Engagement letter AI clause: what to tell clients in Ireland
· Updated
Joaquín Trapero in AI and privacy expert, and founder of Nonimo.
Nothing in Irish law obliges a solicitor or an accountant to put an AI clause in an engagement letter. The question arrives anyway, usually from a client who has read about chatbots and wants to know whether their file went into one. A paragraph in your terms answers it before anyone has to ring.
The copyable clause, numbered 9.1 to 9.6, comes right after the first section and works in a solicitor’s terms of business or an accountant’s letter of engagement. The rest explains it from Irish texts only. If your firm hasn’t yet settled which tools it allows, our page for Irish solicitors deals with that first.
No Irish rule requires an AI clause, but the Law Society asks solicitors to consider one in their terms and conditions letter. Once client data reaches a provider, Article 13 of the GDPR makes it a recipient, and chartered accountants need specific authority under R114.1(d). A short clause plus one privacy notice line handles both.
Do solicitors in Ireland have to tell clients they use AI?
The Law Society’s generative AI guidance was reported in the Gazette on 12 November 2025; the PDF itself is dated December 2025. On dealings with clients it says two things. A solicitor should be transparent about why they use these tools, and should consider referring to them in the terms and conditions letter.
Then it draws a line. Honesty creates no positive obligation to disclose, any more than a firm lists its IT contractor, unless the client specifically asks. The guidance also says it makes no new rules. That is a floor, and a firm standing on it has nothing written down the day a client asks.
Do you have to tell this client, and where?
Has the client asked whether AI is used on their matter?
Has your firm adopted the Law Society's AI use policy template?
Will personal data from the file reach an AI provider?
Our reading of the Law Society guidance (page 13), its AI use policy template and the GDPR.
Two questions sit outside this. What you tell a judge has been its own regime since 1 September 2026, and our guide to Practice Direction HC 142 covers the declarations on affidavits. None of that decides what goes into a letter to your own client.
The guidance also points, in a footnote, to Article 50 of the AI Act. That article reaches chatbots that deal with the public and certain published content, not an advice letter a solicitor has checked and signed. Our reading of the AI Act for Irish businesses has the dates.
A sample AI clause for solicitors and accountants, 9.1 to 9.6
Neither the Society’s AI use policy template nor the Institute’s August 2026 guide offers wording for the terms, so the drafting is ours. Its 2012 precedent is a covering letter with terms attached, hence clause 9. Renumber it, match your defined terms, choose 9.4A or 9.4B, never both; 9.6 goes only in processor work.
Clause 9, ready to adapt
9. Use of technology, including artificial intelligence. 9.1 In carrying out your instructions we use software of various kinds, some of which includes artificial intelligence. We may use it for [first drafts, summaries of documents, translation and proofreading]. If you ask whether such a tool was used on any piece of work, we will tell you.
9.2 Nothing produced by an artificial intelligence tool is given to you as advice, and no decision on your matter is made by one. A solicitor of the Firm checks any such material before it is relied on or sent to you, and we are responsible for it as for any other work we do.
9.3 You may tell us in writing at any time not to use artificial intelligence tools on your matter, or on particular documents, and we will follow that instruction. Where we charge by reference to time, we record and charge only the time our people actually spend.
9.4A Before any text from your matter is put into an artificial intelligence tool, we replace names, PPS numbers, dates of birth, addresses, Eircodes, bank details and our own file references on our own computers, and we check what remains for anything else that could identify a person. The record linking each replacement to the original stays within our systems. The rest of the text, including the facts of your matter, is sent to the tool.
9.4B We may put information from your matter, including personal data about you and others, into [tool and licence], supplied by [provider]. Under our written agreement the provider must keep it confidential, use it only to provide the service to us[, not use it to train its models] and delete it [within [period]]. It is processed in [the EEA / [country], relying on [an adequacy decision / standard contractual clauses]], and you may ask us for details.
9.6 Where we process personal data on your behalf and on your instructions, for example in running your payroll, you give us general written authorisation under Article 28(2) of the GDPR to engage [providers of artificial intelligence tools / [named provider]] as sub-processors. We will tell you of any new or replacement provider at least [30] days before it starts, and you may object within that time.
