks such as summarising documents, drafting first versions and organising information. We choose these tools with regard to confidentiality and security, we do not permit them to be used to train public models with your information, and a lawyer reviews all work before it is sent to you or used in your matter. We will not rely on AI output without checking it.
If you prefer that we do not use artificial intelligence tools on your matter, please tell us in writing and we will record and follow that instruction. [Adapt: describe any tools or categories, any effect on fees, and any consent you require for specific uses.]
Adaptable wording: specific consent (level 2)
We would like to use [tool or category] to [task]. This would involve entering [description of information] into a service operated by [provider], which [describe retention and training terms accurately, from the provider's current documents]. The risks include [describe]. We believe this is appropriate because [reason]. Please confirm in writing whether you consent. You may decline, and doing so will not affect our service except [describe any effect].
Adaptable wording: restricted or declined
You have asked us not to use artificial intelligence tools on your matter. We have recorded your instruction and will comply. This may mean that some tasks take longer or cost more, and we will tell you before that happens. You can change your instruction at any time by writing to us.
How to explain it in plain words (a short script)
- "We sometimes use software that uses AI to help us work faster, for things like summarising documents."
- "It is operated by another company, so your information would pass through its systems."
- "The company has told us it does not use customers' information to train its models and keeps it only briefly; we have checked its terms." (Only say this if true, from current documents.)
- "AI can make mistakes, so a lawyer checks everything before it is used or sent to you."
- "If you would rather we did not use it on your matter, just tell us."
Questions clients ask, and honest answers
| Question | A good answer covers |
|---|---|
| Is my information safe? | What controls you use, what the vendor states, what you exclude, and that nothing is risk-free |
| Will AI write my advice? | That a lawyer is responsible for all advice, and AI only assists with drafting or organisation |
| Does this make it cheaper? | How fees are set (for example fixed or hourly for time spent), and that you will not charge for time not spent |
| Can I opt out? | Yes, and how you will record and follow it |
| Which tools do you use? | Categories and, if appropriate, names, with the provider's current terms |
Record it on the matter
| Field | Type | Use |
|---|---|---|
| AI consent | Select: Not asked, General disclosure given, Specific consent, Declined, Restricted | Drives workflows |
| AI consent date and by whom | Date, Person | Evidence |
| Consent document | URL | Link to the signed wording |
| Client AI restrictions | Text | Details, including outside-counsel guideline references |
- Add the fields to Matters, and link the signed wording from the engagement tracker (engagement letters).
- Filter AI-using workflows (agents, summaries) so they skip matters marked Declined or Restricted.
- Review matters marked Not asked at intake and at any material change in how AI is used.
- When a client withdraws consent, update the record and stop the use.
Outside-counsel guidelines
Many institutional clients send guidelines covering approved tools, data location, security standards and AI. Read them at the start, record any restriction on the matter, and treat them as contractual. Where the guidelines are silent, apply your own policy and consider asking.
Common mistakes
- Burying a vague line in a long letter and treating it as consent to a significant use.
- Disclosing but not recording, so workflows do not respect the client's choice.
- Describing the provider's terms from memory instead of its current documents.
- Assuming consent shifts responsibility.
Next: a firm AI policy template, is Notion AI safe for confidential legal work? and the ABA Model Rules for cloud and AI.
Frequently asked questions
Do I have to tell clients I use AI?
It depends on your jurisdiction's rules and guidance, what the tool does with client information, whether it affects the work or fees, and any client instructions or outside-counsel guidelines. Many lawyers choose to disclose in the engagement letter regardless. Check your regulator's current guidance.
Should I get written consent?
Where client confidential information is entered into a tool in a way that creates risk, or where the client has asked about it, written informed consent is prudent. A general statement in an engagement letter may not be enough for significant uses.
What if a client says no to AI?
Respect it, record it on the matter, and make sure the AI tools are not used on that matter. A property or checkbox on the matter helps you comply, and workflows should skip matters marked Declined or Restricted.
What makes consent 'informed'?
That the client understands the relevant facts: what will be done, what information is involved, who will process it, what the material risks and benefits are, and what alternatives exist, and agrees freely. A vague line in a long letter may not meet that standard for a significant use.
Can a client withdraw consent?
Generally yes. Record the withdrawal, stop the use going forward, and consider what must be done about information already processed, taking account of the tool's retention terms.
How do I explain AI risks to a client in plain words?
Say what the tool does, what of their information it would see, that the provider is a third party, how long it may keep it, that AI can make mistakes which a lawyer will check, and that they can say no. Keep it short and concrete.
What if the client's outside-counsel guidelines forbid AI?
Follow them. They are contractual and often stricter than the regulator. Record the restriction on the matter and restrict workflows accordingly.
Does disclosure shift responsibility to the client?
No. Disclosure and consent inform the client; they do not remove your duties of competence, confidentiality, supervision and candour, which remain yours.