[Firm name] AI policy
Version [1.0]. Owner: [name, role]. Approved by [name] on [date]. Next review: [date].
1. Why we have this policy
We want to use AI tools at work. They save time on letters, emails, research and checking. This policy explains how to use them safely, so our clients' and colleagues' personal data stays protected.
It applies to everyone who works for or with [Firm name], including partners, staff, contractors and temporary workers.
2. Approved AI tools
You may use these AI tools for work: [list each tool and plan, for example ChatGPT Business signed in with your work account, or Microsoft Copilot signed in with your work account].
For client work, use only the approved business plans above, signed in with your work account. They come with a contract with [Firm name] that covers our clients' data.
If you'd like to use a tool that isn't on the list, ask [name or role] first.
3. What must never go into AI
Never put these into an AI tool that isn't on the approved list:
- Personal data about clients, their customers or their staff: names, addresses, email addresses, phone numbers, dates of birth, bank details, National Insurance numbers or tax references.
- The most sensitive personal data, such as health, religion, ethnicity or criminal records (special category and criminal offence data).
Never put these into any AI tool, approved or not:
- Passwords, API keys, private keys or any other login details.
- Anything else listed in the profession sections below.
4. Personal accounts
You may use a personal or free AI account for general questions with no personal data in them, such as "explain the difference between a sole trader and a limited company".
Never use a personal or free account for client work. These accounts have no contract with [Firm name], and many can use what you type to train the provider's AI.
5. Checking what AI gives you
AI can be confidently wrong. You're responsible for anything you send, file or rely on, however it was written.
Check facts, figures, dates and references before you use them. Never present AI output as checked advice without checking it yourself.
6. If something goes wrong
If you think personal data has gone into an AI tool it shouldn't have, tell [name or role] straight away, on [phone or email]. Don't wait, and don't try to fix it alone. Nobody will be blamed for reporting a mistake.
Some breaches have to be reported to the Information Commission (ICO) within 72 hours of us becoming aware of them, so speed matters.
7. Training and confirmation
Everyone will be trained on this policy when they join and when it changes. We'll ask you to confirm you've read and understood it, and keep a record of when you did.
8. Review
[Name or role] will review this policy every [6 or 12] months, and whenever we approve a new AI tool or the law or guidance changes.
For accountancy practices (delete if not relevant)
- Never put UTRs, National Insurance numbers, payroll data or client bank details into an AI tool that isn't approved.
- Never put anything about a suspicious activity report, or a suspicion of money laundering, into any AI tool. Telling a client about a report can be the offence of tipping off (Proceeds of Crime Act 2002, section 333A).
For law firms (delete if not relevant)
- Never put confidential or privileged client information into an AI tool that isn't approved. Doing so may breach client confidentiality, and privilege may be lost for good.
- Check every case, citation and quotation that AI produces against the original source before relying on it.
- Follow the SRA's warning notice on the misuse of AI. Supervisors remain responsible for work done by the people they supervise.
For other small businesses (delete if not relevant)
- Never put customer lists, order details or staff records, such as payroll, sickness or HR notes, into an AI tool that isn't approved.
- Take extra care with anything about a person's health, which is special category data.
