AI Acceptable Use Policy for a Small Professional Firm

An AI acceptable use policy for a professional firm should name the approved tools and account types, set out which client information may go into each, require a qualified person to check anything that carries advice, figures or citations, say what you tell clients, and cover incidents, meeting recordings, training and review dates. Two pages is usually enough.

What separates it from a generic small-business template is the duty of confidence you owe clients. A retailer's policy worries about marketing copy. Yours has to deal with engagement letters that restrict AI, partners who use personal accounts on their phones, and a professional indemnity insurer that may ask how AI-assisted work gets checked before it reaches a client.

Follow me on Instagram@sagnikteaches

What generic templates miss for accountants, lawyers and consultants

If you've never written any AI policy, the general method in how to write an AI usage policy for a small business is the place to start. This tutorial assumes you have that shape and need the parts that only matter when your product is advice. Four gaps show up again and again in small firms:

Connect on LinkedInSagnik Bhattacharya

• Client instructions. Some clients now write "no generative AI" into their terms, or ask on a supplier questionnaire. A policy that allows AI everywhere puts fee earners in breach without knowing it.
• The partner exception. Rules get written for staff and ignored by the people who own the firm. In practice the senior person pasting a draft opinion into a personal chatbot on a Sunday night is the biggest exposure you have.
• Sign-off that means something. "A human reviews all AI output" is meaningless if the reviewer skims. Professional work needs a named reviewer who checks sources, sums and references against the originals.
• Billing. If a draft that used to take three hours now takes forty minutes, the policy should say how that time is recorded, so nobody bills manual hours for machine work.

The checklist: 14 clauses, grouped by what they protect

Work through these in order. Each clause has a reason and a way to check it's being followed, because a policy you can't audit is a wish list.

Subscribe on YouTube@codingliquids

A. Scope and ownership

1. Who it covers. Partners, directors, employees, trainees, contractors, locums and anyone with a firm login, on any device. Why: contractors and part-time staff are where confidential files leak. Check: the list of people who've acknowledged the policy matches payroll plus your contractor list.
2. A named owner and approval route. One person (often the practice manager or IT partner) keeps the approved-tools list and says yes or no to new ones. Why: without a route, people use whatever they find. Check: every tool on the list has an owner and a review date.

B. Tools and accounts

3. Approved tools, by name and plan. Not "ChatGPT" but "ChatGPT Business, firm workspace only" or "Microsoft 365 Copilot through firm accounts". Business plans such as ChatGPT Business, Claude Team and Copilot in Microsoft 365 don't train on your content by default. Consumer plans rely on each user finding and switching off the model-training setting. Check: compare the admin console's seat list with your staff list, and scan expense claims for personal AI subscriptions.
4. Firm logins only for client work. No personal accounts, no shared passwords, two-factor sign-in on, leavers removed on their last day. The reasoning is set out in company AI accounts instead of personal logins. Check: quarterly, match active AI seats against current staff.
5. Features that are on or off. Decide which features stay on: connected apps that let ChatGPT read your mailbox or drive, shareable links to chats, memory, and automatic meeting note-takers. Why: a connector can expose far more than one pasted paragraph. Check: screenshot the admin settings each quarter and keep the image with the policy.

C. Client information

6. Three tiers of information, with a table showing which tier may go into which tool (there's one further down). Why: staff can't apply "use judgement" at 6pm on a deadline day; they can apply a table.
7. Minimum necessary, anonymised where possible. Before client material goes into any tool, strip what the task doesn't need. The routine is in how to anonymise client data before you paste it into AI. Check: spot-check five chats a quarter in the admin console, if your plan allows it, or ask staff to show you theirs.
8. Client restrictions override the policy. If an engagement letter, client instruction or regulator says no AI, a flag goes on the client file and the fee earner follows it. Check: the flag exists as a field in your practice management system, not as a note someone might not read.

