You don’t need a large compliance team to use AI responsibly. A short, practical set of rules protects your clients, your data and your reputation while letting people get on with their work.
Key takeaways
- Approve specific AI tools and business plans.
- Define which data may be used in which tools.
- Require human review where accuracy and reputation matter.
- Train staff and review the policy regularly.
The checklist
1. Inventory current use
- Which AI tools are people already using, personally or for work?
- What tasks are they using them for?
2. Approve tools
- Choose approved tools and business plans with appropriate data controls.
- Publish an approved-tools list and a process to request new ones.
3. Classify data
- Define what counts as public, internal, confidential and restricted information.
- State which categories can be used in which tools, and which never can.
- Check client contracts for restrictions on using their data.
4. Require human review
- Anything published, sent to clients or used in decisions needs a human check.
- AI-generated facts, figures and citations must be verified.
5. Protect intellectual property
- Be careful with confidential client materials and trade secrets.
- Understand vendor terms on ownership and use of inputs and outputs.
6. Assess vendors
- Review security, data use, retention and compliance information for each AI vendor.
- Revisit when vendors change terms or features.
7. Train people
- Explain the policy in plain language with examples.
- Teach good practice: giving context, checking outputs, protecting data.
8. Review regularly
- Update the policy at least annually and when adopting major new tools.
- Track incidents and near misses and learn from them.
This checklist is general guidance, not legal advice. Involve your legal advisors for regulatory and contractual questions.