Imagine asking a colleague to prepare a draft tax opinion. They produce it in thirty seconds. You sign it without reading it. If the opinion is wrong, whose problem is it — theirs or yours? The answer is obvious — and yet, with AI, many professionals find themselves doing exactly this every day.
Generative artificial intelligence has slashed the cost of producing documents. Analyses, draft contracts, circulars, replies to clients: everything takes a fraction of the time it used to. But the time saved in production doesn’t disappear: it moves further along the process, onto the professional who has to decide whether that output is reliable, correct and fit to sign. Verifying AI output in a professional firm has become the real skill to master — and the real risk to manage.
This article explains why the problem isn’t the AI tool you use, but the governance you have (or haven’t) built around it. And what to do in practice.
- AI slashes the cost of production, but shifts the cost of verification onto the professional who signs.
- An AI-generated error can be formally perfect and cognitively convincing: it’s harder to catch than an obvious mistake.
- Professional responsibility stays with whoever signs, whatever tool was used to produce the document.
- Not all of a firm’s activities carry the same level of risk: AI governance must be proportionate to the potential harm.
- Automation without strategy doesn’t increase productivity: it moves the bottleneck and builds up an invisible verification debt.
- Effective human oversight isn’t a rubber stamp: it requires time, expertise and observable procedures.
In this article
- Verification debt: the hidden cost of AI in the firm
- Who is responsible for errors in an AI-generated document?
- Automation bias: why AI convinces even when it’s wrong
- Which of a firm’s activities can really be delegated to AI?
- How to structure AI governance in the firm: strategy before the tool
- What happens if a client suffers harm from an AI-generated document?
- The Ovia view
- Frequently asked questions
Verification debt: the hidden cost of AI in the firm
There’s a concept worth keeping in mind every time you open a generative AI tool: verification debt. It’s well described in an analysis published by Cybersecurity360: when you drastically cut the cost of producing information, you risk making the cost of verifying it explode.
The dynamic is simple. A staff member takes ten minutes to write an email; with AI they produce it in thirty seconds. But the recipient still has to read and assess it for the same time as before. A professional generates five analyses in an afternoon instead of one: someone still has to establish whether those analyses contain correct information. If verification isn’t done — or is done badly — the productivity gain is only apparent. The bottleneck has simply moved.
The problem is even more insidious in a professional firm, because AI output doesn’t look wrong: it’s formally correct, grammatically flawless, convincingly structured. An obvious error is easy to catch. A plausible one — a partially quoted rule, a slightly inaccurate rate, an outdated interpretation of case law — takes specific expertise to spot. And that’s exactly the kind of error an AI model can produce without any warning sign.
Who is responsible for errors in an AI-generated document?
The short answer is: whoever signs it. And that won’t change with new regulations, because professional responsibility is structurally tied to registration with the professional body, the mandate received from the client and the duty of care. AI isn’t a legal person: it can’t be sued, has no professional indemnity insurance and answers to no professional body.
If an accountant prepares an incorrect tax return using an AI tool and the client suffers harm — penalties, interest, disputes — the accountant is responsible. If a lawyer drafts a contract with a void clause generated by a language model, the lawyer answers for it. Italian Law 132/2025 on AI disclosure obligations in professional firms has already introduced new transparency obligations, but it hasn’t shifted responsibility: it has made it more visible.
This awareness shouldn’t lead to giving up AI — that would waste a tool that, used well, genuinely improves the work. It should lead to a more serious question: how is the verification process structured in my firm? Who checks, when, on which types of output and with what traceability?
- Thinking that “I used a tool” reduces professional responsibility. It doesn’t: the signature is always the professional’s, not the software’s.
- Confusing the presence of a human in the process with real oversight. An overloaded professional approving dozens of AI outputs a day isn’t exercising judgement: they’re signing blank cheques.
- Not documenting the verification process. If a dispute arises and there’s no record of who checked what and when, the professional’s defence becomes much harder.
- Treating all AI output the same way. A draft internal note has a completely different risk profile from a tax opinion or a contract for a client.
Automation bias: why AI convinces even when it’s wrong
There’s a cognitive phenomenon that makes verifying AI output harder than it seems: automation bias, the tendency to trust output from an automated system more than output from a human being. Language models amplify it, because they don’t just return a figure or a number: they argue, structure and use fluent, persuasive language.
As an analysis published in Agenda Digitale on healthcare shows, giving a professional an AI system doesn’t automatically improve the quality of decisions. Access to a powerful tool can create an augmented professional, but it can also create a distracted one, anchored to the first suggestion and ill-prepared to challenge it. The same dynamic applies perfectly to a professional firm.
A wrong answer that is well worded is cognitively more dangerous than an obviously anomalous figure, because it reduces the reader’s inclination to question it. Automation bias doesn’t stem only from trust in technology: it stems from fatigue, lack of time and the fact that AI always offers an immediately available solution. When you’re under pressure — tax-return season, filing deadlines, a hearing tomorrow morning — the temptation not to check is at its highest.