D. Professional judgement

9. Named sign-off for anything leaving the firm. Advice, figures, tax or legal references and anything a client will rely on is checked by a qualified person, who records that they checked it. Why: AI can invent a case, a standard or a percentage in a confident sentence. Check: the file shows who reviewed and when.
10. A verification standard. Every citation, statute, standard, rate or number is traced to its primary source, not to the AI's own summary of it. Reading the output and finding it plausible doesn't count.
11. Prohibited uses. List them plainly: sending AI-drafted advice without review; letting AI make decisions about individuals such as hiring or creditworthiness; generating signatures, or documents that pretend to be from someone else; recording anyone without telling them.

E. Clients, meetings and billing

12. What you tell clients. A standard sentence for engagement letters and a standard answer for supplier questionnaires, agreed once so fee earners don't improvise. Check: the current engagement letter template contains it.
13. Meeting recordings and note-takers. Tell attendees at the start, give them the option to decline, and store transcripts on the client file with the same retention as other notes. The trade-offs are covered in whether AI meeting note-takers are safe for client calls.

Clause 12 works only if the wording exists before anyone needs it. Filled in for an illustrative accountancy practice:

Engagement letter: "We use AI tools under our firm's business accounts
to help draft, summarise and check work. Under those accounts' terms,
your information is not used to train the tools' models. A qualified
member of staff reviews all work before it is sent to you. Tell us if
you would prefer us not to use AI on your work and we will record that
on your file."

Questionnaire, "Do you use generative AI on our data?": "Yes, within
[tool names and plans]. Your data is not used for model training under
those plans' terms. Use is governed by our AI acceptable use policy,
available on request, and every output is reviewed by a qualified
person before it reaches you."

Check both against your real settings before sending either. The training sentence is true only if every tool on the approved list is a business plan with that default, and the day someone adds a consumer tool to the list, the engagement letter becomes inaccurate.

The billing sentence in the policy is easiest to explain with numbers. Say a trainee used to spend three hours drafting a first-cut summary of a client's lease portfolio. With the firm's AI tool, the draft takes 40 minutes and the manager's check another 30, so the time record shows 1 hour 10 minutes across the two of them, not three hours. If the firm wants to charge for what the work is worth rather than the time it took, that's a pricing decision to make openly, with a fixed fee in the engagement letter, not something to reach by rounding timesheets up.

F. Incidents, training and review

14. Report within one working day; train at induction; review twice a year. Anyone who pastes client material into the wrong tool, or sends AI-drafted work with an error, tells the policy owner within a day, with no penalty for reporting. Everyone gets a short induction on the policy. If you have clients in the EU, the EU AI Act's Article 4 expects deployers to take steps that support staff AI literacy, and a recorded induction is a sensible way to show that. Review the whole policy every six months, or sooner when a vendor changes its terms.

Which client information can go into which tool

This is the table staff will actually use, so print it and pin it up. Adjust the tool names to your own list.

The line between tiers 2 and 3 is the one partners argue about. A useful test: if this information turned up in the wrong place, would you have to tell the client, your insurer or a regulator? If yes, it's tier 3.

A one-page policy you can adapt

Here is sample wording, written to be short enough that people read it. Replace the bracketed parts and delete anything that doesn't apply.

[FIRM NAME] AI ACCEPTABLE USE POLICY        Version [1.0]   Owner: [NAME]   Next review: [DATE]

1. Scope. This policy applies to everyone who works for or with the firm,
   including partners and contractors, on any device.

2. Approved tools. Only the tools on the Approved AI Tools list may be used for
   firm or client work, and only through firm accounts. Personal AI accounts
   must not be used for client work. To request a new tool, ask [OWNER].

3. Client information. Follow the three-tier table. Put in only what the task
   needs. Tier 3 information needs a partner's approval for each task
   (for a partner's own work, another partner's approval).
   If a client file carries a "No AI" flag, do not use AI on that work.

4. Checking. You are responsible for anything you send, however it was drafted.
   Before advice, figures or references leave the firm, a qualified person must
   check every citation, number and statement against its original source and
   record the check on the file.

5. Never: send AI-drafted advice unchecked; let AI decide anything about an
   individual; create signatures or documents that appear to come from someone
   else; record a meeting without telling everyone present.

6. Clients. Use the standard AI wording in engagement letters and questionnaires.
   Record time actually spent; do not record manual time for AI-assisted work.

7. Meetings. Announce any AI note-taker at the start; stop it if anyone objects;
   store transcripts on the client file.

