What Your Client Contract Should Say About AI
Your standard terms were written before any of this and say nothing about it. Larger clients are starting to ask, and the firms with an answer ready are winning the work.
Your engagement terms cover confidentiality, liability, payment and termination. They were drafted before AI was a question anybody asked, and they are silent on it.
That silence is becoming a commercial problem rather than a legal one, because clients are now asking and the answer decides contracts.
None of what follows is legal advice. It is the list of things worth putting in front of whoever drafts your terms.
What clients are actually asking
Procurement questionnaires have started including AI questions, and they cluster around four things: whether you use it in delivering their work, whether their information leaves your business, who checks the output, and what happens when it is wrong.
The firms losing on these questions are not the ones using AI. They are the ones who cannot answer, because uncertainty reads as a lack of control.
Six things worth addressing
Disclosure. Whether you may use AI in delivering the work, and whether you have to say so. Silence here means the answer gets decided in a dispute rather than in advance.
What may be submitted. The client’s confidential information, personal data about their staff or customers, anything under a third party obligation. Say what is permitted and on what terms.
Training. Whether anything of theirs may be used to improve a model. For most business arrangements the answer should be no, and clients increasingly want that written down.
Human review. Which outputs are checked by a named person before they reach the client. This is the clause that most reassures, and it is one sentence.
Accountability. That your professional obligations and your liability are unchanged by how the work was produced. Worth stating explicitly, because it is what the client is really worried about.
Records. What you keep about how a decision was reached, and for how long.
Where the standard looks like it is heading
The European Union’s AI Act entered into force on 1 August 2024, with obligations phasing in from 2 February 2025. It requires disclosure when people are interacting with an AI system, labelling of synthetic content, and record keeping and human oversight for systems in its high risk categories.
It applies to you only where the output of your systems is used inside the Union, so for most Canadian and US firms it does not bite directly. Its value here is different: it is the clearest published statement of what a reasonable standard looks like, and the questions it asks are converging with the ones large clients are putting in procurement.
Drafting against it is a way of being ready for the client questionnaire rather than for a regulator.
Look at the other direction too
Two clauses that protect you rather than the client, and both get forgotten.
What your suppliers may do. If a subcontractor or an agency handling your client’s work uses AI on it, that is your exposure and your client will hold you to it. The obligation has to flow down in writing.
What the client submits to you. If they send you AI generated material, specifications, drawings, copy, data, and you build on it, you should not be carrying the risk that it was wrong. Worth a sentence.
Do not overreach
The failure mode here is a three page annex that reads as though you are anxious about the subject.
A short, clear position is more reassuring than an exhaustive one, and it is also more likely to survive a negotiation. Most of this can be a page. What matters is that the position exists, is consistent across every contract, and that everybody in your business gives the same answer when asked.
Check what you have already agreed
Before drafting anything new, read the confidentiality clauses in your existing contracts, particularly with your largest clients.
Many are drafted broadly enough that submitting client information to any third party service requires consent, and a general AI tool is a third party service. That obligation is already binding, it predates any of this, and most firms have never considered it in this context.
This is worth an hour with whoever handles your contracts, because the exposure is retrospective rather than future. Find out where you stand before deciding what to write next.
Say it on your website too
The contract handles the client who has already reached procurement. A published position reaches everybody earlier than that, which is where more of the decision now happens.
A short page stating how your firm uses AI, what happens to client information, and who reviews the work does two things. It answers the question for prospects who would never have asked it out loud, and it removes an objection before anybody has to raise it in a meeting.
Very few firms in professional services have published anything of the sort, which currently makes it a differentiator rather than a hygiene factor. That will not last, and being early is free.
Keep one version of the answer
The practical failure is not the drafting. It is that four people in your business give four different answers to the same client question.
Somebody says you do not use it at all, somebody else describes a tool they use daily, and the client concludes nobody is managing this. That impression is considerably worse than any policy you might have written.
Agree the four sentences, circulate them, and make sure everybody who speaks to clients has them. That is the whole of the implementation and it takes one meeting.
The clause clients notice most
If you only add one sentence, make it the human review one.
Naming that a qualified person reviews anything before it reaches the client answers the question underneath all the others. It costs you nothing, because you were going to do it anyway, and it converts an anxious conversation into a settled one.
The firms that struggle here are the ones who cannot say it truthfully, and that is a delivery problem rather than a drafting one.
Answer it before you are asked
The commercial move is not the contract clause. It is having a short written statement you can send when the question arrives, without going away to find out.
What you use it for, what happens to their information, who checks the work, and what happens when something is wrong. Four sentences, agreed once. That document wins work against firms who have to convene a meeting about it, and it takes an afternoon.
Sources
European Commission, Regulatory framework for AI. In force 1 August 2024; obligations phasing in from 2 February 2025.
AI Optimize builds disclosure, human review and a full audit trail in as standard, so the answers to those four questions already exist. That work sits under Custom AI Integrations.
Related reading
Keeping a Record of What Your AI Did
A client disputes a figure your system produced eight months ago. You need to show what it saw, what it decided, and who checked it. Most businesses cannot.
What Your AI Policy Should Say About Client Work
A page your team will actually read, covering the four situations that come up. Most policies fail because they were written to satisfy a lawyer rather than to be used on a Friday afternoon.
WHAT WE BUILD
