[Practice Name] — AI Use Policy
Effective [date] · Owner: [principal] · Applies to everyone, on every device
The one rule
Never put client-identifying information into an AI tool that is not on our approved list.
Never goes into any AI tool
- ✕Client names, SINs/SSNs, account numbers, dates of birth, or addresses
- ✕Client documents, statements, tax slips, or scans — in any format
- ✕Anything you would not put in an email to a stranger
Our five rules
- 1Use approved tools only. Only the tools listed by the practice, on paid business plans, signed in with your work email. No free personal accounts for client work — ever.
- 2Strip identifiers first. Before asking AI for help with anything client-related, remove names and numbers. “A client in their late 50s” works as well as the real name.
- 3A person reviews everything. AI output is a draft. Nothing it produces goes to a client, a regulator, or the public until a person here has read it and taken responsibility for it.
- 4AI never gives our advice. Recommendations to clients are human judgments made by qualified people. AI helps us prepare and explain — it does not advise.
- 5Say something, same day. Put the wrong thing into a tool? Stop, write down what happened, tell the principal today. Reporting fast is doing the right thing — this is a no-blame rule.
Approved tools
| Tool | Plan | Allowed for |
|---|---|---|
| [Tool 1] | [Business plan] | [e.g. internal + de-identified client work] |
| [Tool 2] | [Business plan] | [e.g. internal + de-identified client work] |
| [Tool 3] | [Business plan] | [e.g. internal + de-identified client work] |