A client asks how your firm uses AI. Could you answer?

A client used to ask whether your firm used AI on their work, and the safe answer was usually "no". That question has flipped. Now they ask how you use it, and how you keep it under control, and the firms that cannot answer cleanly are the ones losing ground. The written policy in your shared drive is not the answer. The answer is a short, true account you can give on the spot, and most firms do not have one ready.

This is general guidance, not legal advice. The point here is commercial, not compliance: what you say to a buyer who wants to know how their work is handled.

The shift is visible in the data. In Thomson Reuters' 2026 survey of more than 1,500 professionals across 27 countries, more than half of corporate legal and tax departments said they want their outside firms to use AI on their matters. Fewer than a third knew whether their firms actually were (Thomson Reuters Institute). The demand is there; the visibility is not. The same survey found 40% of firms had been given contradictory instructions by clients, some told to use AI on a matter, some told not to, sometimes by the same client on different jobs. Buyers want their advisers to be good at this, and they cannot tell who is.

So the conversation gets had for you, in the gap where you say nothing. A client who cannot see how you use AI assumes one of two things. Either you are not using it, in which case you look slow and expensive next to a firm that is. Or you are using it and not saying, in which case their next worry is what happened to their confidential file. Silence does not read as caution. It reads as either behind or careless, and neither wins the renewal.

The bar moved from using AI to accounting for it

Being able to account for your AI is now a separate skill from using it, and most leaders are not confident they have it. A Grant Thornton survey of 950 business leaders found that 78% were not strongly confident they could pass an independent review of how they govern AI within 90 days (Grant Thornton). Grant Thornton calls this the proof gap: organisations are using the tools but cannot show that the use is safe, defensible, and owned by someone. That is a US survey, so read it as a general signal rather than a UK rule. The pattern travels, though. Plenty of capable firms are well into using AI and would struggle to say, in two clear minutes, how.

A buyer's question does not need a 90-day audit. It needs two minutes of plain speaking, and that is harder than it sounds when nobody has written the words down. The reason most firms freeze is not that their practice is bad. It is that they have never had to describe it out loud, so the description does not exist yet.

A policy is for your staff. The account is for your client

The two are easy to confuse, so it is worth being exact. A policy is the internal document that tells your people what they may and may not do with AI. If you do not have one, that is the first job, and we have written separately on a simple AI policy for a small business. The account is different. It is the short, outward version: what a client hears when they ask how their work is handled. It is built from the policy, but it is not the policy, and reading the policy aloud is not the same as giving the account.

A good account is plain, specific, and true. Plain, because the person asking may be a general counsel or may be a founder who knows nothing about models, and the same words have to work for both. Specific, because "we take AI seriously and have the right safeguards" tells a client nothing and sounds like everyone else. True, because the fastest way to lose a client is to describe a control you do not actually run, and have it surface later.

What a good account contains

Four things, said plainly.

First, where AI touches their work. Name it honestly. AI helps with first drafts, research, summarising long documents, and the early shape of an analysis. The judgement, the advice, and the final position are done by your people. A client is far more comfortable with "AI does the first pass, a qualified person owns the result" than with a vague reassurance, because the first one sounds like a process and the second sounds like a slogan.

Second, what stays under human sign-off. This is the part that matters most to a client and the part firms most often skip when describing themselves. Say plainly that nothing leaves the building on a client matter without a named person checking it. If you want the detail of why that check is non-negotiable, the failure mode is the same one that has put fabricated citations into real court filings, and we covered it in stopping AI mistakes from reaching clients. The account version is one sentence: a person signs off, every time, and here is who.

Third, how confidentiality is handled. A client's first real fear is that their sensitive material has been typed into a public chatbot that learns from it. Be able to say what tools you use, whether client data is used to train anyone's model, and where it is processed. You do not need to lecture them on data protection law. You do need to know your own answer, because under a duty of confidence and data protection rules this is your obligation, not the tool vendor's.

Fourth, who is accountable. Name a person or a role that owns AI use in the firm. "Our managing partner signs off the approach and reviews it quarterly" is worth more to a buyer than any amount of policy text, because it tells them there is a human to call when something goes wrong.

The person on the other side of the question

It helps to remember who is actually asking. A client handing you a sensitive matter, a dispute, a deal, a set of accounts, a search for a senior hire, is trusting you with something that matters to them and often to other people too. When they ask how AI touches that work, they are not running a procurement formality. They are asking whether their confidential thing is safe and whether your judgement is still the judgement they hired. A straight answer respects that. A deflection does not. The firms that will keep this trust are the ones that treat the question as fair and answer it like adults, rather than treating it as an obstacle to get past.

What to do before the next pitch

Write the account before a client makes you improvise one. Get the relevant people in a room and answer the four questions above in plain words, out loud, until the answer is short and you all say it the same way. Pressure-test it: does every sentence describe something you actually do? Cut anything you cannot stand behind. Then make sure the people who sit in pitches and renewals know it, because the question rarely arrives on a form with time to prepare. It arrives in a meeting, and the answer either lands or it does not.

This is the kind of work AI Lessons for Leaders is built around: not a tool demo, but getting a leader to the point where they understand their own firm's AI well enough to speak to it without notes. If a client has already asked and the answer came out wobbly, that is the signal to fix it now, before the next one asks.

The simplest test is the one your client is already running on you. If a good client asked you today how your firm uses and governs AI, could you answer in two clear minutes, and would every word be true? If yes, you are ahead of most of your market. If you hesitated reading that, you have found your next hour of work.

FAQ

What should you tell a client who asks if your firm uses AI?

Give a short, true account, not a policy document. Cover where AI touches their work, what stays under human sign-off, how their confidential data is handled, and who in the firm is accountable. Keep it to plain language that works whether the person asking is technical or not, and make sure every sentence describes something you actually do.

Do we have to tell clients we use AI?

Many clients now expect it and a growing number ask directly, especially in pitches and supplier due diligence. More than half of corporate departments want their advisers to use AI but cannot tell who is, so a clear account is becoming a way to win work rather than a risk to manage. Where a specific engagement or sector has disclosure expectations, take proper advice on those, but as a commercial matter, being ready to answer is now close to a requirement.

Is an internal AI policy enough?

No. A policy governs what your staff may do; it is necessary but inward-facing. Clients ask an outward question, and reading the policy aloud does not answer it. You need a separate, short account built from the policy and rehearsed so the people in client conversations can give it cleanly.