Documentation & Communication: Make AI Reviewable
Ethical AI use is not only about the output—it’s about whether your process is auditable. Good documentation lets another reviewer answer: “What did we feed the tool? What did it produce? What did we verify? Who approved it?”
What to document (minimum viable audit trail)
| Item | Why it matters | Example |
|---|---|---|
| Task classification | Shows risk-based controls | “Medium risk: internal draft memo; no client identifiers” |
| Tool used | Shows approved environment + settings | “Enterprise model; training disabled; retention 0 days” |
| Inputs | Confidentiality + reproducibility | “Document IDs 12–18; redacted names” |
| Prompt | Explains instructions and guardrails | “Summarize only; cite to page/line; if uncertain, say so” |
| Output version | Tracks changes | “Draft v2 after attorney edits” |
| Verification steps | Defensibility | “All citations opened; quotes compared; numbers recalculated” |
| Approver | Accountability | “Approved by A. Smith on 2026‑01‑26” |
Client communication: when to disclose AI use
You do not need to “announce AI” for every low-risk internal use. But you should consider client communication or consent when:
- The matter is high sensitivity (privilege strategy, trade secrets, regulated data).
- The tool is third-party hosted and requires sharing client information.
- The client has a policy restricting AI use, data transfer, or offshoring.
- AI use materially changes cost, timeline, or risk profile.
Sample internal note (copy/paste)
AI use note: On [date], [role] used [approved tool] to draft an internal summary based on [source]. No client identifiers were included. Output was verified by [method] and reviewed/approved by [attorney].
Sample client language (adapt to your engagement)
Our team may use approved AI-enabled tools to assist with drafting and analysis. We use these tools under attorney supervision and verify outputs against primary sources. We apply confidentiality safeguards, including data minimization and access controls. Please let us know if you have any restrictions on tool use or data processing for this matter.
Practice tip: Communication is not about “marketing AI.” It’s about managing risk and aligning with client expectations.