Your staff are already using these tools. A policy written now is a policy; written later it is a remediation.
In most firms, someone is already summarising meetings or drafting emails with a general-purpose tool. Policies that begin by pretending otherwise get ignored.
Ask first, without consequences. Then write a policy that reflects reality.
Be specific. Drafting internal material, summarising a recorded meeting, and preparing research are different from generating client communications or anything that resembles a recommendation.
The line most firms draw: a human reviews and owns every output that leaves the firm.
Which tools may receive client information, and which may not receive it under any circumstance. This depends on the contract with each vendor — whether data is retained, whether it trains their models, where it is stored.
A named list of approved tools works better than a principle, because a principle gets interpreted optimistically at four in the afternoon.
Client communications are books and records regardless of what produced them. If a tool generates or transmits them, it sits inside your capture and supervision obligation.
The tool does not change what the record is. It changes how easily the record escapes your capture.
Name who owns the policy, how new tools get approved, and how often the list is reviewed. This category moves fast enough that an annual review is barely adequate.
Whether and how you tell clients. There is no single right answer yet, and the answer depends on what you are using it for.
The safe position: if a client would be surprised to learn how something was produced, say so in advance. Surprise is the thing that damages trust, not the technology.
By your compliance consultant or counsel. This is a genuinely unsettled area and a policy written from a website is a starting draft, not a programme.
Read next
Where AI actually helps →