A first draft, not legal advice: the partner who owns your terms should test it against how the office works. For an accountancy practice, read "a solicitor of the Firm" as the engagement partner. Square brackets are yours to fill or delete. Clause 9.5, the privacy notice line, is further down.
Four words carry 9.4A: “on our own computers”. The Law Society’s safeguards end with AI run locally or in an environment the firm controls; 9.4A claims less, keeping only the identifying step in house. A firm with developers could build it on Presidio, Microsoft’s open-source toolkit, though the plumbing around it is theirs.
The last sentence of 9.4A matters as much. A client who later saw an actual prompt should find the clause accurate, so that sentence stays in even though it reads less comfortably.
The brackets in 9.4B mirror the Society’s vendor assessment tool: processing in the EEA or under standard contractual clauses, a contractual bar on training, and retrieval and deletion on exit. The guidance says consumer versions, free or paid, aren’t suitable by default for client data. If you can’t fill the brackets, the tool fails 9.4B.
| Your tool | Read this before filling the brackets |
|---|---|
| ChatGPT | what each ChatGPT plan does with your inputs |
| Claude | whether your Claude plan trains on your data |
| Gemini | what Gemini keeps and shares |
| Microsoft Copilot | Copilot’s training terms by licence |
The Law Society’s AI use policy template sets a stricter rule
Next to the guidance, the Society’s Practice Essentials toolkit carries an AI use policy template for firms to adopt. It is mostly written for staff, and those internal rules are the subject of our AI policy template guide. A handful of lines face the client, and they go further than the guidance.
Section 4.1 says clients must be informed where AI has materially contributed to a deliverable or decision. Section 7.2 commits the firm to telling clients when AI helped prepare a deliverable or advice, or when they are talking to a chatbot. Section 5 sends AI processing into the privacy notice and the record of processing.
Its guidance note keeps this proportionate: nothing for a grammar check, a short footnote or cover note for substantive work. A firm that adopts the template has chosen the stricter rule, and a client who reads the policy can hold the firm to it. Clause 9.1 should never promise less than your own policy does.
The same task under the guidance and under the template
Nothing to say unless the client asks.
No disclosure needed (guidance note to 7.2).
No duty unless asked; consider a line in the terms and conditions letter.
A brief note on the letter saying AI assisted and naming who reviewed and approved it (7.2).
Outside its scope: the AI Act's transparency duties apply.
Clients are told they are dealing with an AI system (7.2).
Nothing to say.
Disclosed to colleagues who rely on it (7.1); the client hears only if it feeds advice they receive.
Law Society GenAI guidance, page 13; AI use policy template, sections 4.1, 7.1 and 7.2.
Terms and conditions letter or section 150 notice: where the AI wording goes
Most Irish matters open with two documents. The Solicitors’ Guide recommends giving the client the firm’s terms and conditions of business when instructions are taken. A signature isn’t obligatory but is good practice, and terms sent by email should be acknowledged. The Society’s precedent dates from 7 September 2012, replacing a 2008 version.
The second is the notice under section 150 of the 2015 Act, which binds solicitors and barristers alike. It sets out, in clear language, the legal costs or how they will be calculated. Legal costs include outlays as well as fees, the only door through which AI walks into the notice.
A licence the firm pays whatever the matter is an overhead and stays out. A paid AI review or translation service bought for one file is an outlay like any other. Before your next costs notice goes out, check the AI line against the table; which licence your firm holds decides most of the rows.
Where an AI cost goes under section 150
| The AI cost | Where it goes | Section 150 |
|---|---|---|
| Firm-wide licence for a drafting assistant | Overhead: not in the notice | none |
| Per-document AI translation charged to the client | Outlay: the amount, or how it is calculated | (2)(a) or (b), and (4)(c) |
| AI document review bought for discovery on one case | Outlay, plus the likely cost and the client's approval before you engage it | (4)(e)(i) and (6) |
| Costs climb because a tool's output had to be redone by hand | A new notice once costs look significantly greater | (5) |
| Client asks what an AI line on the notice means | Clarification as soon as reasonably practicable | (9) |
Legal Services Regulation Act 2015, section 150, as revised. Our classification, not a ruling.
