Client AI Audit Questions

How to Answer Client AI Audit Questions:
A Guide for Law Firm Risk Committees

Answering a client AI audit questionnaire: a long client addendum with every question ticked, under a seal showing a padlock inside the firm's own cloud

It is Friday afternoon. A risk partner opens a 140-question AI addendum from a Fortune 500 client. The firm's own AI pilot has sat in vendor review for seven months. Meanwhile, three associates are quietly using free chatbots to meet deadlines. (This is an illustrative scenario.)

Few risk committees would call this unusual. It is the gap between what clients demand and what traditional procurement can deliver.

Why Are Clients Asking Law Firms About AI Now?

Because they are using it themselves. The 2025 ACC and Everlaw survey of 657 in-house professionals found that GenAI use in corporate legal teams more than doubled in a year, from 23 to 52 percent. Yet 59 percent said they do not know whether their outside counsel uses it on their matters.

That uncertainty is why AI clauses are appearing in OCGs. ACC now publishes sample AI guidelines for outside counsel. Common themes include:

  • No client data in public AI tools

  • No training of models on client data

  • Disclosure of AI use on request

  • Human review of all output

Why Does Traditional Vendor Review Take So Long?

Every new AI vendor triggers the full cycle: questionnaire, security evidence, data processing agreement (DPA), sub processor mapping, and often client notification.

The full cycle

  1. questionnaire

  2. security evidence

  3. data processing agreement (DPA)

  4. sub processor mapping

  5. client notification

A 2026 Ponemon Institute study of 1,465 risk practitioners found that 60 percent say a single third-party assessment takes four months to more than a year. Organizations also assess only 36 percent of their vendors. That research spans all industries, not only law.

Delay is not neutral. Thomson Reuters' 2026 report found that 34 percent of professionals use AI their organization has not approved. Every month a safe tool waits; an unsafe one fills the gap.

How Does Running AI Inside the Firm's Own Cloud Change the Review?

The idea is simple: bring the AI to the data, not the data to the AI. When AI runs inside the firm's existing Azure tenant, client documents stay within a boundary the firm already governs and has already had audited.

Microsoft's documentation states that prompts, completions and embeddings in Azure OpenAI are not available to other customers or to OpenAI and are not used to train the underlying models. The service falls under Microsoft's Data Protection Addendum, which most firms already hold.

So, the question shifts from "Who is this new vendor?" to "How is this configured?" That avoids onboarding and papering a new data processor, and it makes the review shorter and more focused.

Reviewers can then concentrate on:

  • Network isolation and access controls

  • Permission inheritance from the document management system

  • Logging and audit trails

  • Data residency and retention

  • Abuse monitoring settings, which customers can apply to be exempted from

What Can Firms Tell Clients? Plain-Language Answers

ABA Formal Opinion 512 (2024) expects lawyers to protect confidentiality when using GenAI, so clients will ask. Use these as starting points, adapt them to your actual architecture, and have counsel review them.

Is our data used to train AI models?

"No. Client data is not used to train or improve any AI model. Prompts and outputs stay within our controlled cloud environment."

Where are our data processed and stored?

"Within our own Microsoft Azure tenant, in [region]. It does not leave our environment."

Who can access it?

"Only users are already permitted to see the matter. The AI inherits our existing access controls and ethical walls."

Does a third party process our data?

"No additional AI vendor receives client data. Processing occurs in our existing Microsoft cloud, under our current Microsoft agreement.”

How do you control accuracy?

"Lawyers review AI output against source documents before use. Activity is logged and auditable."

How Can Risk Committees Speed Up Approval?

  1. Build an evidence pack. Include an architecture diagram, data flow map and controls matrix.

  2. Tier use cases by data sensitivity. Start with firm-internal knowledge, then move to matter data.

  3. Flag OCG AI restrictions at matter intake, so restricted matters are handled automatically.

  4. Keep a library of approved client answers, reviewed quarterly.

  5. Measure approval time, not only approval outcomes.

The Takeaway

Clients do not expect firms to avoid AI. They expect proof of control. The firms that win will be the ones that can show it in days, not quarters.

Explore KLapper

FAQ

Frequently asked questions

What are outside counsel guidelines for AI?
They are client rules on how law firms may use AI on their matters, often covering data handling, disclosure and human review.
Why does legal AI vendor review take so long?
Each new vendor needs security evidence, a data processing agreement and risk assessment. Ponemon's 2026 study found 60 percent of organisations take four months or more.
How can law firms use AI without exposing client data?
Run AI inside the firm's own cloud tenant, inherit existing permissions, and keep logs and human review in place.

Sources

  1. ACC and Everlaw, Generative AI's Growing Strategic Value for Corporate Law Departments (October 2025)

  2. ProcessUnity and Ponemon Institute, State of Third-Party Risk Assessments 2026

  3. Thomson Reuters, Future of Professionals Report 2026

  4. Microsoft Learn, Data, privacy, and security for Azure OpenAI Service

  5. ACC, Sample AI Guidelines for Outside Counsel

  6. ABA, Formal Opinion 512 (2024)