The Provenance Ledger: Keeping AI-Assisted Research Defensible in UK Advisory Work

AI research tools have become a normal part of the professional toolkit. They can summarise guidance, draft a first-pass comparison, suggest lines of enquiry and turn a vague question into a structured research plan. The difficulty is not that they are useless. It is that they are fluent. A plausible summary can travel through a firm faster than anyone can check it, and by the time it reaches a client it may have acquired the appearance of a verified source.

The practical response is not to ban the tools or to pretend that every output needs a formal audit. It is to keep a lightweight provenance ledger: a record of what was asked, what the tool returned, which sources were checked and what remains unverified. The principle is simple enough to put on a sticky note: citation or it didn't happen.

The failure mode: fluent summaries, uncertain provenance

The characteristic failure is not a dramatic hallucination. It is a summary that sounds reasonable, cites a regulator or a statute, and cannot produce the paragraph that supports the claim. A colleague then reuses the summary in a client note. The note is forwarded. The original prompt is lost. No one can say whether the point was checked against the primary source or simply generated.

For UK professionals, the risk is compounded by jurisdiction and currency. Guidance changes, thresholds are updated and devolved rules can differ. An AI tool may blend sources from different years or different parts of the UK without signalling the join. A source log will not solve that by itself, but it makes the join visible.

What the ledger must capture

The ledger should be short enough to complete in the normal course of work. A spreadsheet, a database or a structured note is fine; the format matters less than the discipline. Record:

• the date and the person responsible for the research;
• the question or brief, in one or two sentences;
• the tool and model used, where known;
• the prompt or a short summary of it;
• the outputs relied on, not every output generated;
• the sources the tool cited;
• the verification status and the primary source checked;
• the date of verification and the reviewer;
• whether the material is internal only or client-facing;
• the retention period and location.

This is not a transcript. It is a chain of custody for ideas. If a client asks how a point was reached, the firm should be able to show the route without reconstructing it from memory.

Verification tiers

A simple tiering system prevents the ledger from becoming a binary choice between trusted and untrusted. Four tiers are usually enough:

• Tier 1: verified against the primary source, with the relevant passage or page recorded.
• Tier 2: corroborated by an authoritative secondary source, with the limitation noted.
• Tier 3: unverified lead, suitable for internal discussion only.
• Tier 4: do not use, because the source cannot be found, is out of date or is outside the relevant jurisdiction.

The tier should be visible in the working document. A Tier 3 note that is clearly labelled is far less dangerous than an unlabelled paragraph that everyone assumes has been checked.

When to verify

Verification should be proportionate to use. Brainstorming can remain at Tier 3. Anything that leaves the firm should be at Tier 1 or, at a push, Tier 2 with a clear caveat. The following triggers should always prompt a check against the primary source:

• a reference to legislation, regulation or official guidance;
• a numerical threshold, deadline or penalty;
• a quotation attributed to a named person or body;
• a statement about current market practice;
• a claim that a document or rule has changed;
• any point that will appear in a client-facing note, proposal or board paper.

If the primary source cannot be produced, the claim should be rewritten or removed. A citation that cannot be opened is not a citation; it is a decoration.

Labelling unverified material

Labels need to survive the journey from draft to final. Use a consistent prefix in internal documents, such as AI-LEAD or UNVERIFIED, and remove it only when the tier changes. In client-facing work, do not include unverified material at all. If a caveat is genuinely necessary, state the limitation in plain language and explain what has and has not been checked.

The label should also record the reason for the tier. A note that says 'Tier 3: source cited by tool could not be located' is more useful than a bare status. It tells the next reviewer what needs to happen.

The client-facing test

Before any AI-assisted material is used externally, apply four questions. Can a colleague reproduce the point from the sources recorded? Can the firm produce the relevant passage, not just the citation? Is the source current as at the date of use? Is it applicable to the right jurisdiction and the right type of client?

If the answer to any of these is no, the material is not ready. This test is deliberately stricter than a general reasonableness check because the cost of an unchecked claim is rarely limited to the paragraph in which it appears. It can affect advice, engagement terms and professional indemnity notifications.

Retention, supervision and data protection

The ledger should follow the firm's retention policy for research and client work. A common approach is to retain it with the matter file or the project record, so that it is available if the work is later reviewed. Supervisors should sample the ledger monthly, not to catch people out but to check that the tiers are being applied consistently.

Data protection needs attention too. Prompts can contain client information, personal data or confidential commercial terms. The ledger should record the tool used and the type of data shared, and the firm should have a clear rule on what may not be entered into external systems. The source log is not a substitute for a data protection assessment; it is a complement to it.

A simple workflow

The workflow can be reduced to seven steps: brief, prompt, capture, verify, label, review and archive. Brief the question precisely. Prompt with the source constraints in mind. Capture only what is used. Verify against the primary source. Label the tier. Review before external use. Archive with the matter or project record.

None of this requires a large system. It requires a habit and a named owner. The firms that manage AI research well are unlikely to be the ones with the most elaborate policy; they will be the ones where a colleague can ask 'where did this come from?' and receive an answer within a minute.

The ledger as a professional habit

AI tools will continue to change. Models will improve, citations will become more reliable and interfaces will become more embedded in ordinary software. The provenance question will remain. UK professionals are judged on the quality of their advice and the defensibility of their work, not on the speed of their drafting. A source log is a small administrative habit that protects both.

The ledger does not need to be perfect. It needs to be honest, current and proportionate. If a point cannot be traced, it should not be presented as fact. That is not a technophobic position; it is the same standard that has always applied to good research, now applied to a faster tool.