AI Use Policy Template for Businesses

This AI use policy template is a starting point you can copy for acceptable use and governance: approved tools, restricted data, and human review. Replace every bracket, then have counsel review it before adoption. It sets expectations for staff. It does not verify what a vendor’s system does.

A written AI use policy answers three questions for your staff: which AI tools they may use, what client or company data never goes into a tool that isn’t approved, and who signs off before AI-prepared work reaches a client. Without one, adoption happens through whatever tool an employee found on their own, and the business has no record of what data went where.

AI use policy template: what can your team copy and adapt?

Replace every bracketed item before sharing this draft. Assign an owner who can answer questions and record changes. This text sets internal expectations; you still need to check your contracts, professional duties, and vendor terms for the tools and data you actually use.

[Business name] AI use policy
Owner: [name and role] | Effective date: [date] | Next review: [date]
Counsel review: [counsel] reviewed this on [date]. Until then it is a draft
and is not in force.

1. Approved tools. Staff may use [tool and approved plan] for [approved tasks].
   Ask [owner] before using another AI tool, account, extension or feature for work.
2. Data. Do not enter client, matter or business information into an unapproved tool.
   For each approved tool, follow [data categories allowed], [client or project
   access rules] and [retention requirement]. If unsure, stop and ask [owner].
3. Review. A person in [reviewer role] checks AI-prepared work against its
   source material before it reaches a client or is used for a decision.
   Record approval in [system or location]. The responsible professional makes
   all final judgments, signatures and external communications.
4. Client messages. Drafts, including intake replies and status notes, wait
   until [role] accepts them. The tool does not send them.
5. New tools. Send requests to [owner]. Before approval, check permitted data,
   access, vendor terms, output quality and who will maintain the workflow.
   The owner updates and shares the approved-tool list.
6. Mistakes and exceptions. If restricted data enters the wrong tool, or an
   output is sent without review, report it promptly to [contact and channel].
   [Owner] records what happened and coordinates the business's response.
7. Review. Revisit this policy at onboarding, when a tool or workflow changes,
   and at least [review interval].

Why a policy has to exist before the tools do

Staff can start using an AI tool before the business has approved one. NIST’s AI Risk Management Framework says governing authorities can determine the overarching policies that direct an organization’s mission, goals, values, culture, and risk tolerance.

It also says management aligns the technical aspects of AI risk management to policies and operations, and that processes for human oversight are defined, assessed, and documented. A one-page policy is how a business writes down what is allowed, in language a new hire can read in ten minutes.

For businesses under the FTC’s jurisdiction, the Safeguards Rule’s scope includes tax preparation firms, and an accountant in the business of completing income tax returns is a financial institution.

Those businesses shall oversee service providers by selecting providers that can maintain appropriate safeguards, and by requiring service providers by contract to implement and maintain such safeguards. A tool that receives customer information and was never selected or put under contract sits outside that process.

Acceptable use and governance your firm can copy

The template above is the acceptable-use core: which tools are allowed, which data stays out, who reviews output, and how exceptions are reported. Governance here means naming an owner, dating counsel review, and scheduling a periodic read. It is not a separate document.

What the policy should cover

• Approved tools. Name the tools staff can use for work, and say plainly that a personal AI account, a browser extension, or a tool a vendor is piloting needs approval first. Vague rules like “use good judgment” don’t hold up when something goes wrong; a named list does.
• Restricted data. Be specific: client names, account numbers, health information, and anything under an NDA or engagement letter stay out of unapproved tools. Microsoft says the stored data includes the user’s prompt and Copilot’s response.
• Storage versus training. Microsoft also says prompts, responses, and data accessed through Microsoft Graph aren’t used to train foundation models. A tool can store what someone pastes even when that material is not used for training.
• Client approval. Define who reviews AI-prepared work, and require that review to be recorded, not just assumed. See human in the loop AI for what that step looks like in practice.
• New tools. Adoption is ongoing, not a single decision. Name who evaluates a new tool, which questions get asked (start with the 12 security questions), and how the approved list is updated and shared.
• A broken rule. State the response plainly and in proportion to the risk: a first conversation for a minor slip, something more serious for repeatedly moving client data into unapproved tools.

For law firms

ABA Formal Opinion 512, issued July 29, 2024, expects lawyers to understand a generative AI tool’s terms, how client information is accessed, and whether the tool learns from inputs. When a self-learning tool’s output could disclose client information, informed consent is required before that information is put into the tool, and boilerplate engagement language is not enough on its own.

In the template, name who may use AI on matter work, which tools are approved, and that a lawyer checks AI-prepared client communications before they go out. Add a register line for Opinion 512 consent where your ethics counsel says it belongs. This block is general information, not legal advice.

Which profession rules does the policy point to?

• Accounting firms. IRC §7216 requires the taxpayer’s written consent for uses outside the regulatory exceptions. Name the tasks that need it.
• Law firms. ABA Opinion 512 requires informed client consent before inputting representation information into a self-learning generative AI tool when there is a risk it could be disclosed to or accessed by others. General engagement-letter language is not enough.

The policy does not replace those rules. The AI readiness assessment checks them for one workflow.

Keep it short and specific

A policy that reads like a legal filing won’t get read. Aim for one page, plain language, and examples from the work your people actually do, reviewed at onboarding.

NIST calls for ongoing monitoring and periodic review of the risk management process. Our recommendation: review the policy at least once a year, and whenever you add an approved tool.

Where Precision AI OS fits

A policy governs how your people use AI day to day. It does not replace the controls a vendor should already have built in. When we build the pipeline and agents, each business’s data is isolated and encrypted with keys unique to it, and models run only under zero-retention routing, with data collection refused on every request. The system enforces what a policy can only ask for. See how we protect your data, or book a discovery call.