A professional firm's duty of confidentiality is older than every AI tool the firm now runs client work through, and none of those tools came with an exception to it. When a brief, a workpaper, or a tax return passes through a vendor's model, the duty follows the data — the only question is whether the engagement letter settled the terms before the client had reason to ask.
The consent expectation is now written into the rules
In July 2024 the American Bar Association issued Formal Opinion 512, its first comprehensive guidance on lawyers' use of generative AI. The opinion grounds its analysis in rules every firm already lives under: Model Rule 1.6 requires lawyers to keep confidential all information relating to a representation regardless of its source unless the client gives informed consent, and Rule 1.4(a)(2) requires lawyers to reasonably consult with clients about the means used to pursue their objectives — which, the opinion makes clear, can include how AI is used on the matter.
State regulators have been more direct about where third-party tools fit. Florida Bar Ethics Opinion 24-1 recommends that a lawyer obtain the affected client's informed consent prior to utilizing a third-party generative AI program whenever the use would involve disclosure of confidential information, and it expects the lawyer to understand the provider's policies on data retention, data sharing, and self-learning before any client data goes in.
Neither opinion mandates a specific clause. What they create is an expectation that consent, where it is required, exists somewhere provable. Consent that lives in a hallway conversation is not provable. The engagement letter is the one document both sides already sign, renew, and re-read when a relationship goes wrong — which makes it the natural home for the terms of AI use.
Most firms and their clients have never had the conversation
The gap between practice and disclosure is measurable. In the Thomson Reuters Institute's 2026 AI in Professional Services Report, 68% of corporate legal professionals said they have no idea whether their outside law firms are using AI at all — while more than half of law firms report using or actively considering generative AI. Roughly three-quarters of both groups agree the firm should be the one to raise the subject. Most firms have not raised it.
That silence is not neutral. Half of the legal professionals surveyed see AI as a moderate or major threat to firm billings, and clients are drawing their own conclusions. One corporate legal officer put it plainly in the report:
I fear that firms will use AI to cut time, but continue to bill for the hypothetical amount of time a task would have taken without it.
Confidentiality obligations do not pause because the processing happens in a vendor's model. The engagement letter is where that gets settled — or lost.
A firm that discloses nothing invites exactly this suspicion, and a client that discovers undisclosed AI use mid-engagement tends to reach for the bluntest instrument available: a blanket prohibition in outside-counsel guidelines, imposed across the firm's entire book of work at once. Confidentiality obligations do not pause because the processing happens in a vendor's model. The engagement letter is where that gets settled — or lost.
For tax practices, the consent requirement is statutory — and criminal
Accounting firms do not have the luxury of treating this as an emerging ethics question. Section 7216 of the Internal Revenue Code makes it a crime for a tax return preparer to knowingly or recklessly disclose tax return information — punishable by a fine of up to $1,000, up to a year of imprisonment, or both — rising to a $100,000 fine in identity-theft cases, as an AICPA Tax Adviser analysis lays out. The regulations define disclosure as making tax return information known to any person, in any manner.
The regime has carve-outs, and their edges are where AI lives. Consent is generally not required for disclosures to service providers assisting with preparation, processing, or filing — but it is required when the provider makes substantive decisions about a return, and when tax return information leaves the United States. For Form 1040 clients, valid consent must be a separate written document with mandated language and an affirmative signature; opt-out consent is prohibited. Whether a given AI tool sits inside or outside those carve-outs turns on facts most firms have never documented: where the model runs, what the vendor retains, what the tool actually decides. That analysis belongs on paper before the tool touches a return, not after an examiner asks.
Four clauses settle the question before it becomes a dispute
None of this requires a ten-page AI appendix. It requires the engagement letter to answer four questions a client or a regulator will eventually ask anyway:
- Disclosure and scope. Name the categories of AI-assisted work the firm performs — research, drafting, document review, preparation — and state which of them involve third-party processing of client information. A category-level statement stays true as tools change; a tool-by-tool list goes stale in a quarter.
- Consent mechanics. Where informed consent is required, capture it affirmatively in the letter itself, not by reference to a policy the client never sees. Hinshaw & Culbertson's analysis of the Florida opinion notes that in-house systems that never expose client data to a third party avoid the consent requirement entirely — a distinction worth stating in the letter, because it reserves routine internal use while seeking consent only where the rules actually demand it.
- Vendor flow-down. State the commitments the firm has verified from its AI vendors: no training on client inputs, defined retention limits, deletion at termination, and processing location. These are the same diligence points the Florida opinion expects the firm to have checked — writing them down converts diligence into a representation the client can rely on.
- Billing treatment. ABA Opinion 512 allows charging for time spent working with AI tools and reviewing their output, but not for time spent learning to use them. Say so, and say how efficiency gains reach the client. The firm that addresses this unprompted defuses the suspicion the Thomson Reuters data shows clients already hold.
An engagement letter that is silent on AI is not neutral — it is a term someone else will eventually write for you, in outside-counsel guidelines, a bar inquiry, or a statute that never mentions AI by name. Firms that draft the clause now choose its terms: what they use, what they disclose, what they promise, and what they charge. For a business whose product is judgment exercised over confidential information, that is not compliance overhead. It is the cheapest trust-building paragraph the firm will ever write.