Engagement letter AI clause: what to tell clients in Ireland

No Irish rule requires an engagement letter AI clause. In November 2025 the Law Society of Ireland said that honesty with clients does not oblige anyone to volunteer that they use generative AI. The Chartered Accountants Ireland Code of Ethics says nothing to the contrary. Italy went the other way: since October 2025 its Law 132/2025, Article 13 has required professionals to tell clients about the AI systems they use.

Still, three Irish texts point towards a clause. The same Law Society guidance invites solicitors to mention AI in the letter that sets out their terms. Article 13 of the GDPR asks who receives a client’s data, and an AI provider becomes a recipient as soon as a draft with the client’s details is pasted in. And an accountant needs proper and specific authority before confidential information goes outside the practice.

All three are easiest to meet in one place: the terms of business or letter of engagement the client already gets. This guide takes each Irish source in turn, then sets out a numbered clause for Irish terms. Its data paragraph comes in two versions, depending on whether identifiers come out before a tool sees the text. The rest of what AI means for a firm is on our page for Irish solicitors.

Is there a duty to tell Irish clients about AI?

Start with what binds. The Law Society writes its guidance against the Code of Conduct, formally the Solicitors’ Guide to Professional Conduct. Its fourth edition dates from 2022, before the wave of generative tools, and doesn’t mention AI at all. But it describes the client relationship in some detail, and that is where the clause will live.

The Guide recommends giving the client the firm’s terms and conditions of business when instructions are taken. Ideally they come with written confirmation of what the solicitor understands the instructions to be. There is no obligation to have the terms signed, though it is good practice. A client who gets them by email should be asked to acknowledge receipt.

The court is a separate question

Telling the court is governed by different texts. Since 1 September 2026 a High Court practice direction has asked for declarations on affidavits and witness statements. Our guide to Practice Direction HC 142 covers who has to be told in the courtroom. None of that decides what goes into a letter to your own client.

The AI Act is the other text people reach for, and the Law Society’s guidance itself points to Article 50 as a possible source of disclosure duties. That article is aimed at systems that deal with people directly, and at certain generated content. So it catches a chatbot on the firm’s website, not an advice letter a solicitor has revised and signed. The detail is in our reading of the AI Act for Irish businesses.

Why a clause anyway

Two things push a careful firm to write something down. First, a client can simply ask, and the Law Society’s guidance treats a specific request differently from silence. Second, data. In most practices some client information will reach an AI provider sooner or later. That brings in the GDPR and, for accountants, the Code of Ethics.

1. Has the client asked whether you use AI?

   YesAnswer accurately. The Law Society's guidance ties the duty to disclose to a specific request.

   NoGo to the next question.

2. Has the firm adopted the Law Society's AI use policy template?

   YesTell clients where AI materially contributed to a deliverable, and mention AI in the privacy notice.

3. Will client personal data reach an AI provider?

   YesAdd AI providers to the recipients in the data protection notice, under Article 13 of the GDPR.

4. Does the draft name people who signed nothing: neighbours, employees, siblings?

   YesTheir identifiers come out before the paste. The client's signature doesn't cover them.

5. Is it a family law file?

   YesNot even the client's consent opens it to a third party. Keep it out of the clause and decide it under the family law guide.

6. Are you a chartered accountant sending confidential information outside the firm?

   YesYou need proper and specific authority, R114.1(d). The letter of engagement is the natural place for it.

7. Does the practice act as the client's processor, as on a payroll?

   YesThe client's prior written authorisation under Article 28(2) of the GDPR: clause 9.6.

8. Will the tool be billed to the client as an outlay?

   YesIt goes in the section 150 notice like any other cost.

None of them: there is no duty to volunteer it, but the guidance suggests a mention in the terms and conditions letter.

A written clause deals with the request and the data before anyone asks. It turns an awkward conversation into a paragraph the client read before the work started.

