ISO/IEC 42001 by industry
ISO 42001 for professional services: governing generative AI in drafting, research and client work
Clause by clause: ISO/IEC 42001:2023 requirements: every clause explained →
What changes when fee earners use AI: why clients ask, which drafting, research and review tools belong in scope, where auditors test client confidentiality in prompts, verification of AI output and engagement-letter terms, and how it sits beside ISO/IEC 27001 and professional rules.
Key points
- Law firms, accountancies, audit practices and consultancies are now asked by clients how generative AI is used on their matters: in drafting, research, document review and summaries of client files.
- The AI risk that clients care about is confidentiality: what fee earners put into prompts, where that text goes, and whether the tool's provider may retain or learn from it.
- Auditors test three things a firm can show: an approved list of AI tools with owners, a rule that a qualified person checks every AI output before it reaches a client, and records of what each engagement letter says about AI.
- Most firms use AI rather than build it, so the AIMS centres on responsible use, supplier terms and verification.
Why professional services firms are asked about ISO 42001
The question arrives through the client relationship. Corporate legal departments and procurement teams now add AI questions to panel reviews: which tools the firm uses, whether client documents go into them and who checks the output.
An ISO/IEC 42001 certificate lets the firm answer once, with a system an accredited certification body has audited. It does not replace a client's own review or the firm's professional duties. Whether certification is right for your firm, or a policy is enough for now, is covered in Do you need ISO/IEC 42001? A decision guide for AI providers and users.
The pressure in this sector is trust in the work product: a memo citing a case that does not exist, or a privileged draft pasted into a public chatbot, harms the client and the firm's standing.
What sits inside the AIMS scope for a law firm, accountancy or consultancy
A sound scope lists the AI systems the firm uses and its role for each: the assistant built into email and documents, drafting and legal research tools, contract review and e-discovery platforms, transcription tools, and AI features inside audit, tax and practice management software. Where the firm has built its own tool, such as a knowledge assistant trained on precedents, it is also the developer and the life-cycle controls apply.
The practice groups, offices and support functions whose people use those tools belong inside, because use is where the risk sits.
Three scope mistakes recur. Listing only the tools IT licensed, while fee earners use personal accounts on public chatbots. Leaving out an office or an acquired practice that works on the same clients. And scoping the innovation team alone, when clients ask about the practice that serves them. The general rules are in ISO/IEC 42001 scope: which AI systems and roles are in, and the mistakes that cost you.
Where the requirements bite for professional services
| Requirement area | What it means in a firm | Evidence the auditor samples |
|---|---|---|
| AI policy and intended use (A.2, A.9) | Which tools are approved, for which tasks, and what may never be entered into a prompt | The approved AI policy, an approved-tools list with intended use per tool, acceptable-use rules acknowledged by fee earners |
| Third-party and customer relationships (A.10) | Provider terms on retention and training with firm data, and what engagement letters tell clients about AI | Supplier assessments and contract terms, a register of client instructions that restrict or permit AI, engagement letter wording |
| Responsible use and verification of output (A.9; A.6 for firm-built tools) | Verification of AI output by a qualified person before it reaches a client or a court | Review sign-offs on sampled matters, rules for citations and figures, event logs from firm-built tools |
| AI system impact assessment (6.1.4, A.5) | What an error or disclosure would do to a client, an opposing party or a person named in the files | An impact assessment per tool, reviewed when a tool changes or is used for a new purpose |
| Competence and awareness (clause 7) | Fee earners and support staff know the limits of each tool and the verification rule | Training records by role, awareness completion, errors caught before release |
Controls are selected through the AI risk assessment and recorded in the Statement of Applicability; the nine groups are explained in ISO/IEC 42001 Annex A: the 38 controls explained.
Working alongside ISO/IEC 27001, privacy law and professional rules
Many firms already hold ISO/IEC 27001 because clients asked for it. The AIMS extends that system rather than sitting beside it: one risk method, one supplier register, one internal audit programme. See ISO/IEC 27001 to ISO/IEC 42001: extending an ISMS into an AIMS.
Client files hold personal data, so prompts can carry it too. Where privacy law applies, such as the GDPR for firms established in the EU or EEA or serving people there, the AIMS supports the firm's controls but does not answer the whole law; ISO/IEC 27701 covers the privacy management side.
Law societies, bar regulators and accountancy bodies issue their own rules and guidance on confidentiality and competence, some of it addressing AI. Those duties remain the firm's to meet; the AIMS records them as interested-party requirements and shows how each is met. Firms serving clients in the EU should also read ISO/IEC 42001 and the EU AI Act: what the certificate does not give.
What a professional services engagement looks like
Duration depends on how many AI tools are in use, whether an ISO/IEC 27001 system already runs, how consistently engagement letters are managed and when the next client panel review falls. The managing partner or COO, the risk function, knowledge management, IT and practice group leaders must be involved, because fee earners decide what goes into each prompt. With Design™, Sterling guides your risk team to own the AIMS; with Drive™, Sterling carries more of the assessments, documentation and readiness work so fee earners stay on client work.
How Sterling works with professional services firms
AI your fee earners can use and your clients can check.
Our expert and experienced consultants build the tool inventory, the verification rule and the supplier and engagement-letter records with your people, and keep the evidence in Effivity, included at no additional cost. Sterling does not certify; an accredited certification body audits and decides. We ensure successful certification for our clients.
Book a free discovery callISO 42001 for professional services: questions firms ask
Do law firms and accountancies need ISO 42001 certification?
No law requires it, but clients increasingly ask how their firms use AI. A certificate answers those questions with one independently audited system instead of a different reply for every panel review.
Can fee earners put client documents into generative AI tools under ISO 42001?
The standard does not forbid it; it requires the firm to decide, assess and control it. Most firms allow approved tools whose terms exclude retention and training, and forbid public tools for client material.
Should our engagement letters mention AI?
That depends on your clients' instructions and your professional rules, not on ISO 42001 alone. The AIMS makes sure the decision is recorded, applied consistently and checked when clients restrict AI use.
Our legal research provider is certified to ISO 42001. Does that cover our firm?
No. The provider's certificate covers its own AI management system. Your firm still has to show how it selects the tool, sets its intended use and verifies what it produces.
ISO/IEC 42001 by industry
Every guide in the ISO/IEC 42001 series is written for one question and links back to the hub for the whole picture.
- ISO/IEC 42001 for banking and financial services
- ISO/IEC 42001 for BPO and shared services
- ISO/IEC 42001 for healthcare
- ISO/IEC 42001 for HR and staffing
- ISO 42001 management review
- ISO/IEC 42001 certification in the Netherlands and Europe
- ISO 42001 nonconformities
- ISO/IEC 42001 for professional services
- ISO 42001 requirements explained
- ISO/IEC 42001 for retail and e-commerce
- ISO 42001 scope
- ISO/IEC 42001 for technology and software
Keep exploring
Explore more about ISO/IEC 42001
Watch a video on how to implement ISO 42001 here.
Watch a video on ISO 42001 requirements here.
ISO/IEC 42001 resources
Services for ISO/IEC 42001
Talk to a consultant
Plan an AI management system that covers every practice group and office.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice