A client may be perfectly happy for you to use AI to format a report and deeply unhappy to discover that interview transcripts were uploaded to an external service. The difference is not always obvious until someone asks.
A short AI policy helps you answer before the question becomes awkward. It should explain which tasks your team uses AI for, which information may be processed, what services are approved and who checks the output. It should also say what the firm does not permit.
Keep the policy practical. “We use AI responsibly” tells a client almost nothing. “We use approved tools for drafting from public sources; confidential material requires a separately authorised workflow; a named professional verifies claims and citations before delivery” is more useful. The exact rules will depend on your contracts, legal obligations and technical arrangements.
Include staff in the discussion. If a colleague finds a new tool, there should be a simple way to request a review. Otherwise people may use it quietly because the existing process is too difficult.
Review the policy when tools or client requirements change. A document written before agents gained access to email and files may no longer cover the actual risks.
Planetary.Blue is developing practical guidance for professionals preparing these policies. For organisations needing more than a template, consulting support can help map workflows, permissions and verification responsibilities. The aim is a policy that describes what people really do, not an impressive document that sits unread.
When assessing an AI vendor, ask where files and prompts are processed, whether data is retained or used for training, who can access logs, how records are deleted and whether a complete export is possible. Ask for written answers, not just a sales demonstration.