The Guide already applies this logic to a different charge. Where a bank’s negative interest on client money is passed on, the basis of calculation belongs in the section 150 notice. A per-use AI charge is no different, and I would rather see it named there than discovered on the bill.
Billing for AI-assisted work: time costing and LSRA overcharging complaints
Clients now ask why a letter drafted with AI’s help costs the same hours. Where time is the basis of charge, the Solicitors’ Guide says the client ought to be kept informed of time spent. It recommends keeping time records, because they may be needed in a complaint to the Legal Services Regulatory Authority.
The LSRA handles three kinds of complaint: inadequate services, excessive costs and misconduct. In one published case study, a family law client was quoted €3,000 to €4,000, then billed €5,000 at €250 an hour without being told the work was hourly. The LSRA found the costs excessive, and €1,000 had to go back.
How far over the estimate is the bill?
Above the estimate: section 150(5) wants a new notice as soon as you see it coming, not a surprise on the final bill.
The starting figures are the LSRA case study’s; the sum runs in your browser. AI changes none of that arithmetic. It makes clause 9.3’s line on time worth more, because time records can prove it. Savings passed on belong in a letter only if the billing system can show them.
The same records matter in court. A judge who finds AI misused in a court document can make costs orders against the practitioner personally, which the sanctions under HC 142 set out. In front of either, a firm’s best answer is a time record kept matter by matter.
Your privacy notice: AI providers as recipients under Article 13
Data protection runs on its own track. Article 4(9) of the GDPR defines a recipient as anyone data are disclosed to, “whether a third party or not”, so a provider under contract still counts. Article 13(1)(e) asks your notice to name recipients, or categories of them, when data are obtained.
A firm representing a client in a dispute is the controller in the EDPB’s guidelines, since it decides what to process and how. The notice is yours to keep current, and point (f) adds any transfer outside the EEA. Which AI tools can meet the GDPR covers what a provider’s terms need to say.
The DPC’s July 2024 blog on large language models asks organisations to understand, before they start, where a tool sends personal data and whether the provider keeps or reuses it. Swapping identifiers for markers doesn’t take the provider off your list, because markers the firm can reverse are still personal data.
Clause 9.5: the recipients line in your data protection notice
IT service providers.
Providers of technology services to the Firm, including providers of artificial intelligence tools, who process personal data on our behalf, on our instructions and under written agreements with us. A list of the providers we currently use is available on request.
Article 13(1)(e) GDPR allows categories of recipients. If a provider processes outside the EEA, add the transfer and its safeguard under point (f).
Developer tools rest on the same fact. Limina’s re-identification step works only because the firm holds the means to put the details back, which is exactly why the provider stays a recipient.
The same goes for a masking service your practice software calls over the internet, such as Protecto’s hosted API. The masking company then sees the raw text first, so I would name it in the notice rather than tuck it under IT services.
Client consent, third parties and the in camera rule
The Solicitors’ Guide allows a client’s affairs to be disclosed only with the client’s consent, by direction of a court, or to a body exercising statutory powers. A client who signs terms allowing AI assistance has opened the first route for their own affairs. Irish files, though, are full of other people’s affairs.
A probate file lists what each sibling inherits. A personal injuries file carries the other driver’s details. Article 14(5)(d) spares the firm from writing to those people where professional secrecy applies, but says nothing about what may be pasted into a tool. Our PPSN guide shows which Irish identifiers to strip first.
Family law is the hard stop. Under the Guide, a family law file goes to no third party, even with the client’s consent, save limited statutory exemptions or a court order. In a family practice I’d keep those files out of the clause and decide each under the Society’s Safe Use Patterns guide.
| Whose information | Can the client’s signature cover it? | What the firm does |
|---|---|---|
| The client’s own affairs | Yes, for the uses your terms describe | 9.4A or 9.4B |
| Siblings, employees, the other driver | No: they signed nothing | Identifiers out before any tool sees the text |
| Health or other special category data in the file | Not by itself | An Article 9 condition, and a DPIA where the risk is high |
| A family law file | No: the in camera rule ignores consent | Enterprise tool with a processing agreement at most, DPIA for sensitive cases, or no tool |
Sources: Solicitors’ Guide to Professional Conduct, chapters on confidentiality and family law files; GDPR Articles 9 and 14(5)(d); Law Society Safe Use Patterns, family law card.
