Engagement Letter AI Policy for Professional Services Firms
Published April 18, 2026 · Updated April 2026 · By The Crossing Report · 6 min read
Summary
- NH SB 640 (passed Senate March 2026) requires written AI disclosure from licensed professionals; Tennessee passed companion legislation the same week
- Three-component disclosure covers the legal requirements: AI use acknowledgment, licensed professional review confirmation, data protection statement
- Do not name specific tools in engagement letters — name categories and maintain a separate updatable tool register
- The disclosure conversation is an opportunity, not a liability — firms that disclose proactively control the framing; firms that are discovered using AI without disclosure do not
The Regulatory Landscape
Professional services firms that thought AI disclosure was optional got a significant data point in March 2026: New Hampshire's Senate passed SB 640, requiring written AI disclosure from licensed professionals in client engagement documents. Tennessee passed companion legislation on a similar timeline.
Neither law uses vague aspirational language. SB 640 specifies that licensed professionals using AI in client service delivery must disclose this in written engagement terms, with clients receiving the disclosure before work begins.
Additional states are in various stages of AI disclosure legislation. The ABA issued Formal Opinion 512 on AI in legal practice, which while non-binding, establishes the framework for lawyer competence obligations around AI disclosure. State CPA societies have issued non-binding guidance recommending disclosure for accountants. Professional liability carriers are tracking this issue.
The regulatory direction is clear: AI disclosure in professional engagement letters is moving from best practice to legal requirement, state by state. For firms operating across multiple states (which is common in tax, corporate law, and consulting), the compliance position that makes sense is uniform disclosure — not a state-by-state patchwork.
What the Three-Component Disclosure Requires
Component 1: AI Use Acknowledgment
The engagement letter needs to acknowledge that AI tools are part of how you work. Not a lengthy explanation of what AI is, not a disclaimer about AI limitations — a professional statement that you use AI tools in your service delivery.
Language template:
Our firm uses AI-assisted tools to support certain aspects of our professional work, including [select applicable: document drafting and editing / legal and regulatory research / financial analysis and review / document processing]. We use these tools to work more efficiently on your behalf and to maintain quality in our deliverables.
Keep it professional and forward-facing. The tone should read as a competence statement, not an apology.
Component 2: Licensed Professional Review Confirmation
The engagement letter must confirm that AI output does not go to clients without licensed professional review. This is the core of the accountability structure that regulators, clients, and professional liability carriers all want to see.
Language template:
All work product prepared with AI assistance is reviewed and approved by a licensed [CPA / attorney / consultant], who is responsible for its accuracy and completeness. Our use of AI tools does not transfer or reduce our professional responsibility to you.
This component does three things: it establishes that the human professional remains accountable, it confirms that clients are not receiving unreviewed AI output, and it positions the firm's AI use as professional practice enhancement rather than cost-cutting at the expense of quality.
Component 3: Data Protection Statement
The engagement letter must address how client information is handled when AI tools are involved. This is the component most clients will actually read — and the one most likely to generate questions if it's vague.
Language template:
Client information shared in connection with AI-assisted work is processed through enterprise AI systems that operate under data processing agreements prohibiting the use of your information for AI model training. We do not use consumer AI tools with client data. You may request our AI tool policy and the data processing terms applicable to your engagement at any time.
The specific language matters: "enterprise AI systems" and "data processing agreements" signal that you understand the data risk and have managed it, without requiring the client to know what those terms mean technically.
What NOT to Include
Do Not Name Specific Tools
"We use Claude, ChatGPT Enterprise, and Clio Duo" in an engagement letter creates a compliance obligation: if you switch any of those tools, you've created a technical disclosure gap. Name categories, not tools. Maintain a separate AI tool register that you can update as your stack changes.
Do Not Create Opt-Outs You Can't Honor
"You may request human-only processing for any engagement deliverable" sounds client-friendly, but verify you can actually operationalize it. If human-only processing for a complex research task would extend delivery time by three weeks, that's a client expectation you've set in writing. Only offer opt-outs you can operationally honor.
Do Not Include Limitation Disclaimers
"AI may produce inaccurate or incomplete output" belongs in an internal policy document, not in a client engagement letter. Your engagement letter already includes professional liability terms. Adding AI-specific limitation disclaimers creates a "we warned you" paper trail that can be used against you if AI-assisted output does contain an error, while also signaling to clients that you lack confidence in your AI use.
How to Communicate the Update to Existing Clients
For existing clients at renewal or next engagement start:
"We've updated our standard engagement terms to reflect how we work in 2026. I've attached our updated agreement, which includes a brief section on our use of AI tools. Short version: we use AI to work more efficiently, everything is reviewed by [name], and your data is protected under enterprise agreements. Happy to answer any questions."
For existing multi-year clients who haven't seen an updated engagement letter: Send a supplemental communication — an email with the three-component disclosure attached — that acknowledges the update without requiring a new engagement signature (unless your jurisdiction or engagement structure requires it).
The clients who push back on AI disclosure are the ones who might have pushed back eventually anyway. Having the conversation in writing, on your terms, before you're asked, is better than having it reactively after a client discovers your AI use through another channel.
Related Reading
- AI Compliance for CPA and Accounting Firms — AICPA guidance, engagement letter AI clause, and 5-step compliance checklist for CPA firms
- AI Policy Template for Professional Services Firms — Complete AI use policy template for accounting, law, and consulting firms
- AI Professional Liability Insurance for Professional Services — How professional liability carriers are treating AI use and what firms need to document
Sources
- New Hampshire SB 640: AI disclosure requirements for licensed professionals, passed Senate March 2026
- ABA Standing Committee on Ethics and Professional Responsibility: Formal Opinion 512 (AI in Legal Practice)
- Tennessee AI disclosure legislation, March 2026
The Crossing Report covers the AI transition for professional services firm owners. The premium tier includes a fill-in engagement letter AI disclosure clause for accounting, law, and consulting firms — ready to add to your current template. Subscribe here →
This is the kind of intelligence premium subscribers get every week.
Deep analysis, cross-sector patterns, and the frameworks that help professional services firms make the crossing.