Two Law Society documents, and what each says about the client

The Law Society has put two documents in front of solicitors, and they don’t say quite the same thing. The first is its guidance on generative AI, announced on 12 November 2025. The second is an AI use policy template, published in its Practice Essentials toolkit for firms to adopt.

Neither is legislation, and the guidance says expressly that it creates no new rules for solicitors. But both will be read against the firm if its use of AI is ever questioned. So the clause should match whichever of the two the firm has chosen to follow.

The guidance: honest, not obliged

The guidance has a short section on communications with clients and other solicitors. It asks solicitors to be transparent about why they use these tools. And it says they “should consider referring to the use of GenAI tools in their terms and conditions letter to clients”.

Then it draws the line: “the duty of honesty does not create a positive obligation to disclose GenAI use”. Its comparison is with service providers and IT maintenance, which nobody lists for a client unless specifically asked. Disclosure required by the AI Act or otherwise is an exception it leaves outside its scope.

The template: a note on the work

The policy template is written for the firm’s own staff, and its internal rules are a subject for our AI policy template. Two passages face outwards. Its transparency principle says clients must be informed where AI has materially contributed to a deliverable or decision. And section 7.2 commits the firm to telling clients where AI helped prepare a deliverable or advice.

The template’s guidance note keeps this proportionate. Grammar checking needs no disclosure; substantive work gets a short footnote or cover note. Data subjects must also be told about the firm’s use of AI in its privacy notice. The staff card at the back puts it simply: if the output goes to a client, disclose it.

	the guidance (November 2025)	the policy template
what it is	professional guidance	a policy for the firm to adopt
duty to tell the client	none, unless the client asks	yes, where AI materially contributed
where	the letter of terms, to be considered	the deliverable, and the privacy notice
routine tasks	not addressed	no disclosure needed

Source: the Law Society’s GenAI guidance for solicitors, page 13 of the PDF; its AI use policy template, sections 4.1, 5.1 and 7.2.

Reading the two together

The two are less at odds than they look. The guidance sets the minimum a solicitor owes as a matter of conduct. The template sets what a firm that adopts it promises itself. A firm that takes on the template has chosen the stricter rule, and its clients are entitled to expect it to follow its own policy.

For a firm that hasn’t adopted it, the clause is still the cheapest way to act on the guidance’s suggestion and be ready for the client who asks. The template’s sample line for a deliverable sits comfortably alongside it. That line is one sentence saying AI tools assisted, naming who reviewed the result.

Article 13 of the GDPR: who receives the client’s data

The second strand is data protection, and it runs whatever the Law Society says. A draft affidavit pasted into a chatbot hands the provider personal data. Article 4(9) of the GDPR defines a recipient, and the definition is deliberately wide. It covers anyone to whom data are disclosed, “whether a third party or not”. So an AI provider working for the firm under contract still counts.

Irish firms usually meet Article 13 with a data protection notice sent alongside the terms of business. Point (e) of Article 13(1) requires that notice to state the recipients or their categories. It speaks as of the moment the data are obtained. A notice drafted before anyone in the firm used AI may simply be out of date.

A firm acting in a dispute is the controller

The European Data Protection Board’s guidelines on controllers and processors use a law firm as a worked example. A company hires a firm to represent it in a dispute. The firm decides what information to use and how, with no instructions from the client about the processing. That makes it the controller.

Being the controller makes the notice the firm’s to get right. Where the provider stores or processes data outside the EEA, point (f) adds the transfer and the safeguard it relies on. That detail has to come from the provider’s own terms, not its marketing. Which AI tools can meet the GDPR sets out what each provider’s processing terms need to contain.

When only markers reach the provider

Taking identifiers out first shrinks what the provider sees, but it doesn’t take the provider off the recipients list. Recital 26 treats pseudonymised data as relating to an identifiable person where extra information can reattribute it. The firm keeps exactly that information. Whether pseudonymised data is personal data looks at the question from the provider’s end.