Chartered Accountants Ireland: proper and specific authority for AI
No rule tells an Irish accountant to announce AI use either. R114.1(d) of the Chartered Accountants Ireland Code of Ethics bars disclosing confidential information outside the firm without proper and specific authority, barring a legal or professional duty or right. An AI provider is outside the firm, so the engagement letter carries that authority.
The Institute’s concise guide on the ethical use of AI, from August 2026, names engagement letters among the commitments an AI system must respect. It treats client information in a public tool without consent as a threat to confidentiality. It also warns that anonymisation may not remove the risk where people could still be re-identified.
The CCAB-I alert of February 2025, from the Institute and ACCA, is blunter: a firm’s AI policy should prohibit personal or sensitive data in AI systems and, where relevant, flag AI-generated content. CPA Ireland amalgamated with the Institute on 1 September 2024, and the Institute’s rules have applied to CPA members and firms since then.
Is the authority in your engagement letter specific?
Tick what your current wording already says.
0 of 5
That reads as general consent, which is not what R114.1(d) asks for.
Close. Fill the gaps before you rely on it.
Specific on every point. Revisit it whenever the tool changes.
Our checklist, built from R114.1(d) and the Institute's August 2026 guide. The ticks stay in your browser.
Payroll is where a practice acts as the client’s processor: the EDPB’s own example is a payroll administrator paying staff on the employer’s instructions. Article 28(2) then needs the client’s prior written authorisation before an AI provider is engaged. Payslips with a union deduction also reveal trade union membership, a special category.
The practice side, from bookkeeping to year-end files, is on our page for Irish accountants. Clause 9.6 above is the only paragraph that answers a specific GDPR requirement, and it belongs only in processor work. Whatever notice period you write into it, make it one the practice can honour across every payroll client at once.
AI disclaimer wording that won’t survive a complaint
Some phrases sound reassuring in a draft and read very differently when the LSRA or the Institute is looking at them after a complaint. Each one below fails against an Irish source the firm would have to answer to. Strike all five from any template that arrives from outside the firm.
| The phrase | Why it fails |
|---|---|
| “Your data is anonymised before any AI sees it.” | The Institute’s guide warns that anonymisation may not remove re-identification risk, and markers the firm can reverse are personal data anyway. |
| “Our AI tools are fully GDPR compliant.” | The Law Society tells solicitors never to assume even an enterprise tool guarantees compliance. |
| “Nothing about your matter leaves the Firm.” | Under 9.4B it leaves by design; under 9.4A the facts still go. |
| “You consent to any use of AI on your file.” | R114.1(d) wants specific authority, and the in camera rule ignores consent altogether. |
| “AI means lower fees for you.” | A section 150 notice deals in actual costs; promise savings and the final bill becomes the measure of the promise. |
None of this helps once client data has reached a tool it shouldn’t have. What to do after client data goes into a chatbot is a separate exercise, with its own clock.
![A client's IBAN swapped for the label [IBAN_1] on the firm's own computers, as clause 9.4A of the engagement letter promises](/guias/en-ie/engagement-letter-ai-clause-iban-label.webp "A client's IBAN turned into a label")
Keeping clause 9.4A true, file after file
Clause 9.4A asks something tedious every time: find each name, PPS number, IBAN and date of birth and take it out before pasting. In Word the search also has to reach the comments, headers and tracked changes. I wouldn’t sign off 9.4A without a method that survives the last hour of a long day.
Nonimo installs on each Windows or Mac computer. Select the text, press one key, and identifiers become labelled markers; the originals go back in when the reply returns. The mapping stays on that computer, which keeps 9.4A true. Practice software that calls the OpenAI API can mask client data on your own server instead.
