What an AI policy needs to cover

Your staff are already using these tools. A policy written now is a policy; written later it is a remediation.

Published August 26, 2026

Start from what is already happening

In most firms, someone is already summarizing meetings or drafting emails with a general-purpose tool. Policies that begin by pretending otherwise get ignored.

Ask first, without consequences. Then write a policy that reflects reality.

Permitted and prohibited uses

Be specific. Drafting internal material, summarizing a recorded meeting, and preparing research are different from generating client communications or anything that resembles a recommendation.

The line most firms draw: a human reviews and owns every output that leaves the firm.

Client data

Which tools may receive client information, and which may not receive it under any circumstance. This depends on the contract with each vendor — whether data is retained, whether it trains their models, where it is stored.

A named list of approved tools works better than a principle, because a principle gets interpreted optimistically at four in the afternoon.

Records

Client communications are books and records regardless of what produced them. If a tool generates or transmits them, it sits inside your capture and supervision obligation.

The tool does not change what the record is. It changes how easily the record escapes your capture.

Review and accountability

Name who owns the policy, how new tools get approved, and how often the list is reviewed. This category moves fast enough that an annual review is barely adequate.

The disclosure question

Whether and how you tell clients. There is no single right answer yet, and the answer depends on what you are using it for.

The safe position: if a client would be surprised to learn how something was produced, say so in advance. Surprise is the thing that damages trust, not the technology.

Get it reviewed

By your compliance consultant or counsel. This is an unsettled area and a policy written from a website is a starting draft, not a program.