Banning AI doesn’t stop people from using it. It stops them from telling you. A short policy that says which tools are approved and what data goes where works better, because people can follow it without guessing.
This template is a plain-language starting point. It includes a policy for most organizations, plus an optional addendum for law firms. Download it, replace the bracketed fields, have your counsel review it, and adopt it.
Download the template
No form, no email required.
Who this is for
It’s written for midmarket organizations that want one clear policy for employees, contractors, and anyone else using company systems. It works for law firms, energy companies, private equity portfolio companies, medical device manufacturers, and general business. The law firm addendum adds the pieces lawyers need around privilege, client consent, and ethical walls.
What’s inside
The base policy has twelve sections:
- Purpose and scope
- Approved tools
- Data classes and what goes where
- Prohibited uses
- Personal accounts and browser extensions
- AI notetakers and recording tools
- Human review of AI output
- Client and customer disclosure
- Incident reporting
- Training
- Ownership and review cadence
- Acknowledgment
The law firm addendum covers privilege and confidentiality, client consent and engagement letters, ethical walls and matter access, supervision, and retention and eDiscovery.
How to adapt it
Start with section 2, the approved tools list. It’s the part only you can fill in, and it’s the part people look at first. Then check the data classes in section 3 against how your organization already labels information. If you have sensitivity labels in Microsoft 365, use those names. If you don’t, use three plain classes and move on.
Keep it short. A policy that fits on two pages gets read. A policy that fits on twelve gets signed and ignored.
Pair the policy with discovery. You can’t enforce a list of approved tools if you don’t know what’s in use. Our shadow AI guide explains how to find unapproved AI, how to decide what to sanction, and how to roll out a policy people follow. Our shadow AI detection checklist gives the seven checks to start with.
The law firm version
Lawyers have duties beyond ordinary data handling. ABA Formal Opinion 512, issued July 29, 2024, addresses competence, confidentiality, client communication, supervision, and fees in the context of generative AI. The Texas Committee on Professional Ethics issued Opinion 705 in February 2025 on the same subject. The addendum in this template translates those themes into firm rules: which tools can touch client information, when to tell clients, how matter access and ethical walls apply to AI tools, and who supervises.
This template isn’t legal advice. Your firm’s general counsel or ethics counsel should review it against your jurisdiction’s rules and your clients’ outside counsel guidelines before you adopt it.
What the template doesn’t do
It doesn’t make a tool safe by itself. A policy sets the rules, and you still need approved tools configured properly, access permissions that match your intent, and a way to find the AI use you didn’t approve. If you’d like help seeing where your Microsoft 365 environment stands, the AI Readiness Snapshot is a starting point for that conversation.