Staff AI policy builder for small practices

Your policy

Nothing is sent anywhere and nothing is saved. Copy it when it says what you mean.

A client confidence pasted into a personal account has left the firm's control. The decision is whether a personal account may touch a client matter at all. what we build for law firms.

The policy this page assembled, as plain text

STAFF USE OF GENERATIVE AI

Why this exists
For lawyers, ABA Formal Opinion 512 discusses professional duties when using
generative AI, including competence, confidentiality and communication.
Approving a tool does not approve every client matter or every data use.
Source: https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf

Purpose and scope
This policy applies to work performed for the practice using AI websites,
applications, browser extensions, coding assistants and automated agents. It
applies on work devices and whenever practice information is involved.

Approved tools and accounts
Use only tools and work accounts in the practice's approved-tool register.
Approval names the permitted tasks, data, settings and responsible owner. Do
not connect personal AI accounts, browser extensions or agents to work
email, files, clinical systems or case-management systems without approval.

Information restrictions
Do not enter client information into an unapproved tool. Do not upload
matter files, clinical records, recordings or screenshots containing that
information. Removing a name alone does not establish that information is
anonymous or properly de-identified. Use public or invented examples for
experimentation.

Permissions and actions
Request approval before granting an AI tool access to mail, drives,
calendars, local files or other systems. Use the least access needed for the
approved task. An agent must not send communications, change records or make
purchases without the authorized person's review and approval.

Review and professional responsibility
Check AI output for accuracy, sources and inappropriate disclosure before
using it. A qualified person remains responsible for professional work.
Follow any client-consent, patient-privacy and contractual requirements.

Mistakes and concerns
Report a wrong upload, unexpected access or unintended action promptly to
the practice's designated reporting contact. Preserve the relevant facts; do
not delete records or continue experimenting to investigate alone.

Ownership and maintenance
The practice's designated owner approves exceptions in writing, records
training and updates this policy when tools, tasks or obligations change.
Staff must know where the approved-tool register and reporting contact live.

This is an operational starting point, not legal advice and not proof of compliance: approve it with the people responsible for privacy, professional obligations and IT, and adapt it to your practice. The clauses come from our staff AI policy article, which carries the sources. Writing the list is easier once you know what people already use: a free 30-day AI security assessment takes that inventory off the computers.

Staff AI policy builder

Three answers and it writes itself

Your policy

A policy is the second step