Disclosing AI to Clients: Engagement Letters for Consultants

Consulting firms should proactively disclose AI assistance in their engagement letters to protect client trust and prevent billing disputes. This guide covers the legal baselines, the Deloitte Australia case, and a seven-point checklist for drafting your AI disclosure clause.

Yes. If your firm uses AI tools to research, analyse, draft or produce slides for client work, you should say so in the engagement letter, and you should repeat that agreement in one line on the deliverable's cover page. The strongest reason is not a general legal duty: for most private advisory deliverables there is no single statute that requires you to label AI-assisted work, and this article is not legal advice on any specific engagement. The strongest reason is the client relationship. Clients discover AI use anyway, and the damage comes when they discover it through an error rather than through an agreement you set out at the start.

It helps to separate three things that are often blurred together. Disclosure of use means telling the client which tasks AI tools performed. Accountability means the firm remains fully responsible for the content, whatever tools produced it. Data handling means being clear about where client documents are processed and whether they are used to train any model. A client can accept heavy AI use with strong verification, or light AI use with none, but almost no client accepts discovering it after the fact.

• Disclosure of use: which tasks AI tools performed, agreed in advance.
• Accountability: the firm signs off and remains responsible for every claim, whatever produced it.
• Data handling: where client documents go, and whether any model is trained on them.

The clearest recent illustration of what discovery-after-error looks like is the 2025 case of Deloitte Australia and the Australian Department of Employment and Workplace Relations. Deloitte was commissioned in December 2024^[1] to review the department's targeted compliance framework, and delivered a report valued at AUD 440,000. In August 2025, the Australian Financial Review reported that multiple errors had been found, including non-existent academic references and citations. The Guardian's account adds a made-up reference to a Federal Court decision in a robodebt case, Deanna Amato v Commonwealth^[1].

The consequences followed the pattern this article is concerned with. Deloitte agreed to a partial refund of the fee, and the department confirmed the firm would repay the final instalment under its contract. A revised version of the report was re-uploaded to the department's website, and in its appendix it disclosed that part of the work had included the use of a generative AI large language model, an Azure OpenAI GPT-4o based tool chain licensed by the department and hosted on its Azure tenancy^[1]. Disclosure came, in other words, after the errors were found publicly, not before delivery.

For an advisory firm, the lesson is not that AI caused the errors, or that a refund was the legally required outcome. It is that the disclosure existed in the revised version, and would have read very differently had it been in the original engagement letter. A client who has agreed in advance which tasks AI performs, and what verification every figure passes, reads an error as a process failure to fix. A client who finds undisclosed AI use behind a fabricated citation reads it as a breach of trust, and senators and journalists get involved.

Start with the honest position: for most private advisory deliverables, there is no single statute in the UK, the EU or the United States that requires a consulting firm to disclose that AI tools were used. That is a description of the general landscape, not legal advice, and the specifics of any engagement, particularly regulated sectors and public-sector work, should be confirmed with counsel.

The nearest thing to a disclosure rule in Europe is narrow. Article 50 of the EU AI Act sets transparency obligations for providers and deployers of certain AI systems, and its text is specific about what triggers them^[2]. It requires, among other things, that people are informed when they interact with an AI system, that synthetic audio, image, video and text content is marked in a machine-readable format, and that deepfakes and certain AI-generated text published to inform the public on matters of public interest are disclosed as artificially generated. That last obligation does not apply where the content has undergone human review or editorial control and a person or organisation holds editorial responsibility for the publication.

• Article 50 targets specific situations: AI interaction with people, machine-readable marking of synthetic content, deepfakes, and certain public-interest text publications.
• It does not create a general duty to label all AI-assisted business documents.
• Human review with editorial responsibility is expressly relevant to the public-interest text disclosure obligation.

The practical answer is to agree the terms of AI use with the client before work starts, in the engagement letter, and to repeat the agreement in one line on the deliverable's cover page. Seven items cover it. Treat them as topics to agree with the client, and confirm the final wording of any clause with counsel.

1. Scope of AI use. State whether AI tools are used, and for which tasks: research, drafting, analysis, slide production. Be specific enough that the client knows what is and is not machine-assisted.
2. Data handling. State where client documents are processed, and whether they are used to train any model. This is the item clients' legal and security teams read first.
3. Human review and sign-off. Describe the review every deliverable passes, and name who signs it. AI-assisted does not mean unreviewed, and the letter should say who is accountable.
4. Verification standard. State how figures and citations are verified before delivery, so the client knows the quality bar the work is held to.
5. Fees. State how fees relate to AI-assisted work, so the client is not left to assume that machine efficiency should simply appear as a discount.
6. Client control. Give the client the right to restrict or exclude AI use for specific workstreams, for example where confidentiality sensitivity is highest.
7. Error correction. State how errors found after delivery are corrected: who is told, how quickly, and whether corrected versions are reissued with changes noted.

