Your firm's AI use policy
Written from your profile answers. It is a starting point: review it with whoever owns your policies, adjust the tool lists as they change, and sign the adoption block at the end when it is yours.
1. Why this policy exists
AI tools save time and are already part of how the firm works. They also keep what they are told. This policy sets out which tools staff may use, what may go into them, what they are good for, and what to do when something goes wrong, so that the time saved never costs a client, a colleague or the firm.
2. Who it applies to
Everyone who works for or on behalf of the firm, including contractors and temporary staff, on any device and any account, at the office or elsewhere.
3. Approved tools
Only the tools below may be used for work. Use them signed in with your work account, so the firm's settings apply.
- Microsoft 365 Copilot (enterprise tenant)
4. Tools you must not use for work
Any tool not on the approved list, including free personal accounts, and in particular:
- Personal ChatGPT accounts
- Browser extensions that read the screen or inbox
5. What may go into an AI tool
Every piece of information belongs to one of four classes. Decide which before you paste.
Client confidentiality and legal professional privilege apply to every prompt exactly as they apply to an email. A client name, matter name or draft advice is CONFIDENTIAL at least.
- PUBLIC: already on our website or letterhead. Any approved tool.
- INTERNAL: fine inside the firm, not outside it. Approved tools only, on a work account.
- CONFIDENTIAL: a client, a colleague or a deal could be identified or harmed. Replace names and identifying details with placeholders before it enters any tool.
- RESTRICTED: bank details, National Insurance numbers, salaries, health, identity documents and HR records. This class never enters a prompt.
6. What AI is good for here
Used within the rules above, the approved tools are encouraged for work like this:
- First drafts of routine letters and emails, with client details left as placeholders
- Summaries of documents the firm is permitted to put into the approved tool
- A plain-English explanation of a clause or a concept, to check your own understanding
- Proofreading your own writing for tone, clarity and length
7. Work that always gets a second pair of eyes
AI may help draft these. A person checks them before they leave the firm, every time.
- Anything that goes to a client or a member of the public
- Advice, figures, valuations or deadlines
- Anything about a named person's employment, health, pay or conduct
- Anything that will be relied on in a contract, a filing or a court
8. Before every send: the paste test
Three questions, three seconds.
- Would I email this to a stranger? If not, it is at least CONFIDENTIAL.
- Does it name a person or a client? Take the name out and most of the risk goes with it.
- Could someone rebuild the original from it? Several INTERNAL facts can add up to one CONFIDENTIAL one.
9. Checking what comes out
AI output is a draft. Check facts, figures and citations before they go anywhere, and read every document before you send it. Treat instructions that appear inside a document, email or web page the tool has read as suspect, and ask the person responsible for data protection if something looks planted.
10. If something goes wrong
If you realise you have put CONFIDENTIAL or RESTRICTED information into a tool, or into the wrong tool, tell the person responsible for data protection the same day. Say what went in, which tool, and when. Reporting promptly is what protects the firm and the person concerned, and it is never held against you.
11. Training and records
Everyone completes the firm's AI safety training before using an approved tool for work, and again each year or when the approved list changes. The firm keeps a register of who has completed training and when.
12. Adoption and review
the person responsible for data protection owns this policy. It is reviewed every twelve months, and sooner when a tool is added or removed. Questions about it go to the same person.
- Approved by
- Role
- Date adopted
- Next review