8. Mistakes. If something goes into the wrong tool or an error goes out,
   tell [OWNER] within one working day. Reporting quickly is never penalised.

9. Training. Complete the AI induction before using approved tools.

I have read and will follow this policy.   Name: ________   Date: ________

Keep the Approved AI Tools list as a separate one-page table so you can update it without re-issuing the policy. Filled in for an illustrative twelve-person consulting engineers' practice on Microsoft 365, it might read:

Notice the "not approved for" column. It answers most of the questions staff would otherwise email you about.

Testing the policy against three Tuesday-afternoon situations

Before you circulate it, run the draft past situations your people will really meet. Here's how it holds up in an illustrative eight-person accountancy and advisory practice with two partners:

• A trainee wants to summarise a 40-page lease for a client's property purchase. The lease names the client and the landlord: tier 2. The policy allows the firm's business account, on that client's project, with the summary checked by the manager before it's used in advice. If the trainee reaches for a free tool on their phone, clause 4 and the table both say no. Clear answer: the policy works.
• A partner wants to draft a sensitive letter about a director's health and a possible sale of the business. Health data plus a price-sensitive deal makes it tier 3. The partner can approve a specific task for themselves, which is awkward. Fix: say that tier 3 approval for a partner's own work comes from the other partner. Small firms need this line written down.
• A client's procurement questionnaire asks "Do you use generative AI on our data?" Without clause 12, the answer depends on who fills it in. With it, you paste the agreed paragraph and list the tools.

If any situation produces "it depends" with no clear route to an answer, the clause needs rewriting, not a footnote. A typical rewrite, before and after:

Before: "Staff should use AI responsibly and take care with confidential data."
After:  "Client-identifiable information may only be entered into tools on the
         Approved AI Tools list, through firm accounts. Tier 3 information needs
         the other partner's written approval for each task, recorded on the file."

The first version can't be broken, which means it can't be followed either. The second tells someone exactly what to do and gives you something to check.

You can also ask your approved AI tool to find the gaps. Paste in the draft (it contains nothing confidential) with a prompt like this:

You are a sceptical trainee accountant in a small firm. Read the AI policy below.
List five realistic situations from a normal working week where the policy does
not give a clear answer, and for each one quote the clause that comes closest.

An illustrative reply might include: "A client emails a spreadsheet and asks me to 'run it through AI' to find anomalies. Clause 3 says follow the tier table, but the table doesn't say whether uploading a whole file is different from pasting a few rows." That's a fair catch; the fix is a line saying whole files follow the same tier rules, with hidden sheets and comments removed first. Other suggestions will be padding, such as "What if AI becomes sentient?", which you ignore. Expect two or three useful gaps out of five, which is worth ten minutes.

Getting partners and staff to sign it, and keeping it current

Circulate the draft with the tools list and the tier table together, then give people a week to raise cases it doesn't cover. Run a 30-minute session where you go through the three situations above using your own tools on screen. People follow rules they've seen applied. The sequence in how to roll out an AI policy so staff actually follow it works well for a firm this size.

After launch, the review work is small but regular:

• Monthly: check the approved tools' admin consoles for new users and new features switched on by default.
• Quarterly: reconcile seats against staff, spot-check a handful of chats, and look at the incident log.
• Every six months: re-read vendors' data terms (they change more often than you'd expect), update the tools list, and re-confirm the engagement-letter wording.
• When your insurer renews: check whether the proposal form asks about AI and that your answer matches the policy.

The incident clause is the one that proves its worth. As an illustration of how it plays out: a bookkeeper at a small practice pastes a client's payroll export into a free chatbot on her phone because the firm's account is on her laptop at home. She realises that evening and reports it the next morning, as the policy asks. Because the report is quick, the practice manager can delete the chat, check what the consumer plan's settings were, record what was exposed (names and pay for eleven staff), and decide with the partners whether the client needs to be told. The remedy that follows is practical, not disciplinary: the firm account goes on her phone too. A policy that punishes reporting gets you the same mistake, discovered six months later.

