AI use policy checklist

A checklist for a small regulated firm. Not legal advice. Have a lawyer review the final policy.

Scope

• Who the policy covers: partners, staff, contractors, interns.
• Which tools and accounts it covers, including personal accounts used for work.
• Which jurisdictions and regulators apply.

Permitted use

• Tasks where AI may be used with light review.
• Tasks where AI may be used with verification.
• Tasks where AI may assist but a human must decide.
• Tasks where AI must not be used at all.

Data

• Classify data: public, internal, confidential, client-sensitive.
• State what may never be pasted into a consumer tool.
• State where data is stored and whether it is used for training.
• Name the approved tools and the approval process for new ones.
• Cover client consent and professional secrecy obligations.

Human oversight

• Name who is accountable for AI-assisted work.
• Require a human check before anything leaves the firm.
• Require disclosure when AI contributed to client-facing work.
• Keep a record of prompts and outputs for high-risk tasks.

Vendors

• Review terms for data use, retention, and subprocessors.
• Check where data is processed.
• Check whether the vendor can delete data on request.
• Prefer local or private deployment where the risk justifies it.

Training

• Train staff on the policy, not just the tool.
• Include examples of what goes wrong.
• Refresh after a material change in tools or regulation.

Incidents

• Define what counts as an AI incident.
• Name who to tell and how fast.
• Keep a log.
• Review after every incident.

Review

• Set a review date, at least annually.
• Assign an owner.
• Record changes and why they were made.