Information and education only; this article is not legal advice. Have the appropriate legal, privacy, or security professional assess your particular agreements and obligations.
Before using AI on client work, separate two questions: can the tool help with the task, and are you authorized to give that tool the information involved? A useful demonstration with fictional data does not answer the second question.
This checklist is for preparing an informed discussion. It is not a certification that a product or workflow is “client-safe.”
Describe the proposed use
Write down the task, the information required, the service and account type, and who will check the result. Be specific: “draft a generic meeting agenda” is different from “summarize a folder of identifiable client records.”
Start with a fictional example. If that demonstrates the benefit, you can evaluate the tool before transferring real client material.
Check permission before uploading
Review your organization’s approved tools and data-handling rules. Identify who can authorize the proposed use. An individual subscription should not be treated as organizational approval.
An NDA may be relevant, but the fact that one exists does not answer every question about external processing. Ask the responsible reviewer what the actual agreement permits, whether additional authorization is needed, and which restrictions apply.
Ask the vendor concrete questions
- Which company receives and processes the information?
- What access do staff, contractors, and other service providers have?
- What is retained, for how long, and with what deletion exceptions?
- What use of inputs and outputs for model development is permitted?
- What controls apply to shared workspaces and connected applications?
- What incident-reporting and support process is available?
The NCSC’s discussion of language-model risks emphasizes understanding service terms, provider access, and handling of sensitive organizational data. Product labels alone do not resolve those questions.
Use the smallest appropriate input
Ask whether a template, fictional example, or limited extract would meet the purpose. Removing a client’s name does not necessarily remove identifying details from the rest of a file.
For example, a generic response outline can be drafted first. An authorized person can add the real names and case-specific facts afterward within the organization’s approved process.
Assign responsibility for the result
Decide who will verify factual claims, calculations, references, and any commitments before the output reaches a client. Do not assume an AI-generated summary faithfully includes every important qualification in the source.
Use a short review record: task performed, approved tool, information used, checks completed, and unresolved questions. Adapt the record to your organization’s requirements; this is a suggested working aid, not a prescribed compliance form.
Make a plan for mistakes
Know whom to contact if material is uploaded to the wrong service or an output exposes information. Use the organization’s incident process promptly. Do not assume deleting the visible chat resolves the issue or removes the need to report it internally.
For client communications, describe the actual use of AI and the actual checks. Avoid promising that a workflow is error-free, fully anonymous, or compliant with every law without a basis for those statements.
A useful next step
Take one proposed task to the responsible approver with a fictional sample and your unanswered questions. A clear, narrow request is easier to evaluate than a request to use AI for everything.
For a low-stakes practice exercise, use our minimal-sharing personalization guide.
Reviewed October 2, 2026. Featured photo: Redd Francisco / Unsplash; illustrative photo.
AI disclosure: This article was drafted and revised using AI. Read our full disclaimer.