What the client’s signature on the letter cannot authorise

Irish professional conduct treats the client’s consent as a real key. The Code of Conduct lists three routes by which a solicitor may disclose a client’s affairs: the client’s consent, a court’s direction, or a body exercising statutory powers. On that reading, a client who agrees in writing to AI assistance has opened one of the three.

The difficulty is whose affairs are in the draft. An affidavit in a boundary dispute names the neighbours. A set of management accounts lists staff salaries. A probate file sets out what each sibling inherits. Article 14(5)(d) of the GDPR spares the firm from writing to those people where professional secrecy requires their data to stay confidential. But that is a rule about notices, not about what may be sent.

Neighbours, employees, siblings: people who signed nothing

The exemption doesn’t license the paste. For third parties, what the firm controls is what goes into the prompt. Their PPS numbers, Eircodes and account details can come out, or the task can stay off the tool altogether. Our PPSN guide covers which identifiers to strip from an Irish file first. Chartered accountants will know the same test from 114.1 A2 of their Code: could others be harmed even where the client consents?

Family law files and the in camera rule

One category needs particular care. The Code of Conduct says a solicitor must not disclose the contents of a family law file to any third party, even with the client’s consent. The only exceptions are limited statutory ones and a court order. So the client’s signature is the one thing that cannot make an AI tool acceptable for that file.

The Law Society’s own safe use guide for family law came out in its Practice Essentials toolkit in 2026. It allows client personal data only in enterprise tools with a data processing agreement, and expects a DPIA where the case is sensitive. Our reading: keep family files out of the clause, and decide them under that guide instead.

Telling the client, or asking for authority

Set against the Law Society’s two documents, these limits show the letter doing two jobs. It tells the client how the firm works, and it asks for authority where authority can be given at all.

	telling the client	asking for authority
what brings it in	the guidance’s suggestion, or a client who asks	client data or confidential information leaving the firm
the source	Law Society guidance; section 7.2 of the template, if adopted	the Code of Conduct on consent; R114.1(d); Article 28(2)
what is enough	a paragraph in the terms, a line in the notice	authority that says what goes, to whom and why
where it goes	terms and conditions letter; data protection notice	letter of engagement
signature	not obligatory, but good practice; ask for receipt of emailed terms	prior written authorisation, where the firm is a processor
who it covers	the client who receives the letter	only the client: not third parties, never a family law file
our wording	9.1 to 9.3, and 9.5	9.4B and 9.6

Sources: Law Society GenAI guidance, page 13; AI use policy template, section 7.2; Code of Conduct, pages 21 and 22 (terms), 52 (consent) and 58 (family law); Code of Ethics, R114.1(d); GDPR, Article 28(2).

The right-hand column is where accountants start.

Accountants: the letter of engagement as proper and specific authority

For a chartered accountant the starting point is different, because the Code of Ethics is written in terms of authority. Paragraph R114.1(d) says an accountant shall not disclose confidential information acquired through professional relationships outside the firm without proper and specific authority. The exception is a legal or professional duty or right to disclose.

The Code also lists disclosure that is permitted by law and authorised by the client among the cases where disclosure may be appropriate. A general AI provider is outside the firm. Our reading is that the letter of engagement is the natural place to give that authority in writing, and to be specific about what it covers.

What the Institute’s August guide expects

Chartered Accountants Ireland published a concise guide on the ethical use of AI in August 2026. Before that, in February 2025, CCAB-I (meaning your Institute and ACCA) issued an alert on AI policies. The table sets what each one asks next to the Code.

text	what it asks of the member
Code of Ethics, R114.1(d)	proper and specific authority before confidential information leaves the firm
the Institute’s concise guide, August 2026	AI systems that comply with contractual commitments, engagement letters included; no client information in a publicly accessible tool without consent
CCAB-I alert, February 2025	no data put in that breaches a duty of confidentiality; a disclaimer where content is generated by AI

Sources: Code of Ethics, R114.1(d); The Ethical Use of AI Technologies, pages 7 and 13; CCAB-I Technical Alert 01/2025, pages 4 and 5.

