AI Governance & Acceptable Use Policy

1. Purpose and scope

The firm supports responsible AI to improve quality, efficiency and client outcomes. This policy covers partners, employees and contractors using generative AI, machine learning, predictive systems, embedded AI or agents for firm work. AI does not displace professional accountability.

Policy owner: [insert] · Approver: [insert] · Jurisdictions: [insert] · Effective date: [insert] · Review: annual and upon material change.

2. Governance principles

Professional accountability, confidentiality, privacy, accuracy, transparency where required, human oversight, security, fairness and proportionate controls.

3. Risk classification and approvals

Assess both task and data sensitivity.

4. Acceptable use

Use approved tools only for authorised work. Never submit confidential, personal or privileged information to unapproved services; fabricate authorities or evidence; submit unchecked client deliverables; or allow agents to execute binding actions beyond their authority.

5. Confidentiality, privacy and IP

Apply data minimisation, access restrictions, contractual protections, retention and deletion controls, transfer assessments and vendor model-training restrictions. Approval of a tool does not authorise all information categories.

6. Human review and quality assurance

Qualified reviewers verify authoritative sources, legal citations, factual claims, financial calculations, assumptions, completeness and jurisdiction. Document approval for high-risk outputs.

7. AI agents and automated workflows

Assign accountable owners, permissions, audit logs, approval gates, escalation procedures and shutdown mechanisms. External communications, filings, transfers, contract execution and system changes require explicit authorisation.

8. Vendor approval

Assess security, processing terms, data location, training rights, reliability, auditability, resilience, costs and exit arrangements. Maintain an approved-systems register.

9. Staff competency and sensitisation

Provide induction, role-specific training, hands-on verification exercises and refreshers. Train partners and managers to supervise AI-assisted work, not merely operate AI tools.

10. Accountability

Board/partnership sets risk appetite; CEO/managing partner implements; AI lead manages registers; Risk/Legal/Compliance verifies duties; IT/Security oversees systems; engagement partners supervise professional work; users report incidents.

11. Incidents and escalation

Report suspected disclosures, fabricated outputs, unauthorised actions or security incidents. Contain, preserve evidence, assess impact, notify when required and document remediation.

12. Monitoring and enforcement

Track quality, rework, time, review effort, technology costs, realised benefits, incidents and competencies. Hours saved do not automatically become profit. Review policy at least annually. Violations may result in suspended access, training or discipline.

Implementation annexes

A. Risk assessment · B. Systems register · C. Vendor diligence · D. Human review checklist · E. Agent authority matrix · F. Incident form · G. Competency matrix · H. Jurisdiction-specific legal annex. These require tailoring before operational use.