When an AI-assisted report contains a wrong number, the professional signing it cannot simply blame the model. Contracts, professional duties, privacy law and insurance terms still matter.
The rules differ by jurisdiction and by use. In Singapore, the Personal Data Protection Act (PDPA) governs relevant handling of personal data, and IMDA has published AI governance guidance. Australia has its Privacy Act and sector-specific duties. The European Union’s AI Act is being implemented in stages, with requirements and proposed timetable changes that must be checked against the current legal text before a client is advised. General-purpose AI and high-risk systems do not all have the same deadlines.
GDPR enforcement has included penalties in the billions of euros. That does not mean every AI mistake attracts a fine; the relevant law, conduct and jurisdiction must be established.
A consultancy using AI to draft a public policy summary faces different risks from one using personal data to rank beneficiaries for assistance. In the second case, consent, lawful processing, access controls, review and explainability become central.
Ask three questions before using AI on a client assignment. What data will enter the system? Who is accountable for checking the output? What do the contract and insurance policy actually cover? Keep records of human review.
Planetary.Blue can share examples and provide paid consulting support. Legal and insurance advice should come from qualified professionals in the relevant jurisdiction.
