x
What are the three sentences?One — what you use AI for. Name the tasks, not the tools. "We use AI assistance for drafting, summarising and first-pass research."
Two — what a human still does. "Every client-facing output is reviewed by a person before it's sent. Decisions, advice and judgement stay human."
Three — what you never feed it. "We don't put client data into third-party AI tools without written permission, and we never upload confidential documents."
That's it. Ten minutes to write, and you write it once. The rest of this post is why each sentence is shaped the way it is, because the shape is what makes it survive contact with a real client question.
Because tools change every quarter and tasks don't. A disclosure that names a product is out of date the moment you switch, and an out-of-date disclosure is worse than a general one — it reads as carelessness in exactly the place you were trying to demonstrate care.
Naming tasks also does something subtler. "We use AI for drafting and summarising" tells a client where the machine sits in your process. "We use [tool name]" tells them nothing except that you have a subscription. The first answers the question they're actually asking, which is never what software do you own and always what part of this did you do.
Keep it specific and dull. Vague reassurance — "we use AI responsibly", "AI-enhanced workflows" — is the tell that someone wrote a disclosure to have one. Marketing language in a disclosure is a contradiction in terms: the entire register you're aiming for is this is boringly true. If a sentence would look at home on a pitch deck, cut it.
Sentence one is also the only place you should be tempted to over-share. You do not need to inventory every prompt. You need enough that a client reading it would recognise your actual process rather than be surprised by it later.
Sentence two is the one clients care about, and it's the one most disclosures get wrong by making it a claim they can't keep.
"Every client-facing output is reviewed by a person" is a promise. If you write it, it has to be true on the Friday you're behind, not just on the Tuesday you wrote the policy. A disclosure is a commitment, and one broken line costs more than the whole page earned — which is the same reason a policy is a promise you keep rather than a document you publish.
So write the version you'll honour. If you don't review absolutely everything, say what you do review: "Anything that goes to a client or into a decision is reviewed. Internal notes may not be." That's a stronger sentence than an aspirational one, because it's checkable and because it demonstrates you thought about the edge cases.
The phrase that does the most work in sentence two is the last one. You sign it, not the model. It's the difference between a supplier who used a machine and a supplier who was replaced by one — which is the trust boundary written for an outside reader instead of for yourself.
Sentence three is about data, and it's the one that gets you through procurement.
The floor is straightforward: no client data into third-party tools without permission, no confidential documents. Then add your own hard limit — the thing you specifically don't do, stated in your own words. Nothing that identifies a client goes into a chat window. No health or financial records. No draft that hasn't been redacted.
The reason to add a personal limit is that it's the sentence a reader believes. Generic data language reads as copied, because it usually is. A specific, slightly awkward line — "we don't put anything with a person's name in it into an AI tool, including internal notes" — reads as written by someone who actually thought about their own practice.
If you don't know what your hard limit is, that's the finding, and it's worth an hour more than the disclosure is. Work out what you'd be uncomfortable seeing in a training set, then write that down.
Four places, ten minutes:
The test isn't whether it's technically true. It's whether a client would be surprised. Buried in your terms and conditions doesn't count — terms protect you, they don't reassure anyone, and a disclosure that only appears in clause 14 is a disclosure designed not to be read.
That distinction is not merely stylistic. Where the transparency rules that applied on 2 August 2026 bite, Article 50 requires the information be given "in a clear and distinguishable manner, at the latest at the time of the first interaction or exposure" — legible, up front, and before the person has committed anything. Whether or not that instrument reaches your business, it's a good specification for the sentences.
Not legal advice — check your own position.
Write them today. Then walk the list from yesterday's audit and paste.
For the prompt set we use to draft and pressure-test these — free, 5-min read: 7 AI Prompts That Run a One-Person Business.
Source (verified 9 Aug 2026): Article 50, EU AI Act — artificialintelligenceact.eu/article/50/.
Related Decodes
AI the Brief (@aithebrief) — AI advice you can act on and trust, for time-starved founders.
TL;DR: An AI disclosure is three sentences, written once. First, what you use AI for — name the tasks (drafting, summarising, first-pass research), never the tools, because tools change and tasks don't. Second, what a human still does — every client-facing output reviewed, decisions and judgement human, and "you sign it, not the model"; write only the version you will honour on a bad Friday, because a disclosure is a promise. Third, what you never feed it — no client data without permission, no confidential documents, plus one specific hard limit in your own words, because generic data language reads as copied. Then paste them in four places: your about or policy page, your proposal template, your chatbot's first message and your onboarding pack. Buried in your terms doesn't count.
