Note: This article is for orientation and does not replace legal advice in individual cases.
Why this topic is becoming important now
Language models occasionally invent numbers, sources or connections. In a draft this is annoying, in a board paper or a restructuring opinion it is a serious risk, because banks, investors and supervisory bodies make far-reaching decisions based on such results. Accordingly, more and more clients want to know whether and how AI is used in their projects and how quality is ensured. Regulation is also catching up: the EU AI Act requires transparency about AI-generated content in certain cases, with human review and editorial responsibility playing an important role.
What “audit-proof” means here
In the narrower sense, “audit-proof” (revisionssicher) means the unalterable archiving of records, for example under tax rules. For AI results in consulting, it means something different: for every statement it is clear where it comes from. A third party can verify sources and steps. It is documented who reviewed and approved a result. And the path to the result can still be reconstructed months later.
The three pillars
| Pillar | What it achieves | How it is implemented |
|---|---|---|
| Sources | Every statement can be traced back to its origin | Automatic linking to document, page or web page; no number without a source |
| Approvals | An experienced consultant reviews before work continues | Fixed checkpoints, e.g. after hypotheses, analysis and before sending |
| Documentation | The path to the result can be reconstructed | Log of work steps, access and approvals |
Who is liable if the AI makes mistakes?
An AI is not a bearer of liability. Towards the client, the firm is responsible for its service, regardless of the tools it was produced with, and the duty of care continues to apply unchanged. Anyone who adopts AI results without checking them takes a considerable risk. Firms should therefore clarify whether their contracts and professional liability insurance cover the use of AI, and where necessary agree its use, including quality assurance, with the client. In a dispute, those who can prove that every statement has a source and was reviewed by a consultant are in a much better position.
Typical mistakes
The most common mistakes are quickly listed: numbers without origin are copied from an AI chat straight into the presentation. There are no fixed checkpoints, so in the end nobody checks. The work happens in private chat histories, and the path to the result is documented nowhere. Confidential documents end up in tools without clarity about data hosting and training. And every consultant handles AI results differently.
Checklist for audit-proof AI results
- Source requirement: no statement and no number without a traceable source.
- Fixed approvals: define checkpoints and decide who approves there.
- Work in the project, not in private chat.
- Keep a log: automatically record work steps, access and approvals.
- Secure environment: EU data hosting, no training, separation between engagements.
- Review contracts and insurance.
Conclusion
AI makes consulting work faster, but not less responsible. An AI-assisted result only becomes audit-proof when sources, approvals and documentation come together. Firms that implement this systematically win twice: they work more efficiently and can show at any time how their results came about.
