Responsible AI adoption: Managing accuracy, security and governance

The growing use of artificial intelligence presents significant opportunities for professional services firms, but it also introduces new risks.

Accountants and lawyers handle sensitive information and operate within highly regulated environments. Any use of AI must therefore protect client confidentiality, preserve professional standards and maintain clear accountability.

Responsible AI adoption is not simply a technology issue. It requires policies, controls, training and a clear understanding of how the tools will be used.

Understanding the risk of inaccurate information

Generative AI tools are designed to produce plausible responses based on patterns within data. They do not determine truth in the same way as a professional reviewing authoritative evidence.

As a result, AI can sometimes generate information that is incorrect, incomplete or entirely fabricated. These errors are commonly referred to as hallucinations.

The risk is particularly important in professional services because an AI-generated response may appear polished and convincing even when the underlying information is wrong.

Examples may include:

• Fabricated legal cases or references;
• Incorrect explanations of regulations;
• Inaccurate calculations;
• Invented quotations;
• Outdated technical guidance; or
• Conclusions that are not supported by the available evidence.

Professionals should therefore approach every AI output with appropriate scepticism.

Maintaining human review

AI-generated work should always be reviewed by someone with the knowledge and authority to assess it.

The level of review should reflect the level of risk. A draft internal agenda may require only a brief check, while a technical report or client-facing document will need detailed scrutiny.

Reviewers should ask:

• Is the information accurate?
• Has anything important been omitted?
• Are the sources reliable and current?
• Does the answer reflect the relevant context?
• Is the wording appropriate for the audience?
• Could the content create legal, financial or reputational risk?

Professional responsibility cannot be transferred to an AI platform. The individual or firm using the output remains accountable for the final work.

Protecting confidential information

Data security is one of the most important considerations when introducing AI.

Publicly available AI tools may use information differently from enterprise platforms, and users should not assume that every system provides the same protections.

Firms need clear rules about the information that may be entered into AI tools. Client names, personal data, commercially sensitive information and confidential documents should not be shared unless the platform has been approved for that purpose and the organisation is satisfied with the relevant security arrangements.

Before approving a tool, firms may need to consider:

• Where information is stored;
• Whether prompts are retained;
• Whether data is used to train the model;
• Who can access the information;
• Whether appropriate contractual protections exist;
• How the tool complies with data protection requirements; and
• Whether activity can be monitored or audited.

Using enterprise-grade tools may provide greater control, but fi rms must still understand how those products operate.

Bias and incomplete reasoning

AI-generated outputs may also reflect biases within the information on which the technology was trained.

This can affect the language used, the assumptions made and the conclusions produced. Bias may be particularly relevant where AI supports recruitment, risk assessment, investigations or decisions involving individuals.

Even where there is no obvious bias, an AI tool may produce an answer based on incomplete reasoning. It may focus on the most common interpretation rather than recognising an unusual but important exception.

Human oversight is necessary to identify these limitations and ensure that decisions are fair, proportionate and properly supported.

Developing an AI policy

A clear AI policy provides staff with practical guidance and reduces uncertainty about acceptable use.

The policy should reflect the nature of the organisation and the work it undertakes. It may cover:

• Which AI tools are approved;
• What information may or may not be entered;
• When client consent is required;
• How outputs should be reviewed;
• Which tasks are prohibited;
• How AI use should be documented;
• Who is responsible for oversight; and
• How incidents or concerns should be reported.

A policy should not be so restrictive that employees avoid using approved tools altogether. The aim is to create a safe framework within which people can use AI confidently.

Training teams to use AI responsibly

Technology and policies are only effective when employees understand them.

Training should explain both the opportunities and the limitations of AI. Staff need to know how to write effective prompts, protect confidential information and recognise unreliable outputs.

Training should also be relevant to the employee’s role. A marketing team may use AI differently from a forensic accountant, tax adviser or solicitor. Examples should therefore reflect the real tasks employees are likely to undertake.

Regular updates will also be necessary. AI tools and their capabilities are changing quickly, and guidance that is appropriate today may need to be revised in the future.

Creating an adoption strategy

AI adoption should be aligned with wider business objectives.

Before introducing a new tool, firms should identify the problem they are trying to solve. They should also consider the benefits, risks and resources required.

A structured adoption process may include:

• Identifying potential use cases;
• Assessing risk and business value;
• Selecting suitable tools;
• Creating policies and controls;
• Testing the technology with a limited group;
• Gathering feedback;
• Measuring results; and
• Expanding adoption where appropriate.

Starting with a pilot project allows a fi rm to identify practical issues before introducing the technology more widely.

Governance and accountability

Larger organisations may benefit from an AI working group or governance committee that brings together representatives from technology, risk, compliance, legal, data protection and operational teams.

This group can review proposed tools, monitor emerging risks and ensure that AI use remains aligned with the organisation’s policies.

Smaller firms may not need a formal committee, but they should still identify a person with responsibility for AI governance.

Clear accountability helps ensure that decisions are documented and that concerns are addressed promptly.

Keeping the strategy under review

Responsible adoption is an ongoing process rather than a one-off project.

Firms should regularly review:

• How employees are using AI;
• Whether the approved tools remain appropriate;
• Whether policies are being followed;
• Whether new risks have emerged;
• Whether the expected benefits are being achieved; and
• Whether further training is required.

Feedback from employees is particularly valuable. The people using AI in their day-to-day work are likely to identify both new opportunities and practical difficulties.

Combining innovation with professional standards

AI can support faster, more efficient professional services, but trust remains fundamental.

Clients need confidence that their information is protected, the advice they receive is accurate and qualified professionals remain accountable for the work.

The organisations that adopt AI successfully will be those that combine innovation with strong governance. By introducing the technology carefully, firms can improve productivity without compromising the standards on which their reputations depend.

Key takeaways

AI-generated information can be inaccurate or misleading, making professional review essential.

Confidential and personal information should only be processed through approved systems with appropriate security controls.

Firms need clear policies, role-specific training and defined accountability.

The strongest AI strategies balance efficiency and innovation with client confidentiality, professional judgement and effective governance.

This article is based on the webinar AI for accountants and lawyers – How professional services firms can improve performance, when Dr Stephen Hill, an AI trainer and consultant with more than 25 years’ experience in fraud, forensic accounting and digital investigations, explored how accountants and lawyers can adopt AI responsibly.

The session covered the latest AI tools, practical use cases, effective prompting techniques, emerging technologies and the governance considerations firms should address before implementation.