Template
AI use policy template for accounting and law firms
By Hugo Ribeiro · Updated · 7 min read
In most firms AI is already in use, nearly always without written rules. The risk is not the tool; it is each person deciding alone what may be sent. A short policy fixes that and leaves evidence that the firm has thought about it.
What it rests on
- Professional confidentiality under your professional body's rules: client facts and documents are not disclosed to third parties. See AI and professional secrecy.
- GDPR (and the UK GDPR, which mirrors these provisions): accountability (Article 5(2)), a contract with anyone processing data on your behalf (Article 28) and appropriate security measures, pseudonymisation among them (Article 32).
- EU AI Act (Regulation (EU) 2024/1689), Article 4: organisations using AI must take measures towards sufficient AI literacy of their staff. The wording was adjusted in 2026 by the Digital Omnibus package, but the duty to take measures remains.
Template (copy and adapt)
Artificial intelligence use policy
[Firm name] · Version 1 · [date]
1. Scope. Applies to all partners, staff and trainees, and to any generative AI tool used for firm work.
2. Approved tools. Only the tools listed in the annex may be used, with firm accounts. Personal accounts and free plans are not used for client work. A new tool joins the list only after approval by [responsible person].
3. Data that is never sent. Data identifying clients, clients' employees or third parties is not sent to AI tools: names, tax and VAT numbers, National Insurance or social security numbers, IBANs, addresses, contact details, case numbers. Passwords and credentials are never sent.
4. Preparing documents. Before a client document is sent, identifiers are replaced with codes (pseudonymisation) on a firm computer, using [tool]. The lookup table does not leave the firm. The sender confirms that no identifier is left visible.
5. Human review. No AI output goes to a client, a tax authority, a court or any other party without review by a professional of the firm, who is responsible for its content. Citations of law, cases and figures are always checked at source.
6. Records. The firm keeps the list of approved tools, the related contracts and the date of each review of this policy.
7. Training. All staff are trained on this policy and on the limits of AI when they join and at least once a year.
8. Incidents. Anyone who sends identifiable data by mistake reports it at once to [responsible person], who assesses whether there is a notifiable data breach.
9. Informing clients. The engagement letter or the firm's privacy notice states that AI tools are used and on what terms.
10. Review. This policy is reviewed every year, or when the law, professional guidance or the tools change.
Read and accepted: [name, date, signature]
How to adapt it
- Point 2: write the exact tool and plan names. "ChatGPT" is not enough; the free and business plans have different terms.
- Point 3: add what is specific to your practice, such as health data in insurance matters or children's data in family cases.
- Point 4: this is what makes the policy workable. If the only rule is "do not send", people stop using AI or use it quietly. With a pseudonymisation step the work gets done and the data stays.
- Point 9: confirm the wording with your professional body or your data protection officer.
This template is a starting point and is not legal advice for your situation.
Where Velado fits
Velado is the tool in point 4: it replaces identifiers with codes on the firm's computer, keeps the table in a local vault and restores the data in the answer. Because the AI only receives codes, points 3 and 4 are met without changing how people work. You can try it in the browser or see how it works for accountants and for lawyers.
FAQ
Does a small firm really need a written policy?
It needs to be able to show what it does. The GDPR requires the controller to demonstrate compliance (Article 5(2)), and a page signed by everyone is the simplest way to do it. It also stops each member of staff deciding alone what can be pasted into ChatGPT.
Do I need the client's consent to use AI?
If what you send does not allow the client to be identified, the confidentiality question does not arise in the same way. If you send identifiable data you are disclosing it to a third party and need a basis for that: check with your professional body and consider a clause in your engagement letter.
Should the policy ban free accounts?
That is the most common rule. Free and personal plans generally come with no data processing agreement and no assurance about training on your data. The template below only allows firm accounts.
What is AI literacy?
It is the obligation in Article 4 of the EU AI Act: organisations that use AI systems must take measures so that the people using them know enough to do so. An internal training session and this policy, read and signed, are a good start. It applies to firms in the EU; UK firms are not bound by it.
Try it with your own document
Velado runs in your browser, on your computer: nothing is sent to any server.