Telling clients how AI was used on their work, with evidence

The gap

In Thomson Reuters' 2026 survey of professional services, 85 % of clients said firms should disclose when AI is used on their matters, while only 16 % of firms actively communicate it and 39 % say nothing. Agency contracts are being amended clause by clause with tool disclosure, human oversight and provenance documentation on request.

Late discovery is what hurts: clients who learn about undisclosed AI use mid-engagement trust the firm less. Upfront disclosure framed as "AI as a tool used by accountable people" doesn't carry that penalty.

What a good disclosure shows

• How much of the work people did, and how much AI agents did
• Which agents and models were used
• For each piece of agent work: whether a person reviewed or approved it
• The period and the projects it covers
• What it leaves out: rates, costs and internal notes

Where the EU AI Act fits

Article 50 of the AI Act applies from 2 August 2026. Among other things, deployers must label AI-generated text published to inform the public on matters of public interest, unless it has undergone human review or editorial control and someone holds editorial responsibility. A record of who reviewed what is the kind of evidence that supports that position. This guide describes good practice and how Hourtick records it; it isn't legal advice, so check your own obligations.

How to roll it out

1. Agree a default with each client: full transparency, per-deliverable disclosure for regulated work, or a summary per period.
2. Keep agent work on tasks, and have people move agent work to done only after they've checked it.
3. Send the report with the invoice or at the end of each month.
4. Keep the shared version unchanged, so what the client saw is what you can point to later.

How Hourtick handles it

Projects → a client → AI work report builds the report for a period: people's and agents' hours, the agent share, which agents and models, and for each task whether a person reviewed or approved the agent's work. Names are hidden unless you choose to show them. Admins can share it as a link the client opens without an account; the report is frozen when shared, carries a SHA-256 fingerprint of its JSON, and the link can be revoked at any time. It's also in the API and over MCP (get_client_ai_report, share_client_ai_report).