The guide adds that a member should be able to explain what the tool does, what it is used for, its limits and how outputs are reviewed. Of the three, the alert is the bluntest.

Payroll bureaux and Article 28(2)

Payroll is the clearest case of an Irish practice acting as the client’s processor. The EDPB’s guidelines give a payroll administrator as their example of a processor, working to the employer’s instructions on whom to pay, how much and when. Bookkeeping and accounts preparation can fall on either side. It depends on how tightly the client directs the work. The payslips such a bureau handles often carry a union deduction, which reveals membership the GDPR treats as special.

When the practice is the processor, the AI provider becomes a processor of a processor. Article 28(2) of the GDPR then puts the decision with the client: prior written authorisation, specific or general. Under a general one, the client has the right to hear of changes and object. A clause in the letter of engagement is the tidiest place to hold that authorisation. The practice side is on our page for Irish accountants.

The terms and conditions letter, the section 150 notice and the bill

Irish solicitors usually send two documents at the start of a matter, and it matters which one carries the AI paragraph. The terms and conditions of business describe the relationship; the Law Society introduced its precedent for them in September 2012. The notice under section 150 of the Legal Services Regulation Act 2015 is about money.

Section 150 requires a notice, in clear language, disclosing the legal costs or the basis on which they will be calculated. The AI paragraph belongs with the terms of business, or in the letter of engagement that goes with them. That is where the Law Society’s guidance points. The costs notice only needs to hear about AI if AI changes the costs.

document	what it is for	does AI belong in it?
terms and conditions of business	the relationship and how the work is done	yes: the notice and the data paragraph
section 150 notice	legal costs, or how they are calculated	only if a tool is billed as an outlay
data protection notice	GDPR Article 13 information	yes: AI providers among the recipients

Sources: Code of Conduct, pages 21 and 22; Legal Services Regulation Act 2015, section 150; GDPR, Article 13(1)(e).

When AI becomes a cost the client pays

Legal costs include outlays as well as fees. So a paid AI service charged to a matter goes in the notice like any other cost. In litigation, section 150(6) goes further. Before engaging a provider of any other service, the solicitor must, where practicable, give the client its likely cost and be satisfied the client approves. Our reading is that a paid AI review service engaged for the case falls within it.

A general subscription paid whatever the matter is an overhead. It doesn’t appear in the notice, and nothing in section 150 requires it to. If the firm’s costs later turn out significantly higher than disclosed, section 150(5) requires a new notice, whatever the reason. Which licence a firm actually holds is a question for our solicitors’ page.

Hours saved, hours billed

Some clients ask a sharper question: if AI drafted it in minutes, why am I paying for hours? Where time is the basis of charge, the Code of Conduct recommends keeping the client informed of the time spent. And a Legal Costs Adjudicator assessing a bill looks at the time and labour reasonably expended.

Nothing obliges a firm to pass efficiencies on as lower fees, and the clause needn’t pretend otherwise. Clause 9.3 below simply says the firm charges for time actually spent. That is the whole answer, and it reads better in the terms than in a reply to a complaint.

The engagement letter AI clause, drafted for Irish terms of business

The Law Society chose a simple format for its own precedent in 2012: a short introductory letter, with the terms attached as a separate document. The wording below is a numbered clause for that attached document. Renumber it to suit, and align the defined terms (the Firm, you, the Matter) with your own document. We have not found a Law Society or Institute precedent that yet includes an AI clause.

Use either 9.4A or 9.4B, not both. Clause 9.5 goes in the data protection notice rather than the terms, and 9.6 is only for work the Firm does as the client’s processor. For a practice, read “the solicitor responsible for the Matter” as the engagement partner.

Clauses 9.1 to 9.3: telling the client

Clause 9 opens with the heading and three paragraphs that every client gets.

Every client · The heading

9. Technology, including artificial intelligence

Every client · What the Firm uses

9.1 The Firm uses a range of technology in providing its services. This may include artificial intelligence tools. We use them to assist with [preparing first drafts, summarising documents, translating correspondence and checking text for errors].

Every client · Who stands behind the work

9.2 Artificial intelligence tools are not a source of advice to you, and no decision on the Matter is left to them. The solicitor responsible for the Matter reviews anything prepared with their assistance before it is relied on or sent to you. The Firm's responsibility for that work is no different from its responsibility for any other work done on the Matter.

Every client · Your instructions, and our charges

9.3 You may instruct us in writing that artificial intelligence tools are not to be used on the Matter, or on documents you specify, and we will comply with that instruction. Where our charges are calculated by reference to time, we charge for the time actually spent.

Clause 9.1 opens with technology in general for a reason. The Law Society’s guidance compares AI with the service providers and IT arrangements a firm doesn’t normally list. A clause that starts from technology puts AI where the guidance puts it. Clause 9.2 restates what the guidance already expects: the solicitor takes full responsibility for anything built on a tool’s output, and must be able to explain the reasoning.

Clause 9.3 goes beyond anything Irish guidance requires. The Law Society ties the duty to disclose to the moment a client asks. This clause gives the client a way to ask at the start, on paper, rather than by phone halfway through a matter. Its second sentence is for firms that bill by time, and can go if yours doesn’t.

Clause 9.4A or 9.4B: the data paragraph

The data paragraph comes in two versions. Pick the one that matches what the firm actually does, and delete the other.

Version A · Identifiers out before any tool is used

9.4A Before any part of a document or communication relating to the Matter is entered into an artificial intelligence tool, the Firm removes or replaces, on its own computers, information that identifies you or any other person. This includes names, PPS numbers, dates of birth, addresses and Eircodes, bank account details and the Firm's file references. The Firm then checks the remaining text for details from which a person could be identified. The information needed to reverse those replacements does not leave the Firm's systems.

Version B · Client information in an enterprise tool

9.4B The Firm may enter information relating to the Matter, including personal data about you and other people, into [name of tool and licence], provided by [provider and address]. The provider processes that information on the Firm's behalf under a written agreement. That agreement requires it to keep the information confidential, to use it only to provide the service to the Firm[, not to use it to train its models,] and to retain it for [no longer than [period] / no longer than is needed to respond to each request].

[Where applicable:] The provider may process the information in [country]. The transfer relies on [an adequacy decision / standard contractual clauses], and you may ask us for a copy of the relevant safeguard.

The Law Society’s list of appropriate safeguards ends with running AI locally, or in a secured environment the firm controls. Clause 9.4A doesn’t claim that, because the model still runs elsewhere. What it does is keep the step that matters most, taking identifiers out, inside the firm’s own environment. The words “on its own computers” carry the clause. If a firm’s redaction happens in a web service, 9.4A is not available to it.

The list names PPS numbers and Eircodes because they are the Irish identifiers most likely to sit in a draft unnoticed. The first is on almost every payroll, tax and welfare file; the second is on every conveyancing and probate file. The clause is also careful about what it doesn’t say. The substance of the Matter still reaches the provider, and a client who later saw an actual prompt should find 9.4A accurate.

What the brackets in 9.4B ask for

The brackets in 9.4B are the first two safeguards on the Law Society’s list, turned into statements the client can rely on. One is a contract obliging the provider to keep the data confidential, ideally with nothing retained. The other is an agreement confining its use to the firm’s purposes. Filling them in is the due diligence the guidance asks for, done once for each tool and licence.

If the brackets can’t be filled, the firm has its answer. In the guidance’s view a consumer account, even a paid one, is not by default a safe place for client confidential material. And a consumer plan won’t produce the agreement 9.4B describes. Which plans do, and on what terms, is covered for ChatGPT, Claude, Gemini and Microsoft Copilot.

