A founder running a small professional services firm asked me a question I’ve been hearing more often: “We use AI to draft client reports and proposals. Do we need to tell them?”
The honest answer is that it depends on what those reports contain and how clients might use them. UK law currently has no universal rule requiring AI labels on every piece of content you produce. The obligations that do exist are anchored in data protection, consumer protection, and professional liability, and they apply unevenly depending on what you’re producing and for whom. Knowing exactly where the lines fall is more useful than a blanket yes or no.
What’s the actual choice here?
The choice is between a clear disclosure policy and treating AI as an unremarked operational tool. UK law does not currently mandate AI labels on every output, but specific circumstances create genuine obligations. Three things move content from the discretionary zone into something closer to a formal duty: the involvement of personal data, the risk of professional reliance, and the impression of human authorship where there isn’t any.
The regulatory terrain relevant to UK SMEs here centres on three bodies. The Information Commissioner’s Office sets expectations on data protection and transparency. The Competition and Markets Authority enforces consumer law and has signalled that misleading AI marketing will attract scrutiny under existing powers. The Advertising Standards Authority governs what counts as misleading in advertising and promotional content, including testimonials and endorsements.
None of these bodies requires you to add an AI disclaimer to every newsletter or client proposal. The regulatory concern across all three is accuracy, the transparency that data protection law already requires, and not making content look like something it isn’t. That framing is more useful than a blanket yes or no, because it tells you precisely which outputs need attention and which are fine as they are.
The Digital Markets, Competition and Consumers Act 2024 gave the CMA powers to fine businesses up to 10% of global annual turnover for serious consumer law breaches. Misleading AI-generated content sits within that territory when it is systematic and material.
When does disclosure become non-negotiable?
Three circumstances push the decision past discretion. First, when AI processes personal data about clients to profile them or inform decisions with significant effects. Second, when the output reads as professional advice that clients might act on financially or legally. Third, when the format signals human authorship, as with testimonials, bespoke reports, or case studies. In each case the regulator’s concern is reliance and deception, not the specific tool used.
UK GDPR’s transparency principle applies whenever personal data is processed by AI. If your firm uses AI to analyse client data, score accounts, or produce personalised recommendations, the ICO’s “Explaining decisions made with AI” guidance requires that clients know AI was involved, understand what it does, and know how a human has overseen the outcome. Individuals whose data is processed in this way have rights to explanation and to request human review under UK GDPR Articles 13-15 and 22.
The professional liability question is direct. Anderson Strathern’s briefing on AI-generated content notes that businesses remain fully responsible for any advice or analysis they send to clients, regardless of whether AI drafted it. If AI produces an inaccurate financial commentary and a client acts on it, the fact that a tool wrote the sentence does not shift the liability. Disclosure alongside documented human review is the practical protection.
For content that implies independent human authorship, the CMA’s foundation models report and the ASA’s influencer marketing rulings both signal that AI-generated testimonials, reviews, or client stories presented as real carry genuine enforcement risk. If a client would feel deceived to learn the content was AI-generated, disclosure is the safer path.
When is selective disclosure sufficient?
A large share of business content sits outside the high-risk categories. Blogs, newsletters, social posts, proposal boilerplate, and internal drafts typically involve no personal data and carry no professional reliance risk. UK law does not currently require AI labels on these. The practical question shifts from legal obligation to client expectation: what would a reasonable client assume, and what does your reputation for honesty require of you?
Many founders adopt a general statement approach for this type of content. A note in your website footer, a line in your standard terms, or a brief AI use policy on your services page stating that you use AI in producing some written material typically covers the expectation without tagging every piece. The RAi UK transparency toolkit describes this as proportionate for low-risk outputs: honest at the policy level, not exhaustive at the instance level.
Internal AI drafts of proposals or team communications don’t trigger disclosure duties under current UK law unless they contain personal data. Labelling them “AI-assisted draft” as a matter of internal practice is useful for a different reason: it signals to colleagues that the document needs a proper human review pass before it goes anywhere near a client.
Design assets and illustrations carry IP ownership and licensing considerations rather than deception risks in typical use, and a general policy statement handles those adequately.
What does it cost to get this wrong?
The cost of under-disclosing sits in three areas: regulatory fines, contract liability from a client who relied on inaccurate AI-generated content, and reputational damage when clients discover AI use that was never mentioned. All three are concrete risks for a firm of any size. The first two have specific numbers attached, which makes the calculation easier to run than many founders expect.
The ICO can fine up to £17.5 million or 4% of global annual turnover for serious data protection failures, including transparency violations. The CMA’s powers under the Digital Markets, Competition and Consumers Act reach 10% of global annual turnover for serious consumer law breaches involving misleading content. Neither outcome is the typical result for a small firm acting in good faith, but both numbers clarify what regulators consider proportionate when something goes wrong.
At the contract level, UK legal commentary points out that standard B2B agreements often cap liability at 100% to 150% of annual fees. For a professional services firm with a client on £500,000 in annual fees, a misrepresentation claim arising from AI-generated advice that a client relied on can easily exceed the firm’s annual profit on that relationship.
Drafting an internal AI policy with legal review typically takes a few days and a modest legal fee. A small firm defending even a minor client dispute in a professional negligence context will spend considerably more before it reaches any resolution.
What to ask before you decide
Five questions that work as a practical gate before any AI-assisted content goes to a client. They aren’t a substitute for legal advice, but they convert a vague anxiety about disclosure into a specific decision with a defensible rationale. If any of the five lands in the yes column, treat disclosure as the working default rather than the exception to argue your way out of.
Does this output involve personal data about an identifiable client or individual? If yes, UK GDPR transparency duties are likely engaged and a clear explanation of AI involvement is the practical response.
Will the client reasonably rely on this to make a financial, legal, health, or significant business decision? If yes, treat it as advice, disclose the AI assistance, and document the human review steps you applied before sending.
Would a reasonable client feel misled if they found out AI had generated all or most of this? Testimonials, bespoke analysis, and reports prepared specifically for that client sit firmly in this zone.
Is the client in a regulated sector? Finance, health, and public sector clients face stricter governance expectations and are more likely to ask about AI use directly. Being prepared with an honest, considered answer matters.
What do your contract and internal AI policy say? If both are silent, that is the gap to close. A short policy specifying which outputs require disclosure, what a human review step looks like, and who signs off is the cheapest governance investment available to a professional services firm. If you’d like to think through what that policy needs to cover for your particular firm, Book a conversation.
