AI governance for UAE law, accounting and consulting firms

Law firms, accounting and audit practices, consultancies and corporate-services providers sell judgement applied to other people's confidential information. That is exactly what general-purpose AI tools are good at imitating, which is why they spread through a professional firm faster than any partner decides they should, and why the governance question in this sector is sharper than almost anywhere else.

Where AI already sits in a professional firm

Start with an inventory taken from the people doing the work, not from the IT function. In a firm of twenty to three hundred fee earners, the same clusters appear almost every time, and most of them arrived without a purchasing decision.

• Drafting and summarising. First drafts of advice, memoranda, reports and correspondence; summaries of long documents, contracts and hearing bundles; translation between Arabic and English.
• Research. Questions put to a general assistant instead of, or before, a subscription research service, with the answers pasted into work product.
• Document review and extraction. Pulling clauses, dates, parties and figures from data rooms, ledgers, bank statements and contracts, sometimes inside a licensed platform and sometimes not.
• Meetings and communication. Transcription and note-taking assistants joining client calls, drafted follow-ups, and voice messages summarised on a phone.
• Practice management. Time-entry narratives, proposal writing, conflict-check assistance and marketing content.

Record each item with the team that uses it, whether the account is the firm's or the individual's, and the kind of client material it has touched. The last column is the one that decides everything that follows.

Client confidentiality is the whole question

Every other sector governs AI around a mix of concerns. In a professional firm one concern dominates. The firm holds material that clients handed over on the understanding that it would go no further, and in many cases the firm has a professional or contractual duty that says so in terms. Pasting that material into a consumer AI account moves it to a third party the client has never heard of, on terms nobody in the firm has read.

The point is not that AI tools are unsafe. Enterprise tiers from reputable providers typically offer contractual commitments on training, retention and data location that a firm can assess and accept. The point is that a personal account on a free or consumer tier gives the firm no contract on any of them, and that is often where usage in a firm starts.

• Sort client material into three tiers. Public or the firm's own; ordinary client-confidential; and privileged, regulated or otherwise restricted. Only the first tier goes into any tool that is not on the approved list. The third tier may go into nothing without a named partner's decision.
• Approve tools by tier, in writing. A short approved list, each entry with the contractual answers on training, retention, sub-processors and location, and the tier of material it may receive.
• Check where the data may lawfully go. The firm's data protection regime, whether federal, free-zone or a client's home jurisdiction, will have something to say about transfers. Get that answer once from your own adviser and write it into the approved list.
• Treat assistants in meetings as attendees. A transcription tool on a client call is a third party in the room. Say so, get agreement, and know where the recording lives.

Work product, review and who signs

A client is paying for the firm's judgement, and the firm is answerable for what it delivers however the first draft was produced. Generated text is fluent, confident and occasionally wrong in ways that are hard to see because the sentence around the error is so well formed. In professional work the characteristic failure is a citation, a figure, a date or a statutory reference that reads perfectly and does not exist.

• Nothing generated reaches a client unreviewed. A named, qualified person reads the whole document, not the summary of it, and checks every reference against the source. This is the same rule the firm already applies to a trainee's draft; the tool is a very fast trainee with no sense of shame.
• Sources come from the firm's research services or the primary text. A general assistant may point to where to look. It does not supply the authority.
• Record assistance where it matters. For regulated deliverables such as audit files, valuations or formal opinions, the working papers should show what a tool produced and who reviewed it, so the file can be defended later.
• Keep the firm's voice. Templates, precedents and house style belong in a firm-controlled system that the approved tools can draw on, so quality does not depend on whichever prompt a fee earner wrote at eleven at night.

What you have promised clients in writing

Most engagement letters were drafted before any of this existed. Read yours with three questions in mind: what it says about confidentiality and third parties, what it says about outsourcing or the use of technology, and what it says about who does the work. Some clients, in particular financial institutions, government entities and international groups, may add their own conditions on AI use to instructions and panel terms. Those conditions bind the firm whether or not anyone read them.

Two practical moves. First, decide the firm's standard position on AI use and put it in the engagement letter, so a client is told rather than left to discover it. Second, keep a register of clients whose terms restrict or prohibit AI use, and make sure the approved tools cannot be pointed at those matters by accident.

Time, fees and the honest conversation about both

If a task that took four hours now takes forty minutes, the firm has to decide what it is charging for. Billing the four hours is the kind of decision that surfaces badly later. Charging for the forty minutes at the same rate gives the benefit entirely to the client and leaves the firm wondering why it invested. Neither is wrong, but the firm should choose on purpose.

A firm that wants to handle this well can move the affected work to fixed fees, say plainly in proposals that assisted drafting is part of how it works, and price the review and the judgement rather than the typing. The position to avoid is fee earners quietly using tools while time entries describe work that was not done that way. That is a conduct problem waiting for a complaint.

Juniors, judgement and what the firm is training

A professional firm is also a training organisation. Much of what a junior learns comes from producing first drafts and having them torn apart. If the tool produces the first draft, the firm has to decide deliberately how the next generation acquires the judgement it will one day sell. That is a leadership question rather than a technology one, and it deserves an answer in the firm's plan rather than an assumption.

Provision beats prohibition here as in every sector. A firm-funded business-tier account for every fee earner, with the approved-tier rules attached, removes the incentive to use personal accounts and gives the firm an audit trail. Add the accounts to joiners and leavers, so prompt history and uploaded material do not walk out with a departing associate.

A 30-day sequence

For a firm of twenty to three hundred fee earners, this order produces evidence a client or a professional body would recognise, and costs very little.

• Week one. Inventory by team and by account type. Name one accountable partner. Read the engagement letter and the panel terms of the five largest clients.
• Week two. Publish the three-tier rule for client material and a short approved-tool list with the contractual answers recorded. Prohibit everything else for tiers two and three, plainly and in writing.
• Week three. Put the review rule in place: a named reviewer for every generated draft, sources from the firm's own research services, and assistance recorded in working papers where a file may be examined. Move fee earners onto firm accounts.
• Week four. Issue a one-page acceptable-use policy, decide the firm's billing position and its standard engagement-letter wording, brief every fee earner in a single session, and add AI tools to the joiners and leavers checklist.

At the end of the month the firm can tell a client which tools touch their material and on what terms, show a reviewer's name on every deliverable, and explain its fees without embarrassment. The fuller control set is the governance checklist, and the questions to put to any tool vendor are here.