Clauses 9.5 and 9.6: the notice, and processor work

The last two paragraphs are for a particular document and a particular kind of work.

9.5 · In the data protection notice

[In the list of recipients in the Firm's data protection notice:] Providers of technology services to the Firm, including providers of artificial intelligence tools, who process personal data on the Firm's behalf and under its instructions[; a current list is available on request / at [web address]].

9.6 · Only where the Firm acts as your processor

9.6 Where the Firm processes personal data on your behalf and on your instructions, for example in operating your payroll, you give the Firm general written authorisation, for the purposes of Article 28(2) of the GDPR, to engage [providers of artificial intelligence tools / [named provider]] as further processors. The Firm will notify you of any intended addition or replacement of such a provider [at least [number] days] before it takes effect. You may object within that period.

Many Irish firms’ notices already name IT service providers among the recipients. Whether that category is precise enough once client data goes to an AI provider is arguable. Adding the words in 9.5 costs nothing, and it keeps the notice consistent with 9.4.

Clause 9.6 is the only one the law requires, and only in a particular situation. For a chartered accountant it also does the work of R114.1(d), because it is specific about who receives the data and why. Pick a notice period the practice can actually honour. A practice that changes tools with a week’s notice to a hundred payroll clients needs a way of handling the objections Article 28(2) entitles them to make.

Wording the clause should never contain

Irish clients tend to read terms of business closely on the day something goes wrong. These five phrases turn up in AI wording because they sound reassuring. Each one fails against a source the firm would have to answer to.

the phrase	the source against it	why it fails
“Your data is anonymised.”	Chartered Accountants Ireland’s AI guide	“anonymisation may not by itself eliminate confidentiality risks” where people could be reidentified; and markers the firm can reverse are pseudonymisation anyway
“Our AI tools are secure and fully compliant.”	the Law Society’s guidance	never assume even an enterprise tool guarantees compliance; the firm can describe its terms, not certify its supplier
“Your information never leaves the Firm.”	the clause itself	under 9.4B it does, by design; under 9.4A the substance of the Matter still goes
“You consent to any use of AI on your Matter.”	R114.1(d); the in camera rule	authority has to be specific, and consent has limits a blanket phrase ignores
“We keep a full record of everything entered into AI tools.”	the Law Society template	only if it is true and someone checks it; record keeping belongs in the internal disclosure rules, not in a promise to the client

Sources: The Ethical Use of AI Technologies, page 13; Law Society GenAI guidance, page 6; Code of Ethics, R114.1(d); Code of Conduct, page 58; AI use policy template, section 7.1.

None of this helps once client data has reached a tool it shouldn’t have. What to do after client data goes into ChatGPT is a separate exercise.

Clause 9.4A in practice, and Nonimo’s part in it

Clause 9.4A asks a fee earner to do something tedious every time: find each PPS number, Eircode and IBAN in a draft and take it out before pasting. A firm that adopts it needs a way of doing that which doesn’t depend on concentration at six in the evening. Nonimo was written for that step, and only that step.

It installs on each Windows or Mac computer in the practice. The user selects the text and presses one key. Identifiers such as the PPS number, the IBAN and a date of birth become labelled markers, and the real values go back in when the reply returns. The mapping between markers and values is held on that computer, which keeps the words “on its own computers” in 9.4A true.

Nonimo is software the firm uses, so it has no place in the wording of 9.4A, which describes the firm’s own practice. It can’t tell whether a phrase like the only dentist in Dingle identifies the client, so the check for contextual detail that 9.4A promises remains a human one.

What the app keeps is set out on the security page: the map between markers and values stays encrypted on that computer. The evidence behind 9.4A is the firm’s own practice, written down in its terms.

