Free preview. This lesson is part of a paid course that earns the ETA Specialist: AI for Professional Services credential. About this course
Confidentiality, competence and supervision
In this lesson you'll
- Apply confidentiality, competence and supervision duties to AI tools
- Decide when client consent or notice is needed before using AI on client work
- Set client data rules for your practice's AI tools
Welcome
Welcome to AI for Professional Services from the Enterprise Technology Association (ETA). Professional services firms sell judgment and trust. That makes AI both an opportunity and a test: it can take hours off research and drafting, and it can also put a client's confidential information in the wrong place or a fabricated source in a client's hands. This course assumes you've completed Level 1: Foundations of the ETA Certified AI Empowered Professional.
- Step 1: Assess
Is this a good task for AI, and what's at stake?
- Step 2: Direct
Brief the AI clearly: goal, context, constraints, done criteria.
- Step 3: Assure
Check the output before you rely on it.
- Step 4: Protect
Keep people, data and your organization safe.
- Step 5: Tune
Iterate, then save what works for next time.
Use the steps in order on every task, and loop back to Tune when results fall short.
Your duties don't change because the tool did
Most professions already have duties that apply directly to AI. The American Bar Association's Formal Opinion 512 (July 2024) is a clear worked example for lawyers, and its logic fits most professions:
- Competence. Understand the tool well enough to use it responsibly: what it's good at, how it fails, and how to check it.
- Confidentiality. Protect client information. The opinion says that before putting client confidential information into a generative AI tool that could expose it to others (for example, a tool that learns from inputs), a lawyer generally needs the client's informed consent, and boilerplate in an engagement letter isn't enough.
- Communication. Tell clients about AI use when it matters to them or when they ask.
- Candor and accuracy. You're responsible for everything you submit or deliver, including errors an AI introduced.
- Supervision. Managers must set policies and train and supervise the people (and tools) doing the work.
- Fees. Charge reasonable fees; don't bill for time the tool saved or for time spent learning a general tool.
Accountants, engineers, consultants and others have parallel duties in their own codes and contracts. Check your profession's guidance and your client contracts, which often include confidentiality and data handling terms stricter than the law.
Client data rules
Passwords, access codes, security keys and other credentials
- Personal information
Social Security numbers, birth dates, home addresses, personal phone numbers
- Health information
Diagnoses, medical leave details, patient records
- Financial account details
Bank and card numbers, individual pay records
- Student records
Grades, discipline and other student information
- Confidential business and client information
Unreleased results, pricing, contracts, legal matters, anything under a confidentiality agreement
Some organizations approve specific tools for some of this data. That decision belongs to your organization, not to you. If you're unsure, treat it as off-limits and ask. You rarely need real details: redact, substitute or generalize.
| Usually OK in an approved, firm-controlled tool | Ask first (client consent or contract check) | Never |
|---|---|---|
| Public information, your firm's own templates and know-how, anonymized examples | Client documents, deal and matter details, financial records, anything under NDA | Client data in personal or public AI accounts; data a client contract forbids sharing with third parties; privileged material outside approved tools |
Workplace example: a 25-person accounting firm
A senior associate wanted to use AI to draft a client's management letter from the audit file. The firm's AI tool was approved, but the client's engagement terms limited sharing data with third-party processors. The engagement partner asked the client, explained how the tool handled data, and got written consent. The draft took half the time; the partner reviewed every finding.
Try it
Write your practice's client data rules for AI in your approved tool, then check them yourself:
Goal: Draft a one-page client data policy for AI use in our [type of] practice.
Context: We use [tools]. Our clients include [types]. Our profession's guidance includes [e.g. ABA Formal Opinion 512 or your code].
Audience: Our professionals and staff.
Constraints: Three columns: OK, ask first, never. Include when to get client consent and who decides. Don't state rules as legal advice; mark anything uncertain "confirm with [risk/ethics lead]."
Format: A table and 5 bullets.
Done criteria: Every rule can be checked by the person doing the work.Review the draft with your risk, ethics or compliance lead.
Key takeaways
- Existing professional duties (competence, confidentiality, communication, accuracy, supervision, fees) apply directly to AI.
- Client confidential information goes only into approved tools, with consent where required; check client contracts.
- Write client data rules as OK, ask first and never, and have your risk or ethics lead review them.
Sources