AI Disclosure to Clients: Consent and Wording

AI disclosure tells clients how your practice uses AI. Obtain their permission before client information goes to a third party, unless a legal duty permits disclosure.

Telling a client about AI and obtaining consent are separate actions. A notice explains what happens. Consent records the client’s agreement where permission is needed.

When You Must Tell Clients About AI

Obtain permission before disclosing information about a client’s affairs to a third party through an AI tool. Code item 6 applies even when the information is not personal information.

The TPB’s AI guidance recommends explaining who receives the information, where disclosure occurs and where it is stored. Explain whether AI tools are involved.

A signed engagement letter, separate consent or another communication can record permission. A general third-party authority can be acceptable, but compare its scope with the proposed use before relying on it.

For practices covered by the Australian Privacy Principles, assess the purpose of using personal information as well. Under APP 6, the original purpose can permit use without new consent.

A secondary purpose needs consent or another applicable exception. The reasonable-expectations exception requires a related purpose, or a directly related purpose for sensitive information.

The OAIC’s commercial AI guidance recommends clear privacy policies and notices explaining AI use. Collecting or generating sensitive information generally needs consent unless an exception applies.

Privacy permission and the TPB confidentiality rule need separate assessment. Satisfying one does not establish that the other is satisfied.

For example, a generic grammar request using invented text involves no client affairs. Uploading an actual client letter for rewriting requires a confidentiality assessment before upload.

Verbal or Written Consent

Verbal consent can be express consent. The OAIC’s consent guidance recognises oral and written agreement. Consent must be informed and voluntary. It must be current and specific, with the person able to understand and communicate their decision.

Written consent is easier to retrieve when a staff member needs to establish what the client accepted. A signature alone does not fix an explanation that leaves the client uninformed.

If you obtain agreement by phone, make a file note immediately. Record the person’s name and authority, the explanation supplied, questions answered and the precise permission given. Include the date and staff member.

Send the explanation and recorded agreement to the client afterwards. Retain the version they considered with the file note. This is a practical recordkeeping method, not a prescribed statutory form.

Silence after an announcement is not a reliable consent record. If permission is required and the client has not agreed, keep their information out of the proposed AI use.

Does Local AI Still Need Disclosure?

Local AI does not create an automatic exemption from disclosure. The TPB’s AI questions and answers says the answer depends on the services, use and implications for Code obligations.

The TPB recommends transparency for drafting and administrative uses. Confidentiality and privacy obligations continue regardless of where the AI runs.

Map what actually leaves the computer before calling a tool local. Check remote processing, support access and connected services. A desktop installation alone does not prove that information stays in the office.

Explain the actual arrangement to clients. A wholly internal use and a disclosure to an external provider need different wording. Do not describe an external service as local because staff access it from office computers.

AI Disclosure Statement Example

Use an AI disclosure statement that names the work and the information involved. The following fictional example assumes an approved external provider checks client forms. It is a drafting example, not legal advice.

Our practice uses an external AI service to help check answers in client forms for inconsistencies and missing information. The attached service details identify the provider and explain the information shared, storage arrangements and retention.

Our practice remains responsible for the services and advice we provide. Please read the service details before deciding whether to authorise the described disclosure. Contact the staff member handling your work with questions or to discuss another arrangement.

Attach real service details before using this wording. Explain whether the provider uses information for training and who can access it. Do not promise exclusions that the provider’s terms or settings do not support.

An AI consent form can use these fields beneath the explanation:

• Client name and the entities covered.
• Representative’s name and authority, where applicable.
• Named provider, approved purpose and categories of information shared.
• Reference to the service-details version supplied to the client.
• A separate decision to authorise or decline the described disclosure.
• Signature or other record of agreement, with the date.
• Contact method for questions or withdrawal of permission for future use.

Keep optional purposes separate. Permission to check a form does not automatically authorise training a model on the client’s documents.

Updating Existing Clients

Review existing engagement terms when AI changes service delivery or data handling. The TPB recommends considering updated terms and informing affected clients when the change is material.

1. List the proposed AI uses and the clients affected. Separate generic drafting from tasks that disclose client information.
2. Compare each use with the permission already held. Record why an existing authority covers it or identify the additional agreement needed.
3. Send the explanation before the changed use begins. Update the AI clause in the accountant engagement letter or use a separate consent where appropriate.
4. Record each client’s response. Give staff a visible way to distinguish authorised uses from refusals and unanswered requests.

If a client declines, agree on another way to deliver the work before proceeding. Before the first affected job, confirm that the file contains the correct explanation and permission for the actual use.