Sources

• Law Society of Ireland, Guidelines for the Use of Generative Artificial Intelligence by the Legal Profession in Ireland. Announced on 12 November 2025 (Gazette); the PDF edition is dated December 2025 and the text is also on the Society’s website. Page 6: consumer versions not suitable by default for client confidential data, and never assume an enterprise tool guarantees compliance; page 8: the solicitor takes full responsibility for work built on a tool’s output; page 10: no new rules or obligations, refrain from entering client data without appropriate safeguards, and the four safeguards (confidentiality with zero data retention, a data protection agreement, technical settings, local or firm controlled environments); page 13: transparency about reasons, “should consider referring to the use of GenAI tools in their terms and conditions letter”, no positive obligation to disclose unless specifically asked, and footnote 26 on Article 50 of the AI Act.
• Law Society of Ireland, Artificial Intelligence (AI) Use Policy, template for law firms (PDF, Practice Essentials). Section 4.1, transparency principle; section 5.1, informing data subjects in the privacy notice; section 7.1, internal disclosure and recording methodology; section 7.2 and its guidance note, external transparency, proportionate disclosure and the sample line for a deliverable; Appendix B, question 4.
• Law Society of Ireland, Safe Use Patterns by Practice Area (PDF, Practice Essentials: AI, updated 2026). Family law card: client personal data in enterprise tools only, with a data processing agreement; DPIA for sensitive cases.
• Law Society of Ireland, Solicitors’ Guide to Professional Conduct, 4th edition, 2022 (PDF). Pages 21 and 22: terms and conditions of business recommended, signature not obligatory but good practice, acknowledgement of receipt when sent by email, summary of sections 149 to 152; page 23: keeping the client informed of time spent; page 52: disclosure only with the client’s consent, a court’s direction or a statutory body; page 57: service providers and limited access to client data; page 58: family law files and the in camera rule.
• Law Society of Ireland, practice note on terms and conditions of business, 7 September 2012 (lawsociety.ie). Introduction of the precedent, its purpose, and its format of a simple introductory letter with a document attached.
• Legal Services Regulation Act 2015, section 150 and Schedule 1 (section 150, revised; Schedule 1). The notice in clear language; costs or the basis of calculation; subsection (5), new notice; subsection (6), providers of other services in litigation; Schedule 1, paragraph 2(c), time and labour reasonably expended.
• Chartered Accountants Ireland, Code of Ethics (Parts 1 to 4 in force from 1 March 2020, PDF; status on the Institute’s Code page). R114.1(d), proper and specific authority; 114.1 A1(b), disclosure permitted by law and authorised by the client; 114.1 A2, harm to third parties even where the client consents.
• Chartered Accountants Ireland, The Ethical Use of AI Technologies: a concise guide for Members, August 2026 (PDF). Page 7: compliance with contractual commitments, engagement letters included; page 13: using AI without client consent as a threat to confidentiality, and anonymisation that may not by itself remove the risk of reidentification; page 15: failing to disclose AI use where required; page 17: what a member should be able to explain.
• CCAB-I, Technical Alert 01/2025, Pointers for a firm’s Artificial Intelligence policy, February 2025 (PDF). Page 4: data put in must not breach a duty of confidentiality; page 5: prohibition on personal or sensitive data, and a disclaimer where content is generated by AI.
• Regulation (EU) 2016/679, the GDPR (EUR-Lex). Article 4(9), recipient, whether a third party or not; Article 13(1)(e) and (f), recipients and transfers, at the time data are obtained; Article 14(5)(d), professional secrecy; Article 28(2), authorisation of another processor; recital 26, pseudonymised data.
• European Data Protection Board, Guidelines 07/2020 on the concepts of controller and processor in the GDPR, version 2.1, adopted 7 July 2021 (EDPB). Page 12: the law firm example; page 15: the payroll administrator as processor; pages 15 and 16: accounting firms, controller or processor depending on instructions.
• Italy, Law 132 of 23 September 2025, Article 13 (Normattiva). The duty on professionals to tell clients about the AI systems they use.