A small firm does not have an IT department or a compliance team. It still needs a few written rules for AI tools. This checklist fits on one page of policy. Adjust it to your profession, your clients and the rules that apply to you.
Before anyone uses an AI tool
- Choose the tools. Write down which AI tools the firm allows. Everything else is not allowed for client work.
- Choose the plans. Personal accounts and business accounts behave differently. Decide which are acceptable. See what the data settings mean.
- Set the settings. Turn off training where the option exists, and make it the same for everyone.
- Find the built-in AI. Email clients, word processors and meeting tools now carry AI features. Decide whether they are on.
- Tell clients. Say in the engagement letter or terms how you use AI tools. Where your rules require consent for certain uses, get it.
- Name an owner. One person answers questions and keeps the policy current.
For each task
- Does the task need client information at all? Templates, explanations and structure often do not.
- Send the passage, not the file. Take only what the task needs.
- Replace every identifying detail. People, companies, addresses, phone numbers, email addresses, account numbers, ID numbers and dates of birth. Use the same placeholder for the same person every time. The checklist of what to remove lists what to look for.
- Check the file name and any hidden content: comments, tracked changes, hidden sheets, document properties.
- Check images and scans. Text inside pictures is text. See personal data in scans and screenshots.
- Read the safe version. Another person reads it too when the matter is high-risk.
- One client per conversation. Never mix clients in a chat.
- Do not paste the key that links placeholders to real names.
After the answer comes back
- Restore the names on your own computer. See the round-trip workflow.
- Verify the content. The AI can be wrong: invented citations, wrong figures, a fact attached to the wrong person. A professional reads and takes responsibility for the result.
- Do not use thumbs up or down on a chat that touched client work.
- Save the work product in the client file, not in the AI tool's history.
- Delete the chat when you no longer need it, if the tool lets you.
- Delete the key when the matter closes, along with any working copies.
Where small firms usually slip
- Staff use a personal AI account because it is already on their phone.
- A well-meant attachment: the whole PDF goes in when one paragraph was enough.
- The AI's answer is pasted into a client email without being read.
- The key sits in a shared folder that syncs to a cloud assistant.
- Nobody remembers to delete the work when the matter closes.
Most of these are habits, not technology. Fix them with the routine above and one reminder at the start of each matter.
Keep a simple record
A short log is enough: date, matter, tool, what was sent in general terms (not the content), who reviewed it. If a client or a regulator asks how you handle AI, you answer from the log. ClientSafe keeps its own activity log of when documents were anonymized and how many items of each type were replaced, without the personal data itself, and it can be exported as a CSV report.
If something goes wrong
- Note exactly what was sent, when, to which tool and from which account.
- Delete the conversation and check the account's data settings.
- Tell the firm's owner the same day.
- Check whether your rules or contracts require telling the client or a regulator, and how fast. Some do, with deadlines.
- Change the routine so it does not happen again.
Do not wait until you are sure it is serious. Deadlines can start when you become aware of the problem.
A one-paragraph policy to start from
Client work and AI tools. We use only the tools on the approved list, on business
accounts with training turned off. Before anything goes into an AI tool, identifying
details are replaced with placeholders and the result is read by the person doing the
work. The key that links placeholders to names stays on the firm's computers and is
never pasted into a chat. One client per conversation. A professional checks every
answer before it is used. Problems are reported to the owner the same day.
Paste it into your staff handbook, change the words that do not fit, and add your own rules on consent and retention.
Staff and habits
- Ten minutes at a team meeting beats a document nobody reads. Show one real before and after.
- Make the safe way the easy way. If staff must do twenty minutes of manual replacing, they will skip it.
- Review the policy twice a year. Tools and terms change.
Frequently asked questions
Is this a compliance programme?
No. It is a set of habits. Your professional rules, your contracts and the law decide what is required of you.
Do we need all of it for a firm of two?
The "for each task" list matters at any size. The rest can be a paragraph in a shared note.
Can we just ban AI?
You can, but staff may use personal accounts anyway. A clear, workable routine is more likely to be followed than a ban.
ClientSafe helps with the "replace" and "restore" steps. It replaces the identifying details with consistent placeholders on your PC and shows what it found for you to review, then puts the names back into the answer.
General information, not legal advice. Adapt it to the rules that apply to you.