An AI acceptable use policy should be a short, plain-language document that says which AI tools people may use, what information can go into them, who is accountable for AI-assisted work, when use must be disclosed, and who to ask when something is unclear.
The goal is not to list every possible risk. It is to give people enough clarity that they use AI confidently on the right work and stop guessing, or quietly using personal accounts, on everything else.
Who this is for
General counsel, COOs, compliance leads and managing partners who need a usable AI policy, whether the firm is just starting with AI or already has people using it without clear rules.
The short version
- Keep it to one or two pages, written for the people who will use it, not for lawyers.
- Cover seven things: purpose, approved tools, data rules, prohibited uses, accountability, disclosure, and how to get help.
- Pair it with training and an owner who updates it, or it will go stale quickly.
This page is practical guidance, not legal advice. Your obligations depend on your contracts, jurisdiction and regulators, so have counsel review the final version.
Why short beats thorough
Long AI policies are usually written to protect the firm on paper. People skim them once and then rely on instinct. A short policy with clear examples is more likely to change what people do on a busy afternoon.
A useful test: could a new joiner read it in five minutes and correctly answer “Can I paste this document into this tool?” If not, it is too long or too vague.
Section 1: Purpose
Two or three sentences on why the firm uses AI and what it expects. For example, that AI is encouraged for drafting, summarizing and analysis on approved tools, and that people remain responsible for their work. A policy that reads as a list of threats tends to push usage out of sight.
Section 2: Approved tools
List the AI tools the firm has approved, the type of account required (business accounts, not personal ones), and any settings that must be on. Say how someone requests a new tool and how long a decision normally takes. If approval is slow, people will work around it.
Section 3: Data rules
Map your data categories to the approved tools. Many firms use simple tiers such as public, internal, confidential and restricted, with a rule for each. Give real examples from your own work so people can classify a document in seconds. Our page on keeping client data safe covers tiers and vendor questions in more detail.
Section 4: Prohibited uses
Keep this list short and specific. Typical items include:
- putting restricted or contractually protected information into any tool not cleared for it
- using personal AI accounts for firm work
- relying on AI output for a final decision, figure or citation without checking it
- using AI to make decisions about individuals, such as hiring or performance, without the review the firm requires
- connecting AI tools or agents to firm systems without approval
Section 5: Accountability for output
State plainly that the person who uses AI owns the result. They must check facts, figures and sources against the original material before the work goes to a client, investor, regulator or decision-maker. Reviewers should review AI-assisted work the same way they review any other work.
Section 6: Disclosure
Decide when people must say that AI was used. Common triggers include client contracts that require it, regulatory filings, published content, and recordings or transcripts of meetings. Where nothing requires disclosure, say so, so people aren’t left guessing.
Section 7: Getting help and reporting mistakes
Name a person or a channel for questions, and commit to a fast answer. Explain how to report a mistake, such as pasting the wrong document into a tool, and make clear that honest reports won’t be punished. Early reporting is what lets you contain a problem.
Agents and integrations
If your firm uses or plans to use AI agents that can read from or act on firm systems, add a short section covering:
- who can approve a new agent or connector
- the principle of least access, so each agent only reaches what its job needs
- which actions always require a person’s approval, such as sending external messages or changing records
- where logs are kept and who reviews them
Rolling it out
A policy only works once people understand it. A practical rollout looks like this:
- Draft with input from legal, operations, IT and a few everyday users.
- Test it on real scenarios before publishing. Ask a handful of people to classify documents and spot problems.
- Introduce it in a short training session with examples from the firm’s own work, rather than by email alone.
- Put it where people will find it, linked from the AI tools themselves if possible.
- Review it on a set schedule, and whenever you approve a new tool or a vendor changes its terms.
Common mistakes
- Copying a template unchanged. Generic policies miss the firm’s actual data, clients and tools.
- Banning everything. This tends to drive usage onto personal accounts nobody can see.
- No examples. Abstract rules are hard to apply under deadline pressure.
- No owner. Tools and terms change, and an unmaintained policy quietly becomes wrong.
- Publishing without training. Most people won’t read a policy closely unless someone walks them through it.
When you do not need us
If your counsel and operations lead can spend a few hours together on the seven sections above, and you already have an approved tool in place, you can write a solid policy in-house. Outside help is most useful when you need it to match how teams actually work, want it tested against real workflows, or are introducing agents that touch firm systems.
How Ruby helps
- AI strategy: drafting a short, practical policy and approved-tools list that fits your firm, for your counsel to review.
- AI training: walking teams through the policy with examples from their own work.
- AI engineering: building agents and integrations that follow the policy by design.
A good starting point is one practical hour of AI training that covers your rules alongside the tools.