Two habits make the checklist work in practice. First, the cover-page line: a single sentence on the deliverable itself that restates the agreed AI use, so the disclosure travels with the document rather than living only in a contract the client's procurement team signed. Second, consistency: the engagement letter, the cover page and the firm's actual workflow must tell the same story, because the checklist fails if the letter promises verification the process does not deliver.

This example is an illustrative hypothetical, not a real engagement, and no figures in it represent actual data. A mid-size advisory firm is engaged by an industrial client assessing entry into a European market. The partner drafts the AI paragraph of the engagement letter using the seven-point checklist.

1. Scope: the letter states that AI tools are used for desk research, structuring analysis and first-draft slide production, and that market sizing conclusions and recommendations are developed and validated by the engagement team.
2. Data handling: client documents are processed within the firm's platform environment, are not used to train any shared model, and the client's legal team receives the vendor's data processing documentation before kickoff.
3. Review and sign-off: every deliverable passes a named partner review, and the partner signs the final deck.
4. Verification: every figure and citation in the deliverable is traced to a source before issue, and sources are available to the client on request.
5. Fees: the engagement is priced as a fixed fee for the verified deliverable, not as hours, so AI-assisted efficiency is reflected in the price agreed rather than in a debate after delivery.
6. Client control: the client may direct that AI tools are not used on the workstream covering its own unpublished financials.
7. Error correction: errors found after delivery are notified to the client's project sponsor within an agreed timeframe, and a corrected version is issued with changes noted.

The cover-page note the firm places on the final deliverable reads, in one line: "Prepared with AI assistance for research, analysis structuring and slide drafting; all figures and citations verified and reviewed by the engagement partner, who signs the deliverable; client documents not used to train any model." In the hypothetical, the client's procurement team accepts the clause in the first round of comments, because it answers the questions they would otherwise have had to ask.

The fifth checklist item deserves its own section, because fees are where undisclosed AI use does the most damage. When clients believe they have paid professional-services rates for machine-generated drafting, the backlash can be public and costly. The fee conversation is also where late discovery does its worst work: a client who first learns of AI use while reviewing an invoice treats every line as a question about value, not only the machine-assisted ones. The remedy is sequencing. Agree the fee treatment before the work starts, and the question of who or what produced the first draft never has to be litigated from an invoice.

Agreeing the fee treatment in the engagement letter changes the conversation. When AI use is disclosed and the fee is framed around the verified deliverable, the client is paying for the outcome: a defensible analysis, checked sources and a partner's judgment, not for hours of keystrokes. The ABA's position for US lawyers points in the same direction, treating the cost of AI tools as something to be explained in advance, rather than passed on silently^[3].

• Frame the fee around the verified deliverable and the judgment behind it, not around hours that AI has compressed.
• Explain in advance how tool costs are treated, so the client consents rather than discovers.
• Use the disclosure to justify the review and verification the deliverable has passed, which is what the client is actually buying.

The checklist above is easier to honour when the platform the firm works on makes the promises checkable. Decisity is an AI-native strategy consulting platform that turns a brief and uploaded documents into board-ready decks in which every claim, number and recommendation is traceable to its source, with a full audit trail from conclusion to evidence. That traceability is what makes the fourth checklist item, the verification standard for figures and citations, something the firm can demonstrate to a client rather than merely assert, and it persists so a decision can be re-examined later against the evidence it rested on.

On data handling, the second checklist item, client documents are not used to train shared models, and data is processed with European data residency. Decisity is designed to align with the EU AI Act and engineered in line with ISO 27001 and SOC 2 control principles. For a firm drafting its engagement-letter AI clause, those are the kinds of commitments that turn item (2) from a promise into a verifiable position, and they are worth confirming against the platform's own documentation before the letter is signed.

Related reading:

• Keeping Your Consulting Methodology in an AI Platform
• Correcting a wrong number in a board paper after the meeting
• Presenting AI-Assisted Strategy Analysis to a Skeptical Board

• The Guardian: Deloitte to pay money back to Albanese government after using AI in $440,000 report (6 October 2025)
• EU Artificial Intelligence Act: Article 50, Transparency obligations for providers and deployers of certain AI systems
• The Bar Examiner (NCBE): ABA Formal Opinion 512 on lawyers' use of generative AI tools (Fall 2024)
• Fortune: Deloitte to partially refund the Australian government over a report with apparent AI-generated errors (7 October 2025)