AI Usage Policy for Law and Accounting Firms

Does your law firm or accounting practice have a clear AI usage policy in place before staff start using tools like ChatGPT?

Here is a scenario we come across more often than firms would like to admit. A staff member, trying to save time on a tedious task, pastes a chunk of a client file into ChatGPT to get a quick summary or a first draft of a letter. No malice involved. They are just trying to get through their workload.

But that client information has now left the firm’s controlled environment and gone into a public AI tool, with no record of it happening and no policy that was broken, because no AI usage policy existed in the first place.

If your firm does not have a written AI usage policy yet, this has probably already happened somewhere in your business. The question is not whether your staff are using AI tools. It is whether you know how, and whether you have given them a clear AI usage policy to follow.

Key Takeaways

• An AI usage policy sets clear rules for which AI tools staff can use and how, instead of relying on verbal guidance.
• Without an AI usage policy, staff are likely already using tools like ChatGPT with client data, often without anyone knowing.
• Law firms carry obligations under the Legal Profession Uniform Law and legal professional privilege. Accounting firms carry obligations under APES 110 and the Tax Practitioners Board.
• A solid AI usage policy covers approved tools, what cannot be entered into AI tools, verification steps, client disclosure, incident reporting, and new tool approval.
• An AI usage policy works best as part of your firm’s broader cybersecurity framework, not as a standalone document.
• Writing the policy is only step one. It needs training, communication, and regular review to actually work.

What Is an AI Usage Policy

An AI usage policy is a written set of rules that defines how staff at a law firm or accounting practice are allowed to use artificial intelligence tools such as ChatGPT or Microsoft Copilot in their day to day work.

A proper AI usage policy goes beyond a single vague instruction like “do not put confidential information into AI tools.” It sets out exactly which tools are approved, what categories of information can and cannot be entered into them, who is responsible for checking AI generated content before it is used, how incidents are reported, and how new AI tools get evaluated and approved.

For professional services firms specifically, an AI usage policy exists to protect client confidentiality, legal professional privilege, and regulatory obligations while still allowing staff to benefit from the genuine productivity gains AI tools offer. An AI usage policy is not about banning AI. It is about giving staff clear, practical rules so AI tools can be used safely.

Why Verbal Guidance Is Not Enough

Verbal guidance and good intentions are not an AI usage policy. They do not hold up if something goes wrong, they are inconsistent across staff, and they give your firm no real way to demonstrate due diligence if a client, a regulator, or your insurer ever asks how AI tools are being managed.

For law firms, a documented AI usage policy matters because of legal professional privilege and obligations under the Legal Profession Uniform Law.

For accounting firms, an AI usage policy matters because of client confidentiality requirements under APES 110 and obligations to the Tax Practitioners Board. Both professions also carry obligations under the Privacy Act 1988 around how personal information is collected, used, and disclosed, and AI tools sit right in the middle of that.

An AI usage policy is not about stopping staff from using these tools. It is about making sure AI tools are used in a way that protects your clients, your firm, and your professional obligations.

What an AI Usage Policy Should Actually Cover

A policy that just says “don’t put confidential information into AI tools” is not enough on its own. Staff need practical clarity, not a single vague rule. A solid AI usage policy for a professional services firm typically addresses the following areas.

Approved tools

Which AI tools are sanctioned for use, such as Microsoft Copilot operating within your firm’s secured tenant, and which tools are off limits, such as free public versions of ChatGPT or other consumer AI tools that staff might have on their personal devices. A clear AI usage policy names the approved tools explicitly rather than leaving staff to guess.

What can and cannot be entered into AI tools

This needs to be specific. Client names, matter numbers, financial figures, case details, and any personally identifiable information should generally be excluded from non approved tools, with clear examples staff can refer back to in the AI usage policy.

Verification requirements

Every piece of AI generated content, whether it is a draft letter, a summary, or a research note, needs a defined review step before it is used or sent. The AI usage policy should state who is responsible for that check.

Disclosure to clients

Some clients will want to know if AI tools were involved in preparing their documents or advice. The AI usage policy should set out your firm’s position on this, including whether it is mentioned in engagement letters.

Incident reporting

Staff need a clear, low friction way to report it if they realise sensitive data has gone into a tool it should not have. An AI usage policy that punishes honesty discourages people from speaking up, which makes the actual problem worse.

Approval process for new tools

AI tools are launching constantly. Staff will inevitably want to try new ones. The AI usage policy should set out a simple process for getting a new tool reviewed and approved rather than leaving staff to make that call themselves.

