AI in Professional Advice: Where Human Review Belongs

Artificial intelligence can shorten research, summarise documents, translate correspondence and produce a useful first draft in seconds. It can also invent a source, miss a decisive exception, expose confidential information or turn an uncertain inference into a confident recommendation.

For professional advisers, the question is therefore not whether a human should be “in the loop”. The useful question is where a qualified person must intervene, what they must verify and whether they have the authority to reject the system’s output.

That distinction matters in legal, tax, investment, immigration, corporate and residency work. Clients do not buy a fluent paragraph. They rely on advice that is accurate for their facts, current on the relevant date and delivered by a person or firm accountable for the result.

This guide explains how an advisory business can use AI without confusing automation with professional judgement. It reflects the EU framework in force on 4 October 2026 and includes Hungary-specific regulatory context. It is a governance guide, not legal advice for a particular deployment.

The governing principle: AI may assist, but it should not own the conclusion

A sensible workflow separates three functions:

1. Production support: AI helps organise, translate, summarise or format information.
2. Analysis support: AI identifies possible issues, compares materials or proposes a preliminary answer.
3. Professional decision: an authorised person determines what the facts mean, which rules apply and what the client should do.

The closer a task moves toward the third category, the stronger human review must become. A spelling correction and a residence-eligibility assessment should not pass through the same controls.

Human review is meaningful only when the reviewer:

• has the expertise to identify an error;
• sees the relevant source material rather than only the AI-generated answer;
• understands the tool’s limits and the purpose for which it was approved;
• has enough time to perform a real check; and
• can change, reject or stop the output without pressure to follow it.

A person who merely clicks “approve” is not an effective control.

Not every use of AI is “high-risk” under the EU AI Act

The EU AI Act uses a risk-based and role-based structure. The legal classification depends on the system’s intended purpose, the context in which it is used and whether the organisation is acting as a provider, deployer, importer or another regulated actor. It does not classify every use of generative AI in an advisory office as high-risk.

For example, using a general-purpose tool to improve the wording of an internal draft will usually raise different issues from deploying a system to assess a person’s eligibility, creditworthiness or employment prospects. The second use may affect rights or access to important services and therefore requires a much more careful classification analysis.

The distinction is particularly important in immigration work. Annex III of the AI Act covers specified systems used by or on behalf of competent public authorities in migration, asylum and border-control management, including certain systems used to assess individual risk or assist with visa, asylum and residence-permit decisions. That does not automatically make an adviser’s ordinary drafting or document-management tool a high-risk system. Its actual intended purpose and use still need to be assessed.

The current timetable also needs care. Following the 2026 AI Omnibus amendments, most of the AI Act applies from 2 August 2026, including specified transparency requirements. The rules for Annex III high-risk use cases are scheduled to apply from 2 December 2027, while rules for high-risk systems embedded in regulated products are scheduled for 2 August 2028. Prohibited practices and AI-literacy obligations began applying earlier. The European Commission maintains the current AI Act implementation timetable.

Delay of a particular high-risk rule is not permission to ignore existing law. GDPR, professional rules, consumer-protection law, anti-discrimination law, contractual duties and sector-specific regulation may already govern the same activity.

Where human review should be mandatory

1. Before confidential or personal data enters the tool

The first review point comes before the prompt is sent.

Advisory files may contain passports, addresses, family information, financial records, health data, tax details, criminal-record documents, commercial secrets and privileged communications. Staff should not paste this material into an unapproved public tool merely because it is convenient.

Before a system is used, the organisation should establish:

• what data the tool will receive;
• the legal basis and purpose for processing personal data;
• whether the data can be removed, masked or pseudonymised;
• whether the provider retains prompts or uses them for model training;
• where data is stored and transferred;
• which subprocessors can access it;
• how long inputs, outputs and logs remain available;
• whether a data-processing agreement and transfer safeguards are required; and
• whether the use is likely to require a data-protection impact assessment.

The GDPR principles of purpose limitation, data minimisation, accuracy, security and accountability remain relevant whether the output is produced by a junior employee, a rules engine or a large language model. The organisation using the tool cannot outsource its controller obligations by accepting a vendor’s default settings.

