Practical Guide: Professional Services
Legal, audit, accounting and consulting firms, where the product is judgement, the duty of confidentiality is absolute, and the regulator supervises the person rather than the system.
- Typical top tier
- Tier 3–4 — client advice, audit evidence, court or regulatory filings
- Already-owned ground
- Professional conduct rules, supervision duties, quality management, privilege
- Hardest gate
- G2 — because the retrieval boundary between clients is an architecture decision
- First record to fix
- The client-confidentiality boundary in every retrieval and tuning path
1. Where the risk actually concentrates
Professional services firms have an unusual constraint: the obligations attach to individuals, not to systems. A partner is responsible for the advice, a signing auditor for the opinion, an admitted lawyer for the filing. No governance framework transfers that, and IRGF should not try. What it adds is the record that lets the responsible individual show what the system did, on what material, and what they checked.
The distinguishing technical risk is contamination. Retrieval over a firm's own knowledge base crosses client boundaries by default, and a system that answers a question for one client using material from another has produced a confidentiality breach, a conflict, and possibly a waiver of privilege — none of which will be visible in the output. The boundary is an architecture decision taken at G2 and enforced in the index, not a policy statement in a handbook.
The second is fabrication with consequences. A hallucinated citation in an internal memo is an embarrassment; the same citation in a filing is a sanctionable event, and courts have made that point repeatedly. The control is verification of every external reference before it leaves the firm, performed by a person who is accountable for it.
Indicative classification of the systems this sector keeps building. The scores are illustrative, not authoritative: they show how the anchors in Chapter 6 read against sector facts. Score your own system; do not copy a row.
| Typical system | Illustrative D1–D5 | Tier | What is usually mis-scored |
|---|---|---|---|
| Drafting of filings, opinions or advice sent to a client or a court | D1 4 · D2 2 · D3 4 · D4 3 · D5 4 | Tier 3–4 | Treated as drafting; the output carries the firm's professional obligation |
| Audit anomaly detection and sample selection | D1 4 · D2 2–3 · D3 4 · D4 3 · D5 4 | Tier 3–4 | Sampling decisions determine what is examined; unexamined error is invisible by construction |
| Contract analysis, due diligence and disclosure review | D1 3–4 · D2 2–3 · D3 3–4 · D4 3 · D5 4 | Tier 3 | A missed clause in disclosure review is not recoverable after completion |
| Cross-client knowledge retrieval on firm material | D1 4 · D2 1–2 · D3 4 · D4 4 · D5 4 | Tier 4 unless the boundary is enforced technically | Confidentiality risk scored as a data protection matter rather than a professional duty |
| Legal or technical research assistance with citation | D1 3–4 · D2 1–2 · D3 3 · D4 3 · D5 3 | Tier 3 | A fabricated authority that reaches a filing is a sanction, not an error |
| Tax position analysis and computation support | D1 4 · D2 2 · D3 3–4 · D4 3 · D5 4 | Tier 3–4 | The filing is the client's and the exposure is theirs; that raises D1, not lowers it |
| Proposal, pitch and marketing content generation | D1 2–3 · D2 3 · D3 3 · D4 3 · D5 3 | Tier 2 | Claims about capability and independence made in a pitch can bind the firm |
| Time, billing and resourcing analytics | D1 2–3 · D2 3 · D3 2 · D4 3 · D5 3 | Tier 2 | Resourcing decisions about people, if used that way, move D1 up |
| Conflicts and independence checking support | D1 4 · D2 2 · D3 4 · D4 4 · D5 4 | Tier 4 | A missed conflict is a firm-level event and the check is often treated as administrative |
2. The regulatory interface
Regulatory note. The regimes below are named so each IRGF record can be pointed at the obligation it evidences, not to restate them. Applicability, thresholds and commencement dates differ by jurisdiction and several have moved during implementation. Nothing here is legal advice: confirm the current position with your own counsel, and record the answer in the Regulatory Overlay Reference so it is checkable later.
IRGF does not restate any of these obligations. It gives each one a record that carries the evidence, an owner, and a trigger that reopens it when the obligation or the system changes.
| Regime or standard | What it obliges in practice | IRGF record that carries the evidence |
|---|---|---|
| Professional conduct rules in each jurisdiction of practice | Competence, confidentiality, supervision of work performed for a client, and honesty in communications with courts and regulators. | The supervising professional is the named accountable owner in the Deployment Authorization Record; supervision evidence is a control, not a claim |
| Legal professional privilege and confidentiality obligations | Protection of privileged material, including from disclosure to third parties and processors. | Retrieval and tuning boundaries recorded in the ADR; processor arrangements recorded in the vendor fields |
| Audit standards and quality management (for example ISQM 1, ISA and equivalents; PCAOB requirements where applicable) | Sufficient appropriate evidence, engagement quality review, documentation of judgements, and firm-level quality management including for technology used in engagements. | Evaluation evidence referenced by the AI Assurance Summary; system use documented in the engagement file |
| Independence and conflicts rules | Restrictions on services, relationships and data use that could impair independence. | Conflicts-checking systems governed at their true tier; supplier relationships assessed for independence impact |
| Court and tribunal practice directions on AI-assisted material | Verification of citations and, in some courts, disclosure that AI assistance was used. | Citation verification recorded as a mandatory control with a named verifier |
| Client contractual terms and outside counsel guidelines | Frequently restrict AI processing, offshore processing, model training on client material, and sub-processors. | Client-level restrictions recorded in the lineage record and enforced at the retrieval and tuning layer |
3. Calibrating the five dimensions
The dimensions do not change. What changes is what a 3 and a 4 look like when the subject matter is this sector, and which reading an assessor under delivery pressure reaches for first.
