Guide
A ChatGPT and AI use policy for small firms.
Short answer
A workable AI policy for a small firm names the approved tools, lists what must never go into them, says who reviews AI output, and says how use is recorded. The sample below fits on one page; copy it, change the bracketed parts, and have your own counsel review it.
Updated September 24, 2026 · SOPHIA XT LLC
What the policy has to cover
- Which AI tools and accounts are approved, and that personal accounts are not.
- What must never go in: client identifiers, tax and financial figures tied to a client, passwords and keys, anything marked privileged.
- That a person reviews AI output before it reaches a client or a filing.
- How AI use is checked and recorded, and who reads the record.
- What to do after a mistake: tell someone the same day.
Lawyers should read ABA Formal Opinion 512, which expects supervising lawyers to set clear AI policies under Rules 5.1 and 5.3. Tax and accounting firms can fold the policy into the written information security plan the Safeguards Rule requires; IRS Publication 5708 has a sample plan.
Sample policy
Select the text and copy it. It is written for a firm using Safe-Desk; if you use something else, replace those sentences with how your firm checks and records AI use.
[Firm name] AI use policy
Effective [date]. Applies to everyone who works for [Firm name], including contractors.
1. Approved tools
You may use AI tools for firm work only through [Firm name]'s approved setup: [ChatGPT / Claude / Gemini / Copilot] in Chrome or Edge with the Safe-Desk extension signed in, the Safe-Desk chat, or [other approved tools]. Do not use personal AI accounts, private or guest browser windows, or AI apps on your phone for firm work.
2. What never goes into an AI tool
Do not type, paste or upload: Social Security numbers, ITINs or EINs; bank, card or account numbers; passwords, PINs, keys or security answers; client tax return information; anything marked privileged, confidential or attorney work product; [other firm-specific items]. Safe-Desk swaps many of these for placeholders automatically, but it is a safety net, not permission.
3. Files
Do not upload client files to an AI site. To work on a client document with AI, use Safe-Desk Files, which checks the document first.
4. Check the output
AI makes mistakes. Read and verify anything an AI tool produces before it goes to a client, a court, a regulator or a return. You are responsible for work you send, however it was drafted.
5. Records and review
Safe-Desk records who sent what kind of client data, when, and which rule caught it. It does not record the message. [Owner or compliance lead] reviews the log and receives alerts.
6. Mistakes
If client information may have reached an AI tool outside this policy, tell [name] the same day. Reporting early is expected and will not be held against you.
7. Acknowledgement
I have read this policy and will follow it. Name, date.
Putting it in place
In Safe-Desk the owner can publish the firm's AI policy to staff from Owner view, Policy, and see who has accepted it. Pair the policy with the steps in how to stop staff pasting client data into ChatGPT.
Safe-Desk costs $19 per staff member a month, with a 14-day free trial. Each seat includes $5 of AI a month inside Safe-Desk, pooled across the firm, and AI beyond that is billed at the model's cost plus 30%. Using your own ChatGPT or Claude through the extension or the connector costs nothing extra. Optional setup: we set it up for $149 for up to 10 staff, $10 for each extra person.
Questions
Do we need an AI policy if we are a five-person office?
Yes. Small offices are where one person's habit becomes the firm's practice. A one-page policy that names approved tools and forbidden data is enough to start.
Can we require staff to accept the policy?
Safe-Desk lets the owner publish the policy and records who accepted it and when. The extension and the Windows app don't ask staff to accept it yet.
Is this sample legal advice?
No. It is a plain-English starting point. Have your own counsel review it against your state's rules and your industry's obligations.
Related
- How to stop staff pasting client data into ChatGPTPolicy, approved accounts, a gate in the browser, and a log the owner reads.
- AI for law firms, with client confidences kept outRule 1.6, Formal Opinion 512, and what Safe-Desk catches in legal work.
- AI for accounting and tax firms, with client data kept outIRC 7216, the FTC Safeguards Rule, and what Safe-Desk catches in tax work.
- How Safe-Desk compares with the other ways to keep client data out of AIEnterprise DLP, browser-only extensions, private workspaces and banning AI, side by side.
Try it at your firm.
Start free trialSee how it worksSafe-Desk costs $19 per staff member a month, with a 14-day free trial. Each seat includes $5 of AI a month inside Safe-Desk, pooled across the firm, and AI beyond that is billed at the model's cost plus 30%. Using your own ChatGPT or Claude through the extension or the connector costs nothing extra. Optional setup: we set it up for $149 for up to 10 staff, $10 for each extra person.