2. When facts are extracted from client documents

AI can help extract names, dates, ownership percentages and transaction values. A human should verify every fact that can change eligibility, tax treatment, investment suitability, a filing deadline or a compliance decision.

This review should compare the output with the original document. It should also distinguish between:

• facts expressly stated in the document;
• calculations derived from those facts;
• assumptions made because information is missing; and
• inferences suggested by the model.

If these categories are blended together, a plausible assumption can quietly become a “fact” in the client file.

3. When law, regulation or official guidance is researched

An AI-generated legal summary is a research lead, not an authority. The reviewer should open the primary source, confirm that it is authentic, check its effective date and read the surrounding provisions, exceptions and transitional rules.

For cross-border work, the reviewer must also confirm the jurisdiction and hierarchy of the source. An EU regulation, a directive, a national act, administrative guidance and a commercial blog do not have the same legal status. A rule applicable to public authorities may not apply in the same way to a private adviser. A future commencement date should not be presented as current law.

A defensible research record should identify the source URL or citation, access date, relevant provision and the person who checked it.

4. When the output recommends a course of action

Recommendations are where context matters most. A model may produce a generally reasonable answer while missing a client-specific factor such as nationality, residence history, family status, source of funds, risk tolerance, existing structure or deadline.

Qualified human approval should therefore be required before AI-assisted output becomes:

• legal, tax or regulated investment advice;
• an assessment of immigration or residence eligibility;
• a suitability or risk recommendation;
• a KYC, source-of-funds or sanctions conclusion;
• a decision to accept, reject or escalate a client;
• a material filing, declaration or application; or
• a client-facing statement of rights, costs, timing or likely outcome.

For investment services, this is not simply a matter of good drafting. ESMA’s statement on AI and investment services says that firms using AI remain subject to MiFID II requirements, including organisational duties, conduct rules and the obligation to act in the client’s best interests. It also highlights bias, opaque decision-making, overreliance, privacy and security as material risks.

5. Before the client receives or relies on the output

The final reviewer should check four things:

Accuracy: Are the facts, calculations and sources correct?

Completeness: Are decisive exceptions, risks and missing documents clearly identified?

Communication: Does the text separate confirmed conclusions from assumptions, estimates and unresolved questions?

Authority: Is the reviewer authorised and qualified to approve this type of work?

The review should also consider whether the client needs to be told that AI was used. The answer depends on the use case and applicable rules. Since 2 August 2026, Article 50 of the AI Act imposes transparency duties for specified systems and content, including direct interaction with certain AI systems and particular AI-generated or manipulated content. Sectoral and professional rules may demand further transparency. A generic “AI was used” disclaimer does not correct inaccurate or inadequately reviewed advice.

A proportionate review matrix

AI-assisted task	Main risk	Minimum human control
Grammar, formatting and style	Meaning changes during editing	Author checks the final version against the approved text
Translation	Legal or technical meaning is distorted	Fluent reviewer checks terminology, names, numbers and operative clauses
Meeting or document summary	Omission or invented detail	Reviewer compares the summary with the recording or original document
Source discovery	False, outdated or irrelevant citation	Subject specialist opens and verifies every material primary source
Calculations and comparisons	Wrong assumptions, units or formula	Reviewer reconstructs material calculations and records assumptions
Draft client communication	Overstatement, missing qualification	Responsible adviser approves accuracy, tone and scope before sending
Eligibility, suitability or risk assessment	Significant effect on the client	Qualified decision-maker performs an independent assessment and documents reasons
KYC, AML or sanctions support	Bias, false match or missed risk	Trained compliance professional reviews evidence and controls escalation or rejection
Final advice or application	Legal, financial or procedural harm	Authorised professional signs off the complete file and can reject the AI output

The matrix should be adapted to the firm’s actual activities. The same tool can sit in different risk tiers depending on the task, data and consequence.

A practical AI-governance checklist for advisory firms

Define the use case

• Record what the system is intended to do and what it must not do.
• Identify who provides and who deploys the system.
• Determine whether the use may fall within a prohibited, transparency or high-risk category under the AI Act.
• Map other applicable rules, including GDPR and sector-specific obligations.

