Somewhere in your firm, a partner has already pasted a client’s details into a free AI chatbot to tidy up a newsletter. Nobody approved it. Nobody wrote down that it happened. Nobody told the client.
That is the real risk of AI in professional services, and it has very little to do with whether the writing sounds robotic. This guide covers what Australian regulators expect, which marketing jobs are safe to hand to AI, and a one-page AI use policy you can adapt this week.
Why AI in professional services marketing needs rules first
In most firms, AI is already part of the marketing. It just isn’t happening through any official channel. One partner drafts LinkedIn posts in ChatGPT, someone in business development summarises a seminar transcript, and an executive assistant rewrites the client newsletter with whatever tool was open in the browser.
ASIC has seen the same pattern in financial services. In REP 798, released in October 2024, it reviewed how 23 AFS and credit licensees were using AI and found that adoption was moving faster than the governance around it. ASIC also reminded licensees that the existing rules are technology neutral. The obligations that apply to an email a person wrote apply to one a machine drafted.
That principle holds across law, accounting and insurance. No regulator has created an exemption for AI-generated content. So whether you build it yourself or bring in help with AI marketing for professional services firms, the rules come first. You’ll find more on marketing within regulated industries in our Insights library.
What do Australian regulators expect when you use AI?
Australian regulators expect you to apply your existing privacy, confidentiality and advertising obligations to anything AI touches, and to have clear rules about which tools your people can use. Here is where each one has landed.
Privacy (every profession). The OAIC’s guidance on commercially available AI products recommends, as best practice, that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools. It also expects your privacy policy to explain how you use AI.
Law firms. In December 2024 the Law Society of NSW, the Legal Practice Board of WA and the Victorian Legal Services Board + Commissioner issued a joint statement on AI in legal practice. It says lawyers cannot safely enter confidential, sensitive or privileged client information into public AI tools. It also suggests limiting AI to lower-risk tasks that are easy to verify, and being clear about which tools the practice uses and who can use them.
Financial advisers and wealth managers. ASIC’s June 2026 update to RG 234 says the advertising laws apply to AI-generated content the same way they apply to content a person wrote. It also warns that AI’s tendency to produce made-up or biased content can raise the risk of misleading advertising. Our RG 234 guide for financial advisers covers the rest of the update.
Accountants and insurance brokers. We’re not aware of an AI-specific marketing rule from either profession’s regulators yet. The confidentiality duties in your professional code and the Privacy Act still apply, so treat client information the same way you would with any outside supplier.
Which marketing tasks are safe to use AI for?
Marketing tasks that use public or firm-owned material, and get a human review, are generally safe for AI. Tasks that involve client information, regulated claims or anything that looks like advice need tighter controls, and some should stay human. Use this traffic-light table as a starting point.
| Marketing task | Rating | Why |
|---|---|---|
| Brainstorming topics, headlines and article outlines | Green: safe with review | No client information, and easy to check |
| Turning a partner’s published article into LinkedIn posts | Green: safe with review | It’s your own content |
| Editing drafts for plain English, length and spelling | Green: safe with review | A person checks every change |
| Writing meta descriptions, alt text and social captions | Green: safe with review | Low risk, quick to verify |
| Client newsletters that mention products, fees or performance | Amber: approved tools only | Advertising rules apply and compliance should review |
| Case studies based on real matters or clients | Amber: approved tools only | De-identify first and get consent before drafting |
| Analysing CRM, email or website data | Amber: approved tools only | Often contains personal information |
| Pasting client files, matter notes or financial details into a free chatbot | Red: do not use AI | Breaches the OAIC’s best-practice advice and may breach confidentiality |
| Generating testimonials, reviews, quotes or statistics | Red: do not use AI | Invented proof is misleading |
| Publishing anything nobody has read | Red: do not use AI | Accountability sits with the firm, not the tool |
The amber line matters most. The OAIC notes that an enterprise tool with protections that stop your inputs leaving the organisation is treated differently from a public chatbot. That is why “approved tools only” does so much work in the table.
How to use AI in marketing without sounding like AI
Start with the partner’s own thinking, give the AI your firm’s voice and past content to work from, and have a person edit every piece before it goes out.
Bland output comes from bland input. A prompt like “write a post about succession planning” gets you the same post as every other firm. A ten-minute voice memo from the partner, with the client question that prompted it, gets you something nobody else can publish.
The firms getting the best results build simple agents trained on their own material: a style guide, their best past articles, a list of words they never use and the advertising rules for their profession. Then a human edits. They cut the throat-clearing, check every claim and add the one specific example only the partner knows.
Our view: governance before tools
Most AI conversations in professional services start with the tool. Which one writes best? Which one works with Outlook? We think that is the wrong order.
The firms that get burnt won’t be the ones whose LinkedIn posts sound a bit flat. They’ll be the ones who can’t answer a client who asks, “Did you put my information into that?” Reputations in this market are built over decades and can be damaged in an afternoon.
A one-page policy, an approved tool list and a review step take less time than a single partners’ meeting. Set the rules first. Then choose the tools, and you’ll choose them better, because you’ll know what they need to do.
A one-page AI use policy for your marketing team
Here are eight clauses you can copy, adapt and put in front of your partners this week.
- Approved tools. Marketing work uses only [list approved tools], through firm accounts. Personal and free accounts are not used for firm work.
- What never goes in. No client names, matter or file details, financial or health information, or privileged or confidential material is entered into any AI tool that hasn’t been approved for that information.
- Human review. A named person reads and approves every piece of AI-assisted content before it is published or sent.
- Disclosure. Our privacy policy describes how we use AI, and we tell clients how we use it where it affects the service they receive.
- Advertising rules. AI-assisted content meets the same advertising and conduct rules as everything else we publish. We never use AI to create testimonials, quotes or statistics.
- Record keeping. We keep a simple register of the AI tools in use, what each is used for and who approved it.
- Training. Anyone using AI for marketing completes [training] before they start, and again when the tools change.
- Review date. We review this policy every [six] months, or sooner if regulator guidance changes.
Treat this as a starting point, not legal advice. Check it against your profession’s rules and your privacy obligations before you adopt it.
Frequently asked questions
Can a law firm use ChatGPT for marketing?
Yes, a law firm can use ChatGPT for marketing tasks that don’t involve confidential client information, provided a lawyer reviews the output before it’s published. The joint statement from the NSW, Victorian and WA legal regulators says lawyers cannot safely put confidential, sensitive or privileged information into public AI tools, and suggests keeping AI to lower-risk tasks that are easy to check.
Do we need to tell clients we use AI?
You may need to, depending on your profession and how you use AI. There is no single rule for every profession yet. The OAIC expects privacy policies to explain AI use involving personal information, and the legal regulators’ statement encourages lawyers to be transparent with clients. Check your own profession’s guidance.
Is it safe to put client information into AI tools?
Not into public or free AI tools. The OAIC recommends, as best practice, that organisations do not enter personal information, particularly sensitive information, into publicly available generative AI tools. Enterprise tools with contractual protections are different, but check the terms, your privacy obligations and your confidentiality duties first.
What should an AI policy for a professional services firm include?
An AI policy for a professional services firm should cover approved tools, what information can never be entered, human review, disclosure, advertising rules, record keeping, training and a review date. The eight clauses above give you wording for each.
Set up AI the safe way
Want to know how your firm shows up when prospects ask AI tools for a recommendation? Request a free website audit.
If you’d rather have the policy, the agents and the training set up for you, talk to us about AI marketing.
This article is general information, not legal advice.
