If your staff use AI tools, they are already making decisions about your clients’ information. A short written policy will turn those private decisions into shared rules, and one page is enough.
Start with the rule that matters most
Do not put confidential client information into an AI tool unless the firm has approved that tool for that purpose.
Everything else in the policy is detail around that rule.
A starting template
- Approved tools: list the AI tools the firm has approved, and for what. Anything not on the list needs approval first.
- What counts as confidential: client names tied to their matters, financial figures, identification numbers, privileged or sensitive communications, and anything covered by a confidentiality agreement.
- What is fine: drafting generic text, summarizing public material, brainstorming, and formatting, where no confidential information is included.
- A person checks the output: AI tools make mistakes, invent facts and sometimes sound very sure. A named person reviews anything that goes to a client or into a record.
- No decisions by AI alone: AI does not decide anything about money, legal rights or a client’s records.
- Tell us if something goes wrong: if confidential information is shared by mistake, say so straight away. Reporting a mistake early is safer than hoping nobody notices.
- Review: the policy is reviewed every six months, because the tools change quickly.
Check the settings as well as the rules
Rules help, but settings matter too. Check whether the tool keeps your inputs, whether it uses them for training, and who in the firm can switch features on. Business plans often have stronger controls than free ones.
Make it real
Print it on one page, go through it with the team once, and keep it where people will find it.
If you would like help adapting this to your firm, or a short training session for your team, get in touch. This post is general information, not legal advice. Have a lawyer review the policy if your work involves privileged or regulated information.