Client-Supplied Algorithms: Who Carries the Output When the Tool Isn't Yours?

For most of the last decade, the technology question in a professional engagement ran one way. The firm chose the systems, the firm controlled the access, and the firm's information security team could point to a policy that governed what happened to client data once it entered the building. That symmetry has quietly broken.

Clients now arrive with their own subscriptions. A document review that would once have been run through the firm's disclosure platform is instead run through the client's enterprise licence. Drafting is assisted by a tool procured by the client's own IT function, on the client's own tenancy, under terms the client accepted months before the engagement began. The work product may still carry the firm's name. The machinery producing it very often does not.

Why the tool arrives with the client

The commercial logic is not mysterious. Clients have paid for licences and want utilisation. Their procurement teams have already cleared a vendor and do not wish to clear another. Some clients regard their AI stack as part of their intellectual property and are reluctant to see engagement outputs produced outside it. In regulated sectors the client may have its own model governance obligations that make a third-party tool harder to justify internally than its own.

None of these reasons is unreasonable. The difficulty is that each of them moves a control out of the firm's perimeter without moving the corresponding accountability.

Confidentiality: whose processor is it now?

When a firm instructs its own vendor, the firm is the controller and the vendor is a processor under a contract drafted for that purpose. When the client supplies the tool, that tidy structure inverts. The client is typically the controller of its own data, the vendor is the client's processor, and the firm becomes a third party whose confidential information — and whose client's confidential information — is being processed under an arrangement to which the firm is not a party.

In practice this means the firm may be unable to answer three questions that a regulator, or its own insurer, is likely to ask: what is the retention period, is the input used for model training, and which sub-processors sit downstream? The answer often lives in the client's master services agreement with the vendor, which the firm has never seen and may not be entitled to see.

Data residency and cross-border transfer

A tool hosted in the United States or the European Union may involve a transfer of personal data outside the UK. Where the firm is a controller in respect of that data, the transfer needs a lawful mechanism — an adequacy regulation, the International Data Transfer Agreement, or the addendum. It is not enough to observe that the client consented to the vendor's terms; the client's consent does not discharge the firm's own obligations.

Engagement letters should therefore require the client to confirm the hosting region and the transfer mechanism before the tool is used on any engagement data, and should reserve the firm's right to decline the tool where that confirmation cannot be given.

Output liability: accuracy is not a warranty

AI-assisted output is frequently plausible and occasionally wrong. The contractual question is not whether errors will occur but who bears the consequence when they do.

Three positions are commonly taken. The first is that the firm remains solely responsible for all output, whatever tool produced it — commercially simple, actuarially unattractive. The second is that responsibility is shared in proportion to input — elegant in principle, near-impossible to evidence after the fact. The third, and the one most defensible in 2026 engagement letters, is that the firm retains responsibility for professional judgement and review, while the client accepts responsibility for the configuration, permissions and data it supplies into its own tool, and for any instruction to rely on unreviewed output.

That third position only holds if the letter says so explicitly, and if the firm can demonstrate that a review step actually took place.

Professional indemnity: notification and aggregation

Notification obligations are usually drafted around 'circumstances which may give rise to a claim'. A misconfigured client tool that has been producing flawed drafts across several matters for four months is precisely such a circumstance. Firms should ask their brokers two questions before the next renewal: whether use of third-party client tools is disclosed on the proposal form, and whether claims arising from a single client-supplied platform across multiple matters would aggregate as one claim or several.

The second question matters more than it appears. Aggregation can turn a cluster of modest matters into a single large loss, or — depending on the wording — leave the firm facing several deductibles at once.

A clause-by-clause checklist for engagement letters

• Named tools only. Require the client to identify each AI tool by product and version before use, with a change-notification obligation.
• Terms on the record. Obtain the vendor's terms of use or a summary of the controller-to-processor terms, and record that the firm has reviewed them.
• Hosting and transfers. Confirm hosting region, retention period, training-use setting, and the transfer mechanism relied upon.
• No training on firm data. An express prohibition on the use of engagement material to train or fine-tune models.
• Access control. Clarify who within the client organisation may see firm work product once it sits in the client's tenancy.
• Review obligation. State that no output is delivered without human review, and identify who performs it.
• Liability allocation. Allocate responsibility for configuration, input data and instructions to rely on unreviewed output.
• Indemnity carve-out. Confirm that the firm's indemnity does not extend to defects in the client's tool.
• Notification cooperation. Require the client to notify the firm promptly of any suspected tool malfunction affecting engagement data.
• Exit and deletion. Provide for the return or deletion of firm material from the client's tenancy at the end of the engagement.

Before the next letter goes out

The gap is rarely created by a single dramatic decision. It opens incrementally, matter by matter, as a partner agrees to 'just use the client's platform' because the alternative is a two-week procurement delay. Closing it is a drafting exercise, but it is also a discipline: an engagement letter that names the tool, records the terms, and states who carries the output is a considerably more comfortable document to produce when the insurer asks how the firm managed the risk.