What is Professional Conduct Rules?

Why It Matters

Every licensed profession has a conduct code, and each is written to the same shape: the professional owes the client competence, confidentiality, and a reasonable fee, and remains responsible for what subordinates and services produce. When a tool starts producing the first draft, those duties do not change, and the useful question becomes which one the workflow now has to satisfy.

That is what makes a conduct code actionable for engineering. Each duty implies something a system can support or undermine, and the differences between professions matter less than the pattern.

What the Codes Have in Common

Competence. Reasonable understanding of the tools used to deliver the service, including their limits. Practical translation: know what the system is good at, know its failure modes, and document that understanding.

Confidentiality. Client information is protected, which puts every component that ingests it inside a disclosure question. Practical translation: an ethical wall enforced at retrieval, and an agreement covering each vendor in the path.

Supervision. Responsibility for what non-professionals and services produce. Practical translation: verification of output before it is relied on, with a named person accountable.

Fees. A reasonable fee consistent with the work done, which is where AI-assisted time becomes a record-keeping problem rather than a pricing opinion.

Candour. What is issued under the firm’s name has to be accurate, and the professional’s signature is where that obligation lands. The enforcement record is public: unverified output has produced sanctions rather than warnings.

Where the Codes Differ

The substance of the duties is similar; the vocabulary and the enforcement are not. Law moved first, with ABA Formal Opinion 512 becoming the reference other professions are measured against. Accounting adds independence rules that a shared model or a shared index can quietly undermine. Advisory and consulting firms are bound mainly by contract and by client-imposed terms, which puts the obligation in the engagement letter rather than in a licensing body. Several jurisdictions have issued their own AI guidance on top of the national codes, so a single standard does not exist.

Where It Breaks

The codes describe duties. Controls are what produce the evidence that a duty was met on a specific engagement, and a firm can restate every rule in a policy and still have no mechanism that shows it. Policies describe intent; controls produce records.

The second break is where the duty sits. It attaches to the professional, and buying a governed platform does not transfer it. The record has to show the professional’s own act of review rather than the vendor’s controls standing in for it.

How Flytebit Handles It

We translate the duties into controls that produce evidence: verification per claim before signature, access filtered by engagement and role, and a decision record that names the signer and the sources. Jurisdiction-specific rules are configuration rather than a rewrite, since the verification and disclosure behaviour is driven by policy the runtime enforces. The industry application is on our Professional Services page, and the enforcement design is in Governing Agentic AI.