Staff are already using AI tools, whether or not the business has a policy. Without one, client data ends up in consumer chat apps, drafts go out unchecked, and nobody is sure what is allowed. A short, clear policy fixes that without banning useful tools.
1. List approved tools
Name the AI tools staff may use for work and the accounts they must use, which means business accounts rather than personal ones. Business plans often provide stronger data handling commitments and administrative controls. Anything not on the list needs approval before use.
2. Classify information
Define, in plain terms, what may and may not go into each tool:
- Public information, such as published content, is generally fine in approved tools.
- Internal information, such as plans and non-sensitive business documents, is allowed only in approved business tools.
- Confidential client information, such as tax data, financial records, personal identifiers, and member data, is allowed only in tools specifically approved for it, under your security and legal obligations.
Tax professionals should consider their obligations under the FTC Safeguards Rule and Section 7216 before any client information is processed by a new tool.
3. Require review
AI output is a draft. State that a person must review AI-generated content before it is sent to clients, filed, published, or relied on for a decision, and that the reviewer is accountable for it.
4. Address disclosure
Decide when you will tell clients or members that AI assisted with work, and follow any professional or contractual requirements that apply. Some businesses describe their use of AI in engagement letters or privacy notices.
5. Watch for manipulation
AI tools that read emails, documents, or web pages can be manipulated by hidden instructions in that content. Treat AI-suggested actions with appropriate skepticism, especially anything involving payments, credentials, or sending data elsewhere.
6. Assign ownership
Name a person who maintains the approved tool list, answers questions, and reviews the policy at least annually.
Keep it to two pages
A policy people read and follow beats a comprehensive one nobody opens. Pair it with a short training session and examples of good and bad use.
If you want AI that works on business data with controls built in, IVOKER keeps each firm’s information scoped to that firm, opens only in a signed desktop app, and requires approval before mail is sent.
Written by the Syntonyl team. This article is general information, not legal, tax, or financial advice.