In most firms the first AI policy is written after someone notices a client's name in a chat history. It is far better to write it before. Here is what to settle, and a standard short enough that people will follow it.

Three questions to answer first

  1. Where is the data processed and stored? Consumer chat tools, business tiers of the same tools, and systems you run yourself all handle data differently. Business tiers typically offer contractual terms on retention and training use that consumer accounts do not. Know which tier your team is on.
  2. Is the data used to train the model? Read the terms for the specific plan. If the answer is yes or unclear, client information does not go in. This is the single most common gap we find.
  3. Who in the firm can see what was entered? Workspace tools may give administrators access to histories. That is useful for oversight and must be disclosed to the team.

Canadian firms work under PIPEDA federally and, in some provinces, substantially similar provincial legislation, alongside sector rules from bodies such as securities regulators, law societies and professional colleges. The principles are consistent: collect only what you need, use it for the purpose the client expects, protect it in proportion to its sensitivity, and be able to explain where it went.

A short standard your team will follow

Long policies are not read. The one below fits on a page and has held up in practice.

  • Approved tools only. Name them. Name the plan tier. Anything not on the list is not used for firm work.
  • Client identifiers stay out of general tools. Names, account numbers, addresses, dates of birth and anything that could identify a client are never entered into a general-purpose chat tool. Describe the situation; do not paste the file.
  • Full client data goes only into systems the firm controls. That means tools with a signed agreement, access controls, and a known answer to the three questions above.
  • A person reviews every output before it reaches a client or a record. AI drafts. People decide.
  • Exceptions go to one named person. Not a committee. One owner, a quick yes or no, and a note of the decision.
  • Review the standard twice a year. Tools change terms. The standard should keep up.
A habit that does most of the workBefore anyone pastes anything, one question: would I be comfortable if the client watched me do this? If not, do not.

Why this is an operations problem, not a technology problem

The firms that handle this well do not have better tools. They have made a decision, written it down, and told everyone. That is the same discipline a practice already applies to filing, retention and client communication, extended to one more category of tool.

It is also the first thing we settle in any engagement. Every system we build, from intake to follow-up, runs inside the firm's own tools with a defined review step, because the only AI a regulated firm can rely on is AI it can explain.