Your staff are already using AI. Most firms just have not written down what is allowed. This template is a complete AI Acceptable Use Policy in Word: which tools are approved, what client data can never be pasted into them, who reviews the output, and what happens when someone gets it wrong. Put your firm name at the top, cut what does not apply, and add it to the handbook.
This template is general information, not legal advice. Have your counsel or compliance officer review it before your firm adopts it.
Fourteen sections and two appendices, about eight pages, with every decision your firm has to make marked as a fill-in field. An acknowledgment page for staff to sign and a new-tool request form are included.
The policy draws the line between enterprise AI accounts your firm administers (Microsoft 365 Copilot, ChatGPT Enterprise or Team, Claude for Work) and the personal accounts staff sign up for on their own. The personal accounts are where the exposure is, and the template says so plainly.
An explicit, editable list of what never goes into a general-purpose AI tool: client and matter names, SSNs and EINs, tax returns, financial statements, health information, engagement letters, and anything covered by an NDA or protective order.
Human review before AI output reaches a client or a filing, MFA on every AI account, a named owner who approves new tools, a vendor questionnaire to run before you say yes, and a short reporting path for the day someone pastes the wrong thing.
Citations you can hand to a regulator, an auditor, or a cyber carrier: the NY SHIELD Act, NYDFS Part 500, SEC Reg S-P, IRC §7216, ABA Model Rule 1.6, and NYC Local Law 144 if you use AI anywhere in hiring.
Writing it down takes an afternoon. Making it true takes tenant work: finding out which AI tools your staff have already signed into with their work email, blocking the ones you did not approve, turning on the Copilot and Purview controls you are probably already paying for, and keeping client data inside your own tenant. That is what we do for firms in Lower Manhattan and across the city.