Does regulation make AI too risky for professional services?

The belief is understandable. A Managing Partner at an accountancy, insolvency or law firm has real obligations: client confidentiality, professional indemnity insurance, and duties to regulators such as the ICAEW or the Solicitors Regulation Authority. When an AI vendor promises speed and efficiency but cannot tell you exactly where your client data goes, caution is the professional response. The myth is not that these concerns are imaginary. The myth is that they make AI categorically off-limits.

Research into UK restructuring and insolvency professionals identifies data security, confidentiality concerns, and uncertainty around professional indemnity insurance as the primary barriers to AI adoption. These are legitimate worries. They are also solvable design constraints, not permanent prohibitions.

Why this belief took hold in professional services

Professional services firms operate in an environment where getting it wrong has consequences. A data breach on a client matter is not an IT inconvenience. It is a potential regulatory sanction, a claim against the firm, and lasting reputational damage.

The early wave of AI tools did little to reassure. Consumer-facing products trained on user inputs, vague data-processing agreements, and a general absence of sector-specific guidance from professional bodies all reinforced the sense that AI was designed for tech companies, not for regulated advisory firms.

The absence of explicit approval from insurers and regulators was read as implicit disapproval. That reading is cautious and professionally understandable. It is also, in most cases, an overstatement of what the guidance actually says.

What the evidence actually shows

Regulatory bodies in the UK have not imposed blanket restrictions on AI use in professional services. What they have signalled is that human oversight, clear audit trails, and data governance matter. That is not a reason to avoid AI. It is a specification for how to implement it.

Research among restructuring and insolvency professionals confirms that the sector wants clearer guidance, not that it has received a prohibition. Wanting more clarity is different from operating in a hostile environment. Most professional bodies are in active dialogue with firms about acceptable AI use cases, and several have begun publishing position statements.

The ICO has clarified that GDPR does not prevent the use of AI. It requires that personal data is processed lawfully, transparently, and with appropriate technical controls. A firm that uses an AI workspace where data stays within its own environment, applies proper access controls, and documents its decision-making process is operating within GDPR's existing framework.

Professional indemnity insurers are similarly not refusing cover wholesale. Many are asking firms to disclose AI use in renewal questionnaires. That is due diligence, not exclusion. Firms that can demonstrate structured, documented AI workflows are in a stronger position than those who cannot account for how they reached a conclusion.

What believing this myth costs your firm

For Compliance Managers and Practice Managers, the instinct to wait for complete regulatory certainty feels like prudent risk management. In practice, it transfers risk rather than eliminating it.

Firms that pause entirely are still exposed to the operational risks AI could reduce: human error in document review, inconsistent application of templates, slower turnaround on routine matters. Those risks are real and ongoing. The question is not whether to accept risk. The question is which risks to manage and how.

The efficiency gap is also widening. Firms that have moved carefully into AI use on internal workflows are building staff competence and documented processes. Firms that have not are starting from zero when regulatory clarity does arrive. The cost of delayed adoption compounds quietly.

For Managing Partners, the business case matters too. Professional services SMEs face margin pressure from larger competitors with more resources. Internal AI use on knowledge management, template drafting, and scenario modelling does not require client data to flow anywhere sensitive. Those use cases are available now, without waiting for insurer sign-off on client-matter applications.

A structured approach to de-risking AI adoption

The practical path for a professional services firm is not to wait. It is to start where the risk profile is lowest and build outward from there.

Begin with internal-only applications. Knowledge management, precedent drafting, internal research summaries, and meeting preparation do not require client data to enter an AI tool. These use cases deliver real time savings without touching the confidentiality boundary.

When you are ready to move closer to client work, data environment matters more than tool choice. AI workspaces that keep data within the firm's own infrastructure, or that use platforms with clear data-processing agreements and no training on user inputs, address the core confidentiality concern directly.

Document your workflows explicitly. Show where human experts retain control, where outputs are reviewed before use, and how conclusions are reached. This documentation protects the firm if a claim arises. It also positions the firm well in insurer conversations, because it demonstrates that AI is being used as a tool under professional supervision, not as a substitute for professional judgement.

Seek written guidance from your professional body and your insurer. Most are willing to engage on specific scenarios. A written response gives the firm a defensible basis for proceeding. It also moves the conversation from abstract anxiety to concrete parameters.

What this approach will not resolve

Honesty requires one important caveat. Regulatory guidance in this area is still developing. The Solicitors Regulation Authority, ICAEW, and sector-specific bodies are publishing updates, but the pace is uneven and the specifics vary by practice area.

Firms in highly sensitive practice areas, particularly those handling regulated financial information or legally privileged material, face a higher bar. Internal capability and structured processes will take you a long way. They will not substitute for professional legal advice on specific AI use cases in those contexts.

The approach described here reduces risk materially. It does not eliminate all uncertainty. Any firm that tells you otherwise is overstating the current state of guidance.

The goal is not to rush into AI use before the framework is clear. The goal is to build the internal knowledge and documented processes that allow your firm to move quickly and defensibly when the framework firms up. Firms that have done neither will be starting from scratch at that point.

Your next step as a professional services firm

If your firm is weighing up how to approach AI within your existing confidentiality obligations and insurance constraints, the AI Readiness survey is built to surface exactly those questions. Take the AI Readiness survey. You will get access to 65+ free resources and a custom AI Readiness report. We then offer a free 30-minute showcase to walk through your results.

gecco's Training and consultancy programme gives professional services teams a vendor-neutral grounding in how AI works, where data goes, and how to apply it within existing confidentiality obligations. If you want a structured entry point that builds internal capability without creating dependency on an external provider, that is what the Quick-Start programme is designed to deliver.

Website · LinkedIn · Case Studies · Newsletter