What the tool receives under 9.4A
Affidavit of Ruairí Costigan, PPS number 8064317TA, born 14 March 1979, payments to account IE29 AIBK 9311 5212 3456 78.
Affidavit of [PERSON_1], PPS number [PPS_NUMBER_1], born [BIRTH_DATE_1], payments to account [IBAN_1].
Invented example. Contextual details, such as the only pharmacy in a small town, remain for the fee earner to judge, as 9.4A says.
Nonimo has no place in the wording itself: 9.4A describes the firm’s practice, not a product, and the text never reaches us, as our security page explains. What a client can rely on is the practice written into your terms.
If 9.4A is the version you would rather put your name to, try Nonimo on an Irish draft of your own before the clause goes out with your next letter of engagement.
Sources
- Law Society of Ireland, Guidelines for the Use of Generative Artificial Intelligence by the Legal Profession in Ireland, December 2025. Page 6, consumer and enterprise tools; page 10, safeguards; page 13, the terms and conditions letter and no positive duty to disclose.
- Law Society of Ireland, Solicitors’ Guide to Professional Conduct, 4th edition, 2022. Terms of business, time costing, confidentiality, service providers, family law files, negative interest in the section 150 notice.
- Also from the Law Society, unlinked: AI Use Policy template, Safe Use Patterns by Practice Area and the AI vendor assessment tool (Practice Essentials, 2026); practice note on terms and conditions of business, 7 September 2012.
- Legal Services Regulation Act 2015, section 150, revised. The costs notice, outlays, subsections (5), (6) and (9).
- Legal Services Regulatory Authority, What you can make a complaint about. Inadequate services, excessive costs and misconduct.
- Legal Services Regulatory Authority, Complaints case studies. The family law costs case used in the calculator.
- Chartered Accountants Ireland, Code of Ethics. R114.1(d), 114.1 A1(b) and A2.
- Chartered Accountants Ireland, The Ethical Use of AI Technologies: a concise guide for Members, August 2026. Engagement letters, consent and re-identification. CCAB-I Technical Alert 01/2025 is on the same site.
- CPA Ireland, Guidance and support on the transition to Chartered Accountants Ireland (unlinked, as the two bodies are now one). Amalgamated on 1 September 2024; the Institute’s rules apply to CPA members from that date.
- Data Protection Commission, AI, Large Language Models and Data Protection, 18 July 2024. What to understand about a tool before using it.
- Regulation (EU) 2016/679, the GDPR. Articles 4(9), 9, 13(1)(e) and (f), 14(5)(d) and 28(2).
- European Data Protection Board, Guidelines 07/2020 on controller and processor. The law firm and payroll examples.
Checked on 7 November 2026.
Common questions
Do I need an AI clause in my engagement letter in Ireland?
No, no Irish law requires one. The Law Society asks solicitors to consider mentioning AI in their terms and conditions letter, and the GDPR applies once client data reaches a provider.
Is there a free AI clause template for engagement letters?
Yes, clause 9 on this page is free to copy and adapt. Neither the Law Society's AI use policy template nor Chartered Accountants Ireland's August 2026 guide offers wording for the terms.
Do solicitors have to tell clients they use AI?
Not unless the client asks, according to the Law Society's guidance. A firm that adopts the Society's AI use policy template commits to telling clients where AI materially contributed to the work.
Do accountants in Ireland have to tell clients they use AI?
Not as such, but outside AI tools need the client's authority. R114.1(d) asks for proper and specific authority before confidential information leaves the firm, and the engagement letter is the usual place.
Are solicitors in Ireland allowed to use AI?
Yes, the Law Society accepts it, with safeguards. Its 2025 guidance warns against client data in consumer tools and makes the solicitor responsible for every word a tool helped produce.
Is it ethical for lawyers to use AI?
Yes, if confidentiality, competence and honesty hold. Irish guidance treats AI under the existing Code of Conduct: check the output, protect client data, and answer truthfully when a client asks.
Can solicitors put client files into ChatGPT?
Not on a consumer plan, by default. The Law Society calls consumer versions, free or paid, unsuitable for client data; use a vetted enterprise tool or take identifiers out first.