| Dimension | How to read it here | The mis-score to watch for |
|---|---|---|
| D1 Decision Consequence | Anything reaching a client, a court, a regulator or a filing is 4. Internal drafts are 2. The boundary is whether the work product leaves the firm. | Scoring the tool's role rather than the destination of its output. |
| D2 Autonomy | Genuine professional review is one of the few places where D2 = 1 is defensible — provided the review is substantive and evidenced. Volume review under fee pressure is not. | Assuming the professional duty guarantees the review. Duty is not a control; evidence of review is. |
| D3 Reversibility Deficit | Advice acted on, a filing submitted, a disclosure missed, and confidential material exposed to the wrong client are all 4. | Treating a corrective letter as reversal. |
| D4 Exposure and Scale | A firm-wide knowledge system reaches every matter, including the ones with restrictive client terms. | Scoring the pilot practice group when the deployment is firm-wide. |
| D5 Sensitivity and Uncertainty | Client material is 4 by default and privileged material is 4 with additional handling. Generative research carries uncertainty 3 to 4 because fabricated authority is fluent. | Scoring sensitivity by document classification rather than by client obligation. |
4. One system, end to end
The overlay above is a map. This is one route across it: a single question followed from the matter to the delivered work product, with the record or control that attaches at each step.
5. What each gate adds
Additions only. Everything in the base gate definitions still applies; see the gate checklists for the common set.
| Gate | Sector addition | Why it is here |
|---|---|---|
| G1 | Name the client obligations that apply to the material this system will touch, and whether any engagement terms prohibit the processing outright. | Client terms are the binding constraint in this sector and they differ per engagement. |
| G2 | The retrieval and tuning boundary: how client separation is enforced technically, and what the index build does when a document's classification is unknown. | This is the sector's defining architecture decision, and the failure mode is silent. |
| G3 | Named supervising professional, mandatory verification control for external references, and a record of what the system was used for on each engagement. | The regulator will ask the individual what they checked. The answer must exist in a record. |
| G4 | Extending a system to a new practice area, jurisdiction or client segment is Major. Adding a corpus is Material. | Corpus additions are the change type that breaks the confidentiality boundary. |
| G5 | Retention aligned to engagement and limitation periods, with client-directed deletion honoured across derived indexes and caches. | Deletion obligations reach embeddings and caches, which are the parts everyone forgets. |
6. Controls and evidence worth adding
| Control | Where it attaches | Evidence it produces |
|---|---|---|
| Technically enforced client separation in retrieval and tuning | Index build; access control | Build logs showing the boundary applied, and a test that cross-client retrieval fails |
| Fail-closed handling of unclassified documents | Ingestion pipeline | Rejected-document log, reviewed rather than ignored |
| Mandatory verification of every external citation or authority | Control Matrix; workflow | Named verifier per output, with the check recorded in the engagement file |
| Engagement-level record of AI assistance | Engagement file | What was used, for what task, and who supervised |
| Client-terms register mapped to systems and corpora | Regulatory Overlay Reference, extended to contractual obligations | Which engagements permit which processing, checkable before ingestion |
| Deletion propagation to indexes, embeddings and caches | Retirement and data lifecycle | Evidence that deletion reached derived stores, not only the source repository |
7. Runtime signals to wire first
Control Plane onboarding order matters more than coverage in the first year (Chapter 18). These are the signals that earn their place earliest in this sector.
| Signal | Drift category | Suggested response |
|---|---|---|
| A document enters a corpus without a client classification | Data lineage and governance | Fail closed. An unclassified document in a shared index is the breach that has not been noticed yet |
| Retrieval returns material from an engagement outside the requester's access set | Security / data lineage | Immediate incident: this is a confidentiality event with professional consequences |
| Citation verification rate falls below full coverage | Behavioral / control failure | Suspend external use of the system until coverage is restored |
| A client's terms change to restrict AI processing | Policy and regulatory | Re-open the corpus mapping for that client and purge derived artifacts where required |
| Model or platform vendor changes data-use terms | Policy and regulatory | Treat as a Material change: the confidentiality basis of every system on that platform has moved |
8. Failure modes this sector produces
The knowledge base that forgot the client boundary
The tell. A firm-wide assistant indexes everything the firm holds, because that is what makes it useful, and the confidentiality boundary exists only in the acceptable-use policy.
The response. Enforce separation in the index and prove it with a failing test. If the boundary cannot be enforced technically, the system is Tier 4 and probably should not exist in that form.
Citations verified by the tool that produced them
The tell. A verification step asks the model whether its own citations are real.
The response. Verification means checking against the source, by a person or an authoritative database. Self-check is not a control.
Supervision assumed rather than evidenced
The tell. Every output is nominally partner-reviewed and no record shows what was reviewed or changed.
The response. Record the review as evidence: what was checked, by whom, and what changed. It protects the individual as much as the firm.
Deletion that stopped at the document store
The tell. A client exercises a deletion right and the material remains in embeddings, caches and evaluation sets.
The response. Map derived stores at G2 and make deletion propagation a tested capability, not an assumed one.
9. A ninety-day start
If the sector is yours and the framework is new, this is the order that produces something defensible fastest. It assumes one part-time architect and one risk lead, not a programme.
- Map every corpus a retrieval system can reach, and the client obligations attached to each.
- Test cross-client retrieval deliberately. Do this before any policy work; the result determines everything else.
- Register client engagement terms that restrict AI processing, and connect them to ingestion.
- Score the systems whose output leaves the firm, with the relevant professional and the general counsel present.
- Make citation verification mandatory and measurable on research and drafting systems.
- Add an engagement-file field recording AI assistance and supervision.
- Test deletion propagation into indexes and caches on one real matter.
- Run a G3 dry run on the firm-wide assistant, with the risk partner signing.