This is one of the most common questions we are asked, and one of the least well answered. The good news is that it is really three separate questions. Two of them have short answers, and the third is the one worth thinking about properly.
The question usually arrives in one piece. Do we have to tell people we are using AI? Underneath it sit three questions that have very little to do with each other, and they get muddled together constantly. Pulling them apart removes most of the worry, and leaves you with one genuinely interesting decision to make.
Some sectors have rules about this. Some do not. Whether anything applies to you depends on what you do, who regulates you, and where your customers are.
That is not us being evasive. It is that anything we said would be a guess, and a guess from us is worth nothing on the day somebody asks you to justify your position. Your regulator, your professional body or your solicitor is the authority here. We are not.
If you work in a regulated field, the guidance you already follow on outsourcing, supervision and record-keeping is usually the sensible place to start looking. AI tends to get treated as a new version of those familiar questions rather than as something entirely separate. Ask the people who write your rules. It is normally a short conversation, and it settles the matter properly rather than leaving it hanging.
Whatever the answer turns out to be, ask once, get it in writing, and file it. Most of the discomfort businesses carry around on this comes from not knowing, not from what the answer actually is.
This second one is quieter, and it catches people out far more often. You may have already agreed to something.
Look at the agreements you have signed. Confidentiality clauses. Data processing terms. Supplier agreements, tender responses, framework contracts with larger organisations. Some of them contain wording about subcontracting, about where information may be processed, or about notifying the other side when your working methods change. Wording drafted long before anyone was thinking about AI can still apply to it perfectly well.
This is a job you can do yourself, and it is much better done before anyone asks. Search your signed agreements for the words that matter — confidential, subcontract, process, notify — and read what you actually promised. You will either find that you are fine, which is a good afternoon’s work, or you will find exactly which conversation you need to have and with whom. Either outcome beats wondering.
The test people reach for first is: did AI touch this? It is the wrong test. Within a couple of years the answer will be yes to almost everything, in the same way that the answer to “did a computer touch this” is yes to almost everything now. A test that returns the same answer every time is not telling you anything.
Nobody expects to be told a spellchecker was used. Nobody expects a note explaining that a search box helped find the right document, or that a calculator did the arithmetic. Those tools do not change what the work is, and they do not change who stands behind it.
So use two better questions instead. Would the person receiving this be surprised to learn how it was made? And if they were surprised, would they mind?
The test is not whether AI touched the work. It is whether the person would be surprised, and whether they would mind.
That gives you usable answers quickly. AI drafting a first version of a routine letter that you then read, correct and sign: nobody is surprised, nobody minds. AI reading through two hundred pages and pulling out the points that matter so a person can look at them properly: most people would be pleased, because it means more attention went to the part that needed a human. AI producing the substance of the advice itself, passed straight on without anyone checking it: that is a different thing entirely. That is something people would want to know, and finding out afterwards is always worse than being told at the time.
Most businesses do not need a policy document for this. They need one or two sentences they are comfortable saying to anyone who asks, and which are true.
Something close to this usually works: we use AI to prepare and to gather — first drafts, summaries, finding things, doing the groundwork. A named person checks it, and that named person is responsible for everything that leaves here. Their name is on it.
If that is an accurate description of how you work, say it. Put it on your website. Put it in a proposal. Use it when someone asks. There is no need to label every document individually if the general position is clear, stated and honest.
And being able to say it plainly is turning into an advantage rather than a risk. More buyers are asking the question, and more tender documents include it. A business that answers in one clear sentence sounds like it has thought about it. A vague answer, or a pause, invites exactly the follow-up questions you would rather not have.
What we cannot tell you is whether your regulator wants more than that. That part is genuinely theirs to answer. What we can do is help you get the working practice right underneath it, so that whatever you decide to say is true, and stays true.
If disclosure is the specific worry, two companion pieces go further: what actually determines whether client information is safe to put into AI, and the one rule worth having in place before anything else. Working through what a position like this actually costs to put in place, in your own business, is what the audit covers.
If you want the practice in place before the question comes up, that is what doing it safely covers.
Twenty minutes on the phone, free, no obligation. We can talk through what a plain, honest position would look like for the way you actually work.