How it often happens today
Formal oversightSubstantive oversight
Recommended approachWhich of a firm’s activities can really be delegated to AI?
Not all of a firm’s activities have the same risk profile, and AI governance must be proportionate to the potential harm. The principle is simple: the greater the impact of an error, the more thorough the verification must be. But that also means there are areas where AI can work with very light oversight, freeing up time for high-risk activities.
Managing incoming documents — collection, classification, automatic reminders for what’s missing — is an example of a low-risk activity where automation can go a long way: even if the system makes a categorisation error, the harm is limited and reversible. Similarly, transcribing and summarising meetings or calls is an activity where AI can produce raw output that the professional uses as a starting point, not as final text.
Conversely, a tax opinion, an expert report, a legal brief or a contract for a client require substantive verification against primary sources — not just a read-through for consistency. The distinction isn’t between “I use AI” and “I don’t use AI”: it’s between different levels of assurance applied consistently with the risk.
A risk map for the professional firm
- ✓Document collection and classificationLow risk, high volume. AI can handle it autonomously with periodic oversight.
- ✓Transcribing and summarising calls and meetingsLow risk. The output is a starting point for the professional, not the final product.
- ✓Drafts of standard client communicationsMedium risk. Requires reading and explicit approval before sending.
- ✕Regulatory analysis and tax opinionsHigh risk. Mandatory checking against primary sources, not just the consistency of the generated text.
- ✕Contracts and legally relevant documentsHigh risk. The professional’s signature means full responsibility for the content.
- ✕Tax returns and deadline-bound filingsHigh risk. Errors have direct, measurable consequences for the client.
How to structure AI governance in the firm: strategy before the tool
The central point that emerges from all the analysis on this subject is this: we are automating production much faster than we are automating verification. And the problem can’t be solved by putting a second AI model in charge of checking the first, because that would build a chain in which nobody really owns the result.
As Agenda Digitale’s analysis of AI writing stresses, the real question isn’t whether content was produced with AI or not: it’s who takes responsibility for it. If you sign a document, you’re responsible for what it contains — whatever tool was used to produce it. Applied to a professional firm, this principle leads to an operational conclusion: AI governance isn’t about tools, it’s about processes.
Effective governance answers concrete questions: who in my firm is authorised to use AI for which types of output? Who checks, with what method and how quickly? Where is the verification process recorded? What happens if the output is changed after verification? How are errors that get caught handled? These questions don’t require sophisticated technology: they require a strategic decision about how your firm wants to work. The European AI Act, in article 14 on high-risk systems, goes exactly in this direction: human oversight must be effective and proportionate to the risk, not a rubber stamp on a decision already built elsewhere.
Map activities by risk levelPhase 1 — Strategy
Separate high-impact outputs (opinions, contracts, tax returns) from low-risk ones (transcripts, standard communications). The level of verification must be proportionate.
Define who signs and who checksPhase 2 — Roles
For each type of AI output, decide who is authorised to generate it and who is responsible for final verification. For high-risk activities it shouldn’t be the same person.
Build documented verification proceduresPhase 3 — Process
Create checklists by document type: sources to consult, items to check, a record of who approved and when. To be real, oversight must leave observable traces.
Measure the real cost of automationPhase 4 — Measurement
Count not only the time saved in production, but also the time spent verifying, correcting and handling errors. Only the net balance is real productivity.
Review and update after every change of toolPhase 5 — Maintenance
Every AI model update or change of tool can alter output quality. Governance isn’t a one-off document: it’s an ongoing process.
What happens if a client suffers harm from an AI-generated document?
It’s the question few ask before it happens. The practical answer is that the client can take action against the professional for contractual or non-contractual liability, exactly as they would if the document had been written by hand. The tool used to produce it is not a mitigating circumstance: indeed, with AI regulation evolving fast, it could become an aggravating one if the professional hasn’t met transparency and verification obligations.
The risk isn’t only legal. It’s reputational. A firm that gives a client a tax opinion based on a repealed rule — generated by AI and not checked — doesn’t just lose the case: it loses the client, and with them the word of mouth. In a sector like professional services, where trust is the real asset, an error of this kind costs far more than the damages.
The good news is that the solution doesn’t require giving up AI or going back to working as twenty years ago. It requires doing something professionals do better than anyone: applying judgement, method and responsibility — this time to processes involving automated tools too. For anyone who wants to explore how Ovia Second Brain can support the traceability of decisions and the management of a firm’s internal knowledge, it’s the right place to start.
The Ovia view: automation without governance is a professional risk
At Ovia we work every day with professional firms that want to use AI seriously. The question they ask us most often isn’t “which tool should I use?” — that comes later. The right question is: “what should I automate, who stays responsible and how do I measure it?”.