If you want an outside reference point, ISO/IEC 42001, the management-system standard for AI published in December 2023, is where firms that need formal certification look. Most firms of ten or twenty people don't need it; a two-page policy that people follow, an approved-tools list and an incident log will cover the ground a client or insurer is likely to ask about.

Questions partners ask before signing the policy off

Should a lawyer review our AI acceptable use policy?

An internal policy is a management document, so you can write it yourself, but have your regulator's guidance and your insurer's requirements beside you while you do. Ask a lawyer to look at the parts that touch client contracts: the engagement-letter clause about AI and any promise you make about where client data is processed. Those create obligations to clients; the rest mostly governs staff.

Can staff use AI on their own phones for firm work?

Only through the firm's approved accounts, signed in with firm credentials, and ideally through apps your device management can see. Ban personal consumer accounts for anything involving a client. If you allow personal phones at all, require a screen lock, the firm account rather than a personal one, and removal of the app or sign-out when someone leaves.

What if a client asks us not to use AI on their work?

Record the instruction on the client file where every fee earner will see it, such as a flag in your practice management system, and treat it as a restriction that overrides the policy's permissions. Confirm in writing what it covers: some clients mean generative drafting only and are content with spellcheck, transcription or search. Review the flag when the engagement letter renews.

How long should the policy be?

Two pages of rules plus a one-page table of approved tools is enough for most firms under 30 people. Longer documents get skimmed. Put the reasoning and examples in a separate guidance note or induction session, and keep the policy itself to statements staff can follow and you can check.

Further reads

• How to Classify Business Data Before Using AI Tools — A fuller method for sorting information into tiers before AI touches it.
• Does Your Business Insurance Cover AI Mistakes? — What to ask your insurer about AI-assisted advice going wrong.
• AI Incident Response Plan for Small Businesses (With Template) — The template behind the policy's incident-reporting clause.
• AI Tool Approval Process: How Staff Request a New AI Tool — How staff request a new tool without going round the policy.
• AI Literacy Requirements: What Your Staff Need to Know — What training the policy should require, and how to record it.
• How to Mention AI Use in Client Contracts and Proposals — Wording for the client-facing side: proposals and engagement letters.
• Does a Five-Person Business Really Need an AI Policy? — Why a five-person business needs a one-page AI policy rather than a handbook: six triggers, a complete template, and when one page stops being enough.
• Rolling Out AI in a Bookkeeping Practice Without Losing Control — A staged AI rollout for bookkeeping practices: control points, an inventory of AI already in your software, a pilot, sampling rates and client wording.
• What an AI Implementation Looks Like in a Small Accounting Firm — A seven-person practice followed through 12 weeks of AI implementation: time audit, tools switched on, records chasing, costs and what went wrong.
• AI Implementation Plan for a Small Law Firm: The First 90 Days — A day-by-day 90-day AI plan for a six-person law firm: policy first, two scored pilots, shadow testing, an error log and a go/no-go decision.
• AI Readiness Checklist for Accountants, Solicitors, Consultants — Twenty checks, grouped and scored, that tell an accountancy, law or consulting firm whether it is ready to pilot AI or has gaps to fix first.
• How to Stop AI Inventing Case Law: A Small-Firm Checking Routine — A seven-step routine and a copyable citation log for catching AI-invented or misquoted authorities before anything reaches a court or client.
• AI Governance Checklist for Small Financial Advice Firms — Eight groups of checks, each with the evidence to keep, so a small advice firm can show how AI is approved, supervised and recorded.
• Is It Safe for an Accountant to Use ChatGPT With Client Data? — Which ChatGPT plans an accounting practice can defend for client data, what never goes in, and the engagement-letter wording to add.
• 7 AI Mistakes That Put an Accounting Firm's Client Trust at Risk — Seven ways AI use damages trust in an accounting practice, each with how it shows up with clients and the control that prevents it.
• Can Solicitors Use ChatGPT Without Breaching Confidentiality? — Confidentiality, privilege and data protection are separate tests for a law firm using ChatGPT. What passes each, and the settings to fix first.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: OpenAI and Anthropic business plan pages (data use and training defaults); Microsoft 365 Copilot documentation; EU AI Act Article 4 as amended by the Digital Omnibus on AI; ISO/IEC 42001 publication details.