AI use policy
Built from what your team already does, so people follow it. Change every line that doesn’t fit.
1. What this covers
This policy covers how [Firm name] uses AI tools for work. It applies to everyone here, on any device used for firm business. It is owned by [name and role] and reviewed every [6 months].
2. Tools we use
We use the tools on our approved list, on the plans named there. Ask [the policy owner] before using a tool that isn’t on it. Personal accounts are not used for client work.
| Tool and plan | Approved for | Not for |
|---|---|---|
| [Tool, plan] | [Drafting, summarizing internal documents] | [Client financial information] |
| [Tool, plan] | [Meeting notes, with consent] | [Calls with clients who have not agreed] |
3. What never goes in
- Passwords, keys and other credentials, in any tool.
- Client information, unless the tool is on the approved list for it.
- [Anything a client contract or a regulator restricts].
- Personal information about staff or candidates, unless [the policy owner] has approved the use.
4. A person signs it off
AI output is a draft. The person who sends, files or relies on the work has read it, checked the facts and figures against their source, and is responsible for it. Work that would cause harm if it were wrong, such as [advice, figures, filings], is always reviewed by [role].
5. Telling clients
[Our position on telling clients, checked against our contracts]. Where a client contract forbids AI use, we don’t use it on that client’s work.
6. Recording meetings
We record or transcribe a meeting only when everyone in it has agreed. [Which meetings are never recorded].
7. If something goes wrong
If you think confidential information went into a tool it shouldn’t have, tell [name] the same day. Nobody is in trouble for reporting it. We would rather know.
8. Keeping this current
[The policy owner] re-checks the approved tools when a vendor changes its terms, and at least every [6 months]. Last reviewed: [date].