Our position is that strategy and security come before the tool. Helping a firm produce more documents with AI without having defined who checks them and how isn’t a service: it’s a risk dressed up as efficiency. That’s why every Ovia project starts from a map of activities, the definition of verification roles and the choice of what not to automate — not just what to automate.
The tools we build are designed to support this governance, not to get around it. From document management with status tracking, to structured capture of decisions made on calls or in meetings, to email handling with explicit approval before sending: every automation has a visible, documented human checkpoint. Because the professional’s signature still counts — and must go on counting.
Frequently asked questions
Can I trust what AI produces without rechecking everything?
It depends on the type of output and its potential impact. For low-risk activities — transcripts, document classification, standard communications — light oversight may be enough. For tax opinions, contracts or deadline-bound filings, checking against primary sources is essential: formally correct AI output can contain plausible errors that are hard to catch without a critical read.
Who is responsible for errors in an AI-generated document?
The professional who signs it. Professional responsibility doesn’t transfer to the tool used to produce the document: it stays with whoever holds the client’s mandate and is registered with the professional body. If harm occurs, the client can act against the professional for contractual or non-contractual liability, regardless of whether the text was generated by AI.
How do I avoid losing all the time saved to checking every AI output?
The secret is to tailor the level of verification to the risk, not to apply the same check to everything. Build checklists by document type, decide which outputs need checking against primary sources and which don’t, and create documented procedures that make verification quick and systematic — not a generic read-through every time.
Which of the firm’s activities can I really delegate to AI without significant risk?
High-volume activities with low error impact are the most suitable: document collection and classification, call and meeting transcription, drafts of standard communications, automatic reminders. Activities where an error has direct consequences for the client — opinions, contracts, tax returns — always require substantive verification by the professional.
How should a professional firm structure oversight of AI tools?
By defining for each type of output: who is authorised to generate it, who is responsible for verification, with what method (checklists, comparison with primary sources) and where approval is recorded. Effective oversight isn’t a rubber stamp: it leaves observable traces and separates who produced from who verified.
AI can make mistakes I don’t notice: how do I protect myself?
By building verification processes that don’t rely only on the internal consistency of the generated text. AI output can be formally flawless and contain a substantive error — a partially quoted rule, an outdated rate. Effective verification compares the output with primary sources (legislation, case law, official guidance) rather than just reading for fluency.
What happens if a client suffers harm from an AI-generated document?
The client can take action against the professional exactly as they would for a traditionally drafted document. Using AI isn’t a mitigating circumstance, and as regulation evolves — between the AI Act and Italian Law 132/2025 — it could become an aggravating one if the professional hasn’t met transparency and verification obligations. Documenting the checking process is therefore a concrete form of professional protection.
Conclusion
Using AI in professional firms is already a reality — and it makes sense to do so. But the real advantage isn’t measured in documents produced per minute: it’s measured in correct decisions, protected clients and responsibility managed with method. AI that produces quickly and a professional who verifies competently aren’t in contradiction: they’re the two halves of a working process.
What separates firms that profit from AI from those exposing themselves to growing risks isn’t the tool they use. It’s the governance they’ve built around it: who signs, who checks, how it’s recorded, what isn’t automated. When producing becomes almost free, verifying becomes the real value — and the professional’s signature must go on meaning something.
If you want to understand where to start building this governance in your firm, the first step is to map your activities by risk level and define the verification roles. Everything else — tools, automations, integrations — comes after.
Ovia systems for this topic
Tailor-made solutions that solve exactly the problem discussed in this article.
Ovia Second Brain
It centralises the decisions, notes and information linked to each client: when AI produces output that needs checking, the professional finds in one place the history of previous decisions and the context needed for substantive — not just formal — verification.
Discover Second BrainDocumentsOvia Documents
It automates the collection and checking of incoming documents with full status tracking: every action is logged, reminders go out only for what’s really missing, and the professional keeps visibility and control without handling every step by hand.
Discover DocumentsVoiceOvia Calls
Call and meeting transcripts and summaries turned into tasks and deadlines: a concrete example of low-risk automation where AI output is a starting point for the professional, not a final document — exactly the model of safe delegation described in this article.
Discover CallsSources
- AI, il costo nascosto della produttività: quando generare costa meno che verificare — Cybersecurity360
- Testi scritti con l’AI: la caccia al colpevole sbaglia bersaglio — Agenda Digitale
- Più veloce, ma chi verifica? Il conto dell’AI in sanità — Agenda Digitale
- L’uomo nell’era dell’AI: il pericolo è delegare giudizio e responsabilità — Agenda Digitale
An article by the Ovia editorial team, written with the support of artificial intelligence tools from the sources cited, which remain the property of their respective authors. Translated from the Italian original. This information is for general guidance and does not constitute legal or tax advice. Corrections: oviaitalia@gmail.com.