Writing your firm’s AI use policy: what to include

Approved tools

List the tools staff may use for firm work, by name, account type and approved configuration. Say that unapproved tools and accounts must not be used for client work. Assess the actual terms and settings; the account’s price alone does not establish whether it is suitable.

Check whether software the firm already pays for, such as Microsoft 365, includes a suitable AI feature. For each approved tool, record who vetted it and when. Check confidentiality terms, retention and deletion, access controls, where data is processed, and whether inputs may be used to train models. Our article on keeping client information safe when using AI covers these questions in more detail.

Permitted and prohibited uses

Be specific. “Use AI responsibly” gives nobody much to act on. A short task list works better than general principles. For example, a firm might adopt these rules:

• Permitted with reviewFirst drafts of client update letters, document summaries, chronologies and meeting notes, using approved tools and permitted information.
• Additional approval requiredAI-assisted work to be filed at court or sent to an opponent might require a supervising partner’s approval.
• Not permittedGiving AI-generated advice to a client without a competent person checking it, or uploading client documents to an unapproved tool.

These are examples of internal controls, not a universal list of regulatory requirements. Your firm’s rules should reflect the work, the risks and any applicable court or client requirements. A trainee should be able to read them and know whether a task is allowed.

Information rules

Say what may and may not go into each tool. Use fictional examples when testing tools or building templates. Removing names alone may not make a document anonymous.

Check confidentiality, privilege, data protection obligations and the client’s engagement terms before using client information. Some clients restrict AI use in their outside counsel guidelines. A supplier’s promise not to train on inputs does not settle these other questions.

Ask the person responsible for data protection to assess each proposed use. A data protection impact assessment is required before processing begins where the processing is likely to create a high risk to people’s rights and freedoms. Record the assessment and the reasons for deciding whether a DPIA is needed.

Review and responsibility

Treat AI-assisted work as unchecked until an appropriate person has reviewed it. Name the role responsible for that check, not just “the user”. Using AI does not remove a solicitor’s professional responsibility, including responsibility for work they supervise.

Spell out what checking involves. Open and read the sources. Compare facts with the file. Verify legal propositions, citations and dates before relying on them. Our guide to checking AI outputs sets out a reviewer’s checklist you can adapt.

Records

Set a proportionate record-keeping rule for substantive AI-assisted work. Record the tool, what it was used for, who reviewed the result and the outcome of that review. A brief note may be enough for a simple task; higher-risk work may need a fuller record.

Follow the firm’s retention and security rules, preserving the evidence needed to explain how the work was prepared and checked. Avoid unnecessary duplicate copies of confidential prompts or outputs, while retaining anything required for supervision, legal obligations or a dispute.

Telling clients

Decide what to tell clients about AI use and where to say it. The Law Society recommends clear communication, where appropriate, about when and how AI tools are used. Client care letters or terms of business may be appropriate, but a general clause may not address a particular client’s instructions or a specific use.

Agree the approach with whoever owns those documents. Check when further explanation or permission is needed, rather than assuming that generic wording resolves every confidentiality or contractual question.