[Firm name] · AI acceptable use policy
1. Why we have this policy
AI tools can save us real time on drafting, summarizing and research. They also send whatever we type to an outside company. Our clients trust us with their personal and financial information, and our professional rules and privacy laws require us to protect it. This policy lets us use AI while keeping client information inside the firm.
2. Who and what it covers
Everyone who works for [Firm name], including partners, staff, students and contractors. It covers every AI chat or writing tool (ChatGPT, Claude, Gemini, Copilot and others), on firm devices or personal ones, whenever the work involves our clients or our firm.
3. Approved tools
- Approved: [e.g. ChatGPT through the firm account, Microsoft Copilot].
- Use a firm account where we have one. Don't use personal AI accounts for client work.
- Turn off "use my chats for training" in every AI tool you use (see how).
4. Never paste these into AI as they are
- Client or employee names, signatures and addresses
- SIN, SSN, ITIN or any government ID number; dates of birth
- Bank, credit card, brokerage or other account numbers
- Business numbers, EINs, payroll and tax account numbers
- Health information, and anything a client has marked confidential
- Passwords, login codes or access to client portals
5. De-identify first, every time
Before any client document, spreadsheet, email or note goes into an AI tool, replace the details in section 4 with placeholders. At [Firm name] we use [Hushtag], which swaps names and numbers for tags like #PERSON_1 on your own computer and puts them back in the answer. Glance over what was replaced before you send. If you can't de-identify something, don't paste it.
6. You own the output
- AI can be confidently wrong about tax rules, numbers and deadlines. Check every figure and every rule against the source.
- Nothing written by AI goes to a client, CRA, the IRS or any authority until a qualified person has reviewed it.
- AI never logs into client or government portals, and never files anything.
7. If client information slips through
Tell [Privacy officer / partner] the same day. Delete the chat in the AI tool. Write down what was sent, to which tool and when. The firm will decide whether the client must be told and whether it's a privacy breach we have to report. Reporting it quickly is never a disciplinary issue; hiding it is.
8. Telling clients
[Optional] Our engagement letter says we may use AI tools to help with our work, that client identifiers are removed before anything is sent to them, and that a professional reviews all work.
9. Training and review
New staff read and sign this policy before using AI for firm work. [Privacy officer / partner] reviews it every year, or sooner if our tools or the rules change.