15 questions for professional firms on the use of AI

Do you know who in the firm uses AI tools, which tools they use, and for what tasks?

Include partners, lawyers, trainees, administrative staff and external providers.

Do you have a clear list of permitted, restricted and prohibited AI use cases?

For example research, summarisation, drafting, transcription, document review or client communications.

Is AI use limited to firm-approved tools and accounts rather than uncontrolled personal accounts?

Include browser extensions, transcription tools and AI features embedded in other software.

Does the team know what information must not, or should not, be entered into AI tools?

Especially client documents, privileged or confidential information, personal or sensitive data, matter details and unpublished material.

Has the firm checked how the provider uses data, how long it is retained, and what privacy or training settings apply?

Review the actual service and configuration used by the firm, not just the product name.

Can staff minimise, redact or remove unnecessary details before using AI?

Data minimisation is a practical control even where the use itself is approved. Redaction supplements an approved tool rather than replacing it: under the Israel Bar's updated ethics opinion, removing the client's name is not adequate protection.

Is human review mandatory before relying on AI output in professional work?

A confident-sounding output is not a substitute for professional verification.

Is there a defined way to verify citations, authorities, facts and conclusions produced with AI?

Especially when the output is used in legal documents, opinions, correspondence or professional decisions.

Is it clear when material AI use should be documented in the matter or workflow?

The goal is traceability and control, not documentation for its own sake.

Does the firm have a designated person who approves tools, use cases and exceptions?

Without a clear owner, decisions tend to fragment across individual users.

Does a new AI tool go through vendor, terms, security, data and access review before use?

A short repeatable intake process is better than ad hoc review.

Is there a defined path for reporting and responding to an AI incident, error or unauthorised use?

For example uploading the wrong document, disclosing information or relying on incorrect output.

Has the team received training that reflects real legal work rather than generic AI awareness?

Effective training includes examples, data rules and output review.

Is there an easy channel to ask about uncertain uses or report a new tool?

A usable question channel can reduce Shadow AI more effectively than an impractical blanket ban.

Are the policy, approved-tool list and training reviewed periodically?

Tools, features, terms and use cases change quickly. Review should be built into the system.

Do you know who in the firm uses AI tools, which tools they use, and for what tasks?

Include partners, accountants, trainees, bookkeepers, payroll teams and external providers.

Do you have a clear list of permitted, restricted and prohibited AI use cases?

For example summarisation, drafting, data analysis, working-paper support, transcription or assistance with accounting and tax work.

Is AI use limited to firm-approved tools and accounts rather than uncontrolled personal accounts?

Include spreadsheet add-ins, transcription tools and AI features embedded in office systems.

Does the team know what information must not, or should not, be entered into AI tools?

Especially non-public financial statements, payroll data, tax records, bank information, client data and commercially sensitive information.

Has the firm checked how the provider uses data, how long it is retained, and what privacy or training settings apply?

Review the actual service and configuration in use, not only the product name.

Can staff minimise, redact or remove unnecessary details before using AI?

Often the tool can still be useful without receiving identifiers, complete documents or unnecessary figures.

Is human review mandatory before relying on AI output in professional work?

AI can assist, but data, calculations and conclusions still require professional verification.

Is there a defined way to verify calculations, sources, standards, tax positions and facts produced with AI?

Especially when the output affects reporting, advice, client work or a professional decision.

Is it clear when material AI use should be documented in working papers or the workflow?

The objective is traceability and control, aligned with the nature of the engagement and firm policy.

Does the firm have a designated person who approves tools, use cases and exceptions?

Responsibility should be clear across management, IT, security and professional owners.

Does a new AI tool go through vendor, terms, security, data and access review before use?

Tools that connect to email, files or financial systems deserve particular attention.

Is there a defined path for reporting and responding to an AI incident, error or unauthorised use?

For example disclosure of client data, an incorrect calculation or use of an unapproved tool.

Has the team received training that reflects real accounting and tax work?

Effective training covers examples, data rules, output review and escalation.

Is there an easy channel to ask about uncertain uses or report a new tool?

When questions are answered quickly, new uses are easier to discover before they become Shadow AI.

Are the policy, approved-tool list and training reviewed periodically?

Tools and terms change quickly, so governance needs an ongoing review cycle.