AI use policy template: Financial services edition

1. Purpose

This policy says what artificial intelligence (AI) tools may and may not be used for at [Company name]. It exists so that everyone on the team makes the same call, and so that a client, insurer or regulator who asks gets one clear answer.

Generative AI creates no new obligations for a regulated firm; the existing ones simply apply. This policy maps those obligations (supervision, recordkeeping, communications with the public, fair lending) onto AI use.

2. Scope

• This policy applies to every registered and non-registered person at [Firm name], including contractors and vendors who act for the firm.
• It covers every AI tool: chat assistants such as ChatGPT, Claude, Copilot and Gemini, AI features inside software we already use, and any tool with AI in it that a team member signs up for.
• It covers work done on company devices and on personal devices when the work is for [Company name].
• It covers client communications, research, marketing, lending decisions, operations and compliance work.

3. What AI may touch

• First drafts of internal procedures, meeting notes, training material and summaries of published regulation.
• First drafts of client communications and marketing, which then go through the supervision and archiving process below before use.
• Analysis of data inside approved tools, where the data has been approved for that tool.
• [Add or remove lines to fit the firm]

4. What AI may never touch

• Client account numbers, Social Security numbers, balances, holdings and transaction detail in any tool not approved for them.
• Material non-public information in any tool.
• An investment recommendation, a suitability decision, a credit decision or an adverse action made by the tool alone: a licensed or authorized person decides and the record shows who.
• Client communications sent without the supervisory review and archiving below.
• Passwords, trading credentials, API keys and security settings.
• [Add any category your regulator, your clearing firm or your E&O policy restricts]

5. Approval of new tools (enterprise-level review)

• [Chief compliance officer or named reviewer] approves every AI tool at the enterprise level before anyone at the firm uses it. Individuals do not adopt tools on their own.
• The review covers: data handling and training terms; where data is stored; whether outputs can be archived; how the tool fits the firm's supervisory procedures; model risk, including what the tool gets wrong and how that would be caught.
• The review is written up and kept at [Location]. Approved tools and their approved uses are listed at [Location].

6. Supervision and archiving of AI-assisted communications

• Every client-facing communication that AI helped produce is reviewed by [Name or role of supervisor] under the firm's written supervisory procedures before it goes out, and is archived in [Archiving system] for [Retention period] like any other business communication.
• Prompts and outputs that form part of a client communication or a recommendation are retained with it.
• Retail communications and correspondence keep their existing review and filing requirements; using AI changes nothing about them.
• AI tools that cannot be archived are not used for client communications.

7. Human review

• A person checks every AI-written document before it goes to a client, customer, regulator or the public. The person who sends it is responsible for it, not the tool.
• AI output is a draft. We do not send an answer we have not read from start to finish.
• Facts, figures, names, dates and quotations in AI output are checked against the source before they go out.
• A licensed or authorized person reviews every recommendation, disclosure and decision that AI assisted with, and is accountable for it.

8. Lending and adverse action

• Where AI assists a credit decision, the firm can state the specific and accurate principal reasons for any adverse action. "The model said so" is not a reason.
• Models used in lending are tested for disparate impact before use and every [12] months. Results are kept at [Location].
• [Delete this section if the firm does not lend]

9. Records

• When AI helped write something we sent out, we note which tool was used, what we gave it, and who checked the result. The record lives at [Location of the AI use log].
• Records are kept for [12] months, or longer if a contract or regulator requires it.
• Enterprise reviews, supervisory sign-offs and model testing results are kept under the firm's books and records schedule.

10. Vendor terms

• Before a tool is approved, [Name or role] reads its terms for four things: whether our inputs train the vendor's models; how long the vendor keeps our data; where that data is stored; and who owns the output.
• Where a vendor offers a setting that stops training on our inputs, it is switched on before the tool is used, and the setting is checked every [3] months.
• Terms are re-read every [12] months and whenever the vendor announces a change.
• For each approved tool the firm keeps the terms relied on, the data processing terms, and confirmation that outputs can be archived, at [Location].

11. Describing our AI use in client materials

Client materials describe AI use accurately, neither overstating what the tools do nor hiding that they are used. The firm's standard wording:

• "[Firm name] uses artificial intelligence tools to assist with [drafting communications, summarizing research, and administrative tasks]. All recommendations and client communications are reviewed by a licensed professional before they are made. AI tools do not make investment, credit or coverage decisions for our clients."
• Any claim about AI in marketing is reviewed by [Compliance] before use and is supported by what the tool actually does.

12. Training

• Every team member reads this policy when they join and again once a year, and confirms in writing that they have.
• [Name or role] runs a short session on safe AI use at least once a year: what the tools do with what we type, how to check an answer, and what never goes into a chat window.
• Training covers the approved tools, the supervisory and archiving process, the lending rules where relevant, and the firm's standard description of AI use.

13. Review date

• This policy is reviewed on [Review date], and sooner after any incident, any new tool, or any change in the law or in a client's requirements.
• The review checks that the approved tools list is current, that the records are being kept, and that the training has happened.

14. Sign-off

• Owner of this policy: [Name, role]
• Approved by: [Name, role]
• Date approved: [Date]
• Version: [1.0]
• Next review: [Review date]