A one-page AI policy for law and accounting firms

Copy the seven rules into your own document, change the names and tools, and have a partner sign it. This is a starting point, not legal or tax advice, and it does not make a firm compliant with anything. Your own bar, regulator and clients decide what applies to you.

• 1. Approved tools only. The firm keeps a short list of AI tools, with the plan each one is on. Personal and free accounts are not on the list. Our suggestion.
• 2. Know what each tool does with data. Before a tool goes on the list, someone reads its terms for training on your data, retention and sharing, and writes the finding next to the tool. The Florida Bar says lawyers should research a program's policies on data retention, data sharing and self-learning (Florida Bar Ethics Opinion 24-1).
• 3. Client data goes only into listed tools, and only where the client has agreed. The Florida Bar recommends informed consent before using a third-party generative AI program if that would disclose confidential information. Say in the engagement letter which tools you use and for what.
• 4. A person checks every output before it leaves the firm. The Florida Bar says a lawyer must verify the accuracy and sufficiency of all research performed by generative AI and remains responsible for the work product (Florida Bar Ethics Opinion 24-1). Figures, citations and tax positions are checked against the source.
• 5. Outside providers are held to written terms. The FTC's Safeguards Rule guide tells covered businesses to choose service providers that can keep appropriate safeguards, to spell out security expectations in contracts and to monitor the provider's work (FTC Safeguards Rule guide). For US tax return information, 26 U.S.C. § 7216 makes it a misdemeanor to knowingly or recklessly disclose or misuse return information outside what the statute and its regulations permit (26 U.S.C. § 7216).
• 6. Time saved is not billed as time spent. The Florida Bar says efficiency gained through AI must not result in falsely inflated claims of time (Florida Bar Ethics Opinion 24-1).
• 7. If something goes wrong, say so the same day. A client file in the wrong tool, a wrong citation sent out, a lost device: whoever notices tells the named partner at once, and the firm decides what to tell the client. Our suggestion.

Rules 2 to 6 rest on the primary texts linked above, which we read in full. Rules 1 and 7 are our own suggestions, because the sources we read do not set them. Terms change by plan and over time: for example, Microsoft's page on Copilot data protection says “Your data isn't used to train foundation models” for organisations. Terms differ by plan and change, so read the sentence for each tool and plan your staff actually use.

Some clients, courts or firm rules say no third party may process a file. Then rule 3 leaves one option: AI that runs on your own hardware or in your own cloud account. That is what we set up with Aether Core, and we say plainly when you do not need it.

More: ten questions before client files go into AI, can lawyers use ChatGPT with client information, can accountants put client files into ChatGPT.