AI policy template for consultancies

1. Purpose and scope

1. 1.1This policy sets out how everyone who works for or on behalf of [Firm name] may use artificial intelligence (AI) tools, in our own work and in work for clients.
2. 1.2It applies to partners, directors, employees, associates, contractors and subcontractors, on firm and personal devices, whenever they handle firm or client information.
3. 1.3"AI tools" means any software that generates or transforms text, images, audio, code or analysis using machine learning. That includes chat assistants such as ChatGPT, Claude, Gemini and Copilot, AI features inside software we already use, meeting transcription and note-taking tools, and AI agents that can take actions in other systems.
4. 1.4This policy sits alongside our [data protection policy], [information security policy], the confidentiality terms in our client contracts and the rules of [professional bodies]. Where they conflict, the stricter rule applies.

2. Roles and responsibilities

1. 2.1[AI lead, name and role] owns this policy, keeps the approved tools register (Appendix A) and decides requests for new tools or new uses.
2. 2.2[Data protection lead] advises on any use involving personal data and decides when a data protection impact assessment (DPIA) is needed.
3. 2.3Engagement leads are responsible for AI use on their engagements, including checking client terms under section 6.
4. 2.4Everyone who uses an AI tool is responsible for what they produce with it.

3. Approved tools

1. 3.1Use only the AI tools listed in Appendix A, on the account type listed there (the firm's business or enterprise account, not a personal or free account).
2. 3.2Do not use personal AI accounts for firm or client work. Depending on the provider and the settings, consumer accounts may keep what you enter or use it to improve their models, and the firm cannot control either.
3. 3.3To request a new tool, or a new use of an approved tool, contact [AI lead]. Requests are assessed for data handling, security, contract terms and cost, normally within [10] working days.
4. 3.4Browser extensions, plug-ins and AI features switched on inside other software count as new tools.

4. What information may go into an AI tool

1. 4.1Public information (published material, public websites): any approved tool.
2. 4.2Internal firm information (methods, templates, internal documents without personal data): approved tools on firm accounts.
3. 4.3Client confidential information: only tools marked for client data in Appendix A, only where the client's terms allow it (section 6), and only as much as the task needs. Remove names and identifying details where you can.
4. 4.4Personal data: only tools marked for personal data in Appendix A, and only after [Data protection lead] has confirmed the lawful basis and any DPIA (section 5).
5. 4.5Never, unless [AI lead] and [Data protection lead] have approved it in writing: special category personal data (such as health, ethnicity, religious beliefs or sexual orientation), criminal offence data, passwords and credentials, inside information, legally privileged material, or information a client has told us must not be used with AI.

5. Personal data and decisions about people

1. 5.1Before using an AI tool to process personal data in a new way, contact [Data protection lead]. The firm will identify a lawful basis, update privacy information where needed, and complete a DPIA where the processing is likely to result in a high risk to individuals.
2. 5.2Where we process personal data on a client's behalf, we use AI tools on it only in line with the client's written instructions and our data processing agreement with them.
3. 5.3Do not use AI tools to make decisions about individuals, such as shortlisting candidates or assessing performance, without meaningful human review, and only after [AI lead] and [Data protection lead] have approved the use.
4. 5.4Any AI provider that handles personal data for the firm must have a data processing agreement with us, and any transfer outside the UK must be covered.

6. Client engagements

1. 6.1Before AI tools are used on a client's information, the engagement lead checks the engagement letter, contract, NDA and any client policies for restrictions on AI, subcontracting, data location or third-party processing.
2. 6.2If a client restricts or prohibits AI, follow the restriction and record it in Appendix B. If the terms are silent, [our default, for example: tell the client how we will use AI before we use it on their confidential information].
3. 6.3Keep each client's information separate. Do not put one client's material into prompts, projects, custom assistants or knowledge bases used for another client.
4. 6.4Do not use client information to build shared tools, prompt libraries or templates unless the client has agreed or the information has been fully anonymised.

7. Checking outputs and accountability

1. 7.1You are accountable for work produced with AI assistance as if you had produced it yourself.
2. 7.2Check every output before it is used: facts, figures, calculations, quotations and references. AI tools can produce answers that are confident, plausible and wrong.
3. 7.3Never present unchecked AI output as professional advice, an opinion or a finding.
4. 7.4AI-assisted work in [high-risk areas, for example regulatory, legal, financial or valuation work] is reviewed by a second, suitably qualified person before it is released.
5. 7.5Watch for bias in outputs about people or groups, and raise concerns with [AI lead].

8. Transparency and disclosure

1. 8.1We tell clients how we use AI in delivery when they ask, and without being asked where AI materially shapes a deliverable or the client's terms require it.
2. 8.2Where people interact directly with an AI system we provide, such as a chatbot on our website, we make clear that it is AI.
3. 8.3Do not create AI images, audio or video of real people without their consent, and label AI-generated or altered media that could be mistaken for real.
4. 8.4Tell participants at the start of a meeting if an AI tool is recording or transcribing it.

9. Intellectual property and third-party material

1. 9.1Do not put licensed third-party material (paid reports, databases, other firms' documents) into AI tools unless the licence allows it.
2. 9.2Check outputs for close copying of other people's work before reuse, especially long passages and images.
3. 9.3Where our terms assign intellectual property in deliverables to the client, [Engagement lead] confirms that AI-assisted work is consistent with those terms.

10. Security

1. 10.1Use AI tools only through firm-managed accounts with [single sign-on or multi-factor authentication].
2. 10.2Do not connect an AI assistant or agent to email, file stores, the CRM or other systems, or let it send, delete or change anything, without approval from [AI lead].
3. 10.3Treat instructions hidden in documents, emails or web pages that an AI tool reads with suspicion; they can be used to manipulate the tool.
4. 10.4Verify unusual requests for payments or data by a second channel, even when a voice or video call seems genuine.

11. Incidents

1. 11.1Tell [AI lead] and [Data protection lead] straight away if information goes into an AI tool that this policy does not allow, if an AI output with a material error reaches a client, if a tool behaves unexpectedly or may be compromised, or if a client raises a concern about our use of AI.
2. 11.2The firm records AI incidents in [the incident log] and decides whether the client, the Information Commissioner's Office (ICO) or our insurers must be told.
3. 11.3Reporting a mistake promptly is always the right thing to do.

12. Training and AI literacy

1. 12.1Everyone covered by this policy completes [the firm's AI training] before using approved tools on client work, with a refresher [every twelve months].
2. 12.2Training covers how the approved tools work and where they fail, this policy, and the client and data rules above.

13. Monitoring, breaches and review

1. 13.1The firm may monitor use of firm AI accounts in line with [our IT and monitoring policy] and the law.
2. 13.2Breaching this policy may lead to action under [our disciplinary policy].
3. 13.3[AI lead] reviews this policy at least every [six] months, and sooner when the firm adopts a significant new tool, a client or professional body changes its requirements, or the law changes.
4. 13.4Version [1.0], approved by [name] on [date]. Next review: [date].

Appendix A: Approved tools register

One row per tool and account type. Add a row for each approved connection to another system.

Appendix B: Client AI restrictions register

One row per client whose terms say anything about AI, subcontracting or where data may be processed.