Banning AI Tools vs Having an AI Usage Policy: A Quick Comparison

Factor	Banning AI Tools Outright	Having an AI Usage Policy
Staff behaviour	Usage gets pushed out of sight, often onto personal devices	Staff are channelled towards approved, monitored tools
Visibility for the firm	No visibility into how AI is actually being used	Creates a documented, auditable record of approved use
Productivity impact	Removes genuine productivity gains entirely	Lets staff benefit from AI within clear, safe limits
Regulatory and insurance position	Hard to defend as due diligence if something goes wrong	Evidence the firm actively considered and managed the risk
Realistic compliance	Routinely ignored in practice	Far more likely to actually be followed by staff

Risks of Not Having an AI Usage Policy

• Confidential client data can end up stored on a third party AI provider’s servers, outside the firm’s control, with no record of what was entered or when.
• For law firms, pasting case details into an AI tool can risk waiving legal professional privilege over that material, depending on the tool and how it is used.
• Without a defined verification step, AI generated content can be sent to clients or filed with a regulator containing errors, fabricated case citations, or inaccurate figures that nobody caught before it went out.
• Regulators, insurers, and clients increasingly expect firms to show they have actively considered AI related risk. A firm with no AI usage policy and no record of considering the issue is in a far weaker position if an incident occurs or a complaint is made.
• Staff are left making individual judgement calls about what is and is not appropriate to enter into an AI tool, which leads to inconsistent practice across the firm and no way to correct it before a problem happens.

How an AI Usage Policy Connects to Your Broader Cybersecurity Obligations

An AI usage policy should not sit on its own as a separate document nobody reads. It works best as part of your firm’s existing cybersecurity framework, sitting alongside your acceptable use policy, your data handling procedures, and your alignment with frameworks like the ASD Essential Eight or SMB1001 certification.

This is particularly relevant given the Cyber Security Act 2024, which has sharpened expectations around how Australian businesses, including professional services firms, manage cyber risk and respond to incidents.

Regulators and insurers increasingly expect firms to demonstrate they have actively considered emerging risks like AI tool usage, not just traditional threats like phishing and ransomware. A documented, actively communicated policy is part of showing that due diligence.

How to Create an AI Usage Policy: Step by Step

Building an effective AI usage policy does not need to be complicated, but it does benefit from a structured approach.

Start by finding out how AI tools are already being used in your firm. An honest, non punitive conversation with staff about current habits gives you a realistic starting point rather than writing a policy based on assumptions.

Decide which AI tools will be approved and which will be restricted. This usually means tools operating within your firm’s secured environment, such as Microsoft Copilot inside your tenant, being approved, while free public consumer tools are restricted or banned for confidential work.

Define clearly what categories of information cannot go into non approved tools. Specific examples, such as client names, matter numbers, and financial figures, make a policy far easier for staff to apply consistently than abstract language alone.

Set out verification and disclosure requirements, including who checks AI generated content before it is used and whether AI involvement is disclosed to clients.

Add an incident reporting process that staff can use without fear of punishment, and a simple approval pathway for new tools staff want to start using.

Consult relevant stakeholders, including partners, your compliance lead, and your IT provider, before finalising the policy, since each will see different risks and practical considerations.

Roll the AI usage policy out with proper training rather than just an email and a shared drive link, then set a review date, at minimum annually, to keep the policy current as AI tools change.

Common Mistakes Firms Make With an AI Usage Policy

Treating the AI usage policy as a one off document. AI tools and their capabilities change quickly, and a policy written once and never revisited becomes outdated within a year.

Writing an AI usage policy nobody actually reads. A policy buried in a shared drive with no training or communication around it provides little real protection.

Leaving enforcement to everyone, which in practice means no one. A policy needs one clear owner responsible for enforcement and updates.

Trying to ban AI tools outright instead of channelling usage through an AI usage policy. Bans are routinely ignored and simply push usage out of sight.

Writing rules that are too vague to apply. A policy that only says “be careful with confidential information” gives staff nothing concrete to follow.

Writing the Policy Is Only Step One

A policy document sitting unread in a shared drive does not protect anyone. A policy needs to be introduced through proper training, reinforced when new staff join, and revisited periodically as AI tools and your firm’s usage of them evolve.

The most effective approach we see is pairing the policy rollout with a short, practical training session so staff understand not just the rules, but the reasoning behind them.

How XCD IT Helps

Writing an AI usage policy that is specific enough to be useful but practical enough that staff actually follow it takes some thought, particularly when you are trying to balance productivity gains against confidentiality and compliance obligations.

XCD IT helps law firms and accounting practices across Brisbane develop an AI usage policy that fits how the firm actually operates, paired with staff training to make sure the policy sticks. We also help align your AI usage policy with your wider cybersecurity setup, including Essential Eight alignment and SMB1001 certification, so it is not sitting as an isolated document.

If your firm needs an AI usage policy or wants to review the one you already have, we would welcome a conversation.

Frequently Asked Questions