How to write an AI use policy for a small firm

Your team is almost certainly using AI already, whether or not anyone has said they can. A short, clear policy protects your clients and your firm without slowing people down. Here is what to put in it and how to get it done in a week.

Why you need one now

In most small firms AI arrives quietly. Someone uses a free chatbot to tidy an email, someone else pastes in a client document to get a summary. None of it is malicious, but without agreed rules nobody knows what is safe, and client information can end up somewhere it should not be.

A policy does not need to be long or legalistic. The best ones fit on two pages, use plain English and answer the questions your staff actually have.

What to include

Cover these areas, in this order, and keep each one short.

• Purpose and scope: who the policy applies to and why it exists.
• Approved tools: which tools staff may use, and that they must use business accounts, not personal ones.
• Data rules: what must never be entered, such as client personal data or confidential matters, unless a tool has been specifically approved for it.
• Checking output: a person reviews anything AI produced before it is sent, filed or relied on, especially facts, figures and references.
• Being open with clients: when and how you tell clients that AI was used in work for them.
• Approving new tools: a simple route for asking to use something new, and who decides.
• Training: what everyone needs to know before using AI at work.
• Review date: AI changes quickly, so review the policy at least every six months.

Writing it in a week

A realistic plan for a busy small firm.

1. Find out what is in use: Ask your team, without blame, which AI tools they use and for what. You will learn more in a 20 minute conversation than from any audit.
2. Draft the policy: Use the headings above. Write it the way you would explain it to a new joiner, in two pages or fewer.
3. Test it on real cases: Walk through five real situations from your work and check the policy gives a clear answer for each.
4. Brief the team: Share it in a short session, answer questions and agree who people should ask when they are unsure.

Common mistakes

These are the problems we see most often.

• Banning AI outright. People use it anyway, just without guidance.
• Copying a large company template. It will be too long and nobody will read it.
• Listing tools without saying which accounts or settings to use.
• Forgetting to say who checks AI output before it reaches a client.
• Writing it once and never reviewing it.

Want help writing yours?

We can draft your AI use policy with you, test it against your work and brief your team, usually within a couple of weeks. Find out about our consulting for small firms, or talk to an AI specialist.