AI use policy for a consultancy

A consultancy sells judgement delivered in reports, models and recommendations, built on clients' confidential information, and its consultants use AI tools to research, analyse, draft and summarise. The policy has to protect the client's information (some engagement terms prohibit AI tools on client material), keep the judgement the client is paying for human, deal with ownership of deliverables with generated material, reach the associates who do much of the work, and set what the firm discloses and warrants. Drafting for the business, I deliver the AI use policy and its accompanying contract provisions in five working days for a fixed £995.

Who this is for

Consultancies and advisory firms in England and Wales of every kind, from a sole consultant to a firm with associates and subcontractors.

What matters in a consultancy's AI use policy

Clients' confidential information and the consultant's duty

a tool whose terms permit training on inputs or their retention is off limits for confidential information, trade secrets and clients' data, because protection under the Trade Secrets (Enforcement, etc.) Regulations 2018 and compliance with the business's confidentiality obligations depend on the steps taken; a consultancy's engagement terms and its non-disclosure agreements usually require it to keep the client's information confidential, to use it only for the engagement and to disclose it to no third party, and a tool provider is a third party, so that the policy sets which tools may receive client material (business tiers under terms that exclude training, limit retention and keep the data under the firm's control, with the data processing agreement where personal data is involved), what must be removed before material goes in (client names, identifiers, the most sensitive parts), and what may never go in (anything the client's terms prohibit or the firm would not want read back to the client).

The engagement terms that prohibit AI and the ones that are silent

Some clients' engagement terms now prohibit the use of AI tools on their information or require consent, some require disclosure, some require the firm's tools to meet the client's own standards, and most are silent; the policy requires the firm to check the engagement terms and any NDA before using tools on an engagement, to record the position for each client, to obtain consent where the terms require it or where the firm's use would surprise the client, and to default to the firm's own position (stated in its engagement terms) where the client's terms are silent; the contract provisions drafted with the policy state that position in the firm's terms, so that a client who signs them has agreed to the firm's use and the question does not arise mid-engagement.

Research, analysis and the report the client is paying for

AI tools generate plausible research with invented sources, analysis with arithmetical errors and recommendations that reflect the training data rather than the client's situation, and a consultant's report is the firm's work for which it is liable under the engagement and in negligence; the policy requires every source a tool cites to be located and read, every figure recalculated, every analysis understood and owned by the consultant presenting it, and the judgement to be the consultant's, with the tool's contribution recorded in the engagement file; a report that quotes a report that does not exist is the event the policy exists to prevent.

Deliverables, ownership and the work product the firm assigns

Engagement terms commonly assign the intellectual property in deliverables to the client (or license them, with the firm retaining its methodologies), and a deliverable containing generated material has an uncertain owner under the Copyright, Designs and Patents Act 1988 (section 9(3) names the person who made the arrangements as the author of a computer-generated work) and may reproduce third-party material; the policy requires substantial human authorship in deliverables the client will own, requires generated material to be checked for reproduction, records the tools used, and the contract provisions set what the firm warrants about originality and ownership (the firm's own work; generated elements as disclosed) and what it does not; the firm's pre-existing materials and the tools' outputs the firm reuses across clients are carved out of the assignment as the firm's methodologies always were.

Associates, subcontractors and the tools the firm does not see

Much consulting work is done by associates and subcontractors on their own equipment and accounts, and an associate pasting the client's data into a consumer tool is the firm's breach of its engagement terms and the client's confidence; the policy applies to associates and subcontractors through their agreements (the policy incorporated, approved tools required, consumer tools prohibited for client material, audit and termination rights), requires them to disclose the tools they use, and flows the client's specific restrictions down to them; under the UK GDPR, personal data in an AI prompt is personal data being processed, so the business needs a lawful basis, a notice, an Article 28 data processing agreement with the provider and, where the use affects individuals, an Article 35 impact assessment, and an associate's tool is the firm's sub-processor where client personal data goes into it.

Disclosure, liability and the contract provisions that go with the policy

The policy sets the firm's disclosure position (standing disclosure in the engagement terms of the tools used and the human review applied; specific disclosure where a deliverable is substantially generated, the client asks or the client's terms require it), prohibits presenting generated work as the consultant's own analysis, and sets the liability position the contract provisions carry: the firm is liable for its deliverables as its own work, within the engagement's cap, and does not warrant that tools' outputs are free of error beyond the review the firm applies; the provisions go into the engagement terms, the associate and subcontractor agreements, the NDAs the firm signs (an AI carve-out the client will accept) and the firm's supplier agreements with tool providers.

What it costs

AI use policy, £995. Internal policy plus the accompanying contract provisions. Five working days.

AI provisions in a contract, £595. Review or draft AI-specific terms in a supply or customer agreement. Five working days.

Email me at geoffrey@caesar.co.uk with what you need and any documents, and I will confirm the scope and the fee in writing, usually the same working day.

What you get

• An internal AI use policy your staff will follow, rather than a document that bans everything and is quietly ignored
• Contract provisions covering output ownership, training data, confidentiality and liability
• A defensible position to give customers who ask what your AI governance looks like
• Review of your AI suppliers' terms, including what they reserve the right to change
• Practical guidance on what to permit, what to restrict and what to prohibit outright
• One round of amendments

What is not included

• Technical AI assurance, model testing or bias auditing
• Sector-specific regulatory approval
• Advice on non-UK regulatory regimes beyond flagging where they apply
• Ongoing regulatory monitoring

Questions I am often asked

A client's NDA says we cannot share their information with third parties. Can we use AI tools on it?

A tool provider is a third party, so only on tools whose terms keep the data under the firm's control with training excluded, and only if the NDA does not prohibit it outright. The policy requires the terms to be checked for each client and the position recorded, and the contract provisions put an AI carve-out in the firm's NDAs.

Our associates use their own tools. Does the policy reach them?

Through their agreements: the policy incorporated, approved tools required, consumer tools prohibited for client material, disclosure of what they use, audit and termination rights. An associate's breach is the firm's breach of the engagement.

Do we have to tell clients we used AI on their report?

The firm's engagement terms give standing disclosure of the categories of tool and the human review; specific disclosure where a deliverable is substantially generated, the client asks or their terms require it. Generated work is never presented as the consultant's own analysis.

Related guidance and services

• AI contracts and AI use policies, £995, the service this page describes
• Data protection agreements and privacy terms, £795
• Employment contracts and handbooks, £595
• Privacy notice for a consultancy
• AI use policy for a small business

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.