# AI Use Policy (template)

Lean AI Gov template by Fresco Consulting. Replace everything in [brackets]. Keep it to about one to two pages. Not legal advice; firms handling regulated data should have their attorney review the final version.

**Company:** [Company name]
**Effective date:** [date]  **Next review:** [date, 3 months later]
**AI lead (owner of this policy):** [name, email]

## 1. Purpose
We use AI tools to work faster and better. This policy sets simple rules so we protect client and company information, check AI output before it matters, and stay in control of the accounts we use.

## 2. Who this covers
All employees, contractors, and interns who use AI tools for [Company name] work, on any device, including personal phones.

## 3. Approved tools
Only tools on this list may be used for work. Ask the AI lead to add a tool before using it.

**Approved (general use, within the data rules below):**
- [Tool, plan type, for example "business plan, company-managed account"]

**Approved with limits:**
- [Tool]: [limit, for example "internal drafts only, no client data"]

**Not allowed:**
- Any AI tool on a personal account for work data.
- [Any specific tools or categories, for example "free browser AI extensions", "AI meeting recorders on client calls without consent"]

## 4. Data rules
| Data class | Examples at our firm | Can it go into an approved AI tool? |
|---|---|---|
| Public | [website text, published prices] | Yes |
| Internal | [internal procedures, non-client drafts] | Yes, approved tools only |
| Confidential | [client names with details, contracts, pricing, employee records] | Only in tools marked "approved for confidential" below, and only the minimum needed |
| Regulated | [health information, SSNs, bank or card numbers, data covered by client contracts] | No, unless the AI lead has approved a specific tool and use in writing |

Tools approved for confidential data: [list or "none yet"]

When in doubt, remove names and identifying details first, or ask the AI lead.

## 5. Human review
- A person must read and check any AI output before it is sent to a client, published, used in a financial or legal decision, or used to evaluate an employee or applicant.
- Check facts, figures, names, and citations against the original source. AI tools can produce confident mistakes.
- You are responsible for work you send, whether or not AI helped.

## 6. Disclosure
- Tell clients when AI produced a substantial part of a deliverable if [your client contracts require it / the client asks / always, by our choice].
- Do not use AI to imitate a real person's voice, image, or writing without their permission.
- Do not record or transcribe calls with AI tools unless everyone on the call has been told and agrees. [Check your state's recording-consent rules.]

## 7. Accounts and security
- Use company-managed accounts with multi-factor authentication for every approved AI tool.
- Do not share AI tool logins.
- When someone leaves, the AI lead removes their access the same day as their other accounts.
- Turn off settings that allow the vendor to use our data for model training where the plan allows it.

## 8. Problems and incidents
Report right away to the AI lead and [IT provider contact] if:
- Confidential or regulated data was put into a tool that is not approved for it.
- An AI output with a serious error was sent to a client.
- You suspect an AI account was accessed by someone else.
- You receive a suspicious request that may use a cloned voice or video, especially about payments or passwords.
Reporting quickly is always the right call. Follow the Incident Response One-Pager.

## 9. New tools and requests
Ask the AI lead with: tool name, what you want to use it for, and what data it would touch. The AI lead checks it with the AI Vendor Risk Checklist and replies within [5] business days.

## 10. Acknowledgment
I have read this policy and will follow it.

Name: ____________________  Signature: ____________________  Date: __________