Approve the data

• Classify the information that may be entered.
• Prohibit unapproved use of sensitive, privileged or confidential material.
• Apply minimisation, masking and access controls.
• Review the vendor’s retention, training, security, subprocessor and international-transfer terms.
• Complete a DPIA where the GDPR threshold is met.

Design the human control

• Name the role responsible for each review gate.
• Give the reviewer access to the original facts and authoritative sources.
• Set escalation triggers for uncertainty, conflict, missing evidence and high-impact decisions.
• Give the reviewer authority to disregard, override or stop the tool.
• Prevent the same person from creating and approving a high-impact output where separation is proportionate.

Make the work traceable

• Record the tool and approved version used.
• Preserve material inputs, assumptions, sources and significant outputs where lawful and necessary.
• Record who reviewed the work, what was checked and when.
• Maintain version control so the final advice can be distinguished from the machine draft.

Test and monitor

• Test the system on representative scenarios before use.
• Look for systematic errors across languages, nationalities and client groups.
• Track corrections, incidents, complaints and near misses.
• Reassess the workflow when the model, vendor terms, law or intended use changes.
• Suspend use when the system behaves outside its approved purpose or produces an unacceptable risk.

Train the people

Article 4 of the amended AI Act requires providers and deployers to take measures supporting the AI literacy of staff and others operating or using AI on their behalf. Training should be relevant to the person’s role and the system’s context. A receptionist using a transcription tool, a compliance officer reviewing risk flags and an adviser drafting a legal analysis do not need identical training.

At a minimum, users should understand hallucination, automation bias, confidentiality, data minimisation, source checking, escalation and the limits of the approved use case.

What the EU rules mean for a Hungarian advisory business

The AI Act applies directly across the EU, while national bodies handle important elements of supervision and coordination. According to Hungary’s National Authority for Data Protection and Freedom of Information, Act LXXV of 2025 and Government Decree 344/2025 established the domestic framework: the Hungarian Artificial Intelligence Council may issue implementation guidance and opinions; the Minister for National Economy performs the designated market-surveillance and single-contact-point functions; and the National Accreditation Authority is the notifying authority. NAIH remains central where personal-data processing is involved. The authority summarises this structure on its EU digital legislation page.

For a Hungarian firm, the practical lesson is that “AI compliance” is not a single filing with one authority. A deployment may involve AI Act classification, GDPR accountability, professional or financial-services supervision, consumer protection, cybersecurity and contractual risk at the same time.

Short FAQ

Can an adviser use ChatGPT or another general-purpose AI tool for client work?

Potentially, but only within an approved use case and with controls appropriate to the data and consequence. Confidential or personal data should not be entered until the organisation has assessed the legal basis, vendor terms, security, retention and transfer arrangements. Material outputs still require qualified review.

Does human review automatically make an AI-assisted decision compliant?

No. Review must be effective, not ceremonial. The reviewer needs competence, access to the evidence, sufficient time and authority to change or reject the output. Other requirements—such as a lawful basis under GDPR or sector-specific suitability duties—must also be met.

Must every AI-assisted document be labelled as AI-generated?

No single rule requires a label on every AI-assisted document. Article 50 of the AI Act applies to specified interactions and types of AI-generated or manipulated content, and it contains conditions and exceptions. Professional, consumer and contractual duties may require additional disclosure. The use case must be assessed rather than covered by a universal disclaimer.

Who is responsible when an AI-generated recommendation is wrong?

Responsibility depends on the facts, the parties’ legal roles, the applicable professional and sector rules, data-protection responsibilities, contracts and the nature of the loss. Buying an AI service does not by itself transfer an adviser’s duties to clients. The safest operational assumption is that the firm must be able to explain and defend the advice it approves.

The standard to aim for

The best AI governance does not force a human to repeat every mechanical task. It places human judgement at the points where confidentiality, evidence, rights, money or professional responsibility are at stake.

Used this way, AI can improve speed and consistency without becoming an invisible decision-maker. The adviser remains responsible for the essential work: understanding the client, testing the evidence, applying the correct rule, explaining uncertainty and standing behind the conclusion.

Legal and regulatory information is current as of 4 October 2026 and is provided for general information only. Organisations should obtain advice on their specific systems, data and regulated activities.