A law firm's AI usage policy: what belongs in it
A usable AI policy answers four questions: approved systems, permitted data, output review and what happens when something goes wrong. The rest is trimming.
A usable AI usage policy answers four questions: which systems are approved, what data may go into them, who checks the output, and what happens when something goes wrong. Everything else is trimming.
The 2025 legal tech survey by legal-tech.de (around 80 participants, surveyed between May and August 2025) found 16 percent using a specific AI tool and 45 percent who could imagine introducing one. Most firms, then, write their AI policy before they have a system in use. That explains the most common flaw in these documents: with nothing concrete to govern, people write abstractly. An abstract policy governs nothing.
Which systems are approved?
The answer is an exhaustive list of names, not a principle. “Only use secure tools” is not a rule but a request to think along, and it pushes the decision onto the person with the least time to make it. The list names every approved system together with the access route it is approved through, because the same model can be off limits through a chat interface and workable through a cloud deployment (running it in your own account with a cloud provider).
Two details usually go missing: who maintains the list, and how a new tool gets onto it. Without a named route the route forms anyway, just invisibly. A short procedure is enough: proposal to a named person, review of the contractual position including the question of whether a data processing agreement is even sufficient, approval with a date, entry on the list. What is not on the list is not approved.
What data may go in?
Here a graded approach carries further than a blanket ban. A ban that prohibits entering client data in any form sounds strict and gets worked around the moment it stands in the way of the work. It then gets worked around quietly, and the firm loses exactly the visibility it wanted to create.
Three tiers are usually enough. Freely permitted is work with no connection to a matter: public legal sources, statutes and decisions, drafting help without personal data, internal organizational texts. Permitted only in the approved system is work on the matter itself, so briefs, draft contracts, statements of fact and correspondence. And there is a third category every firm has to define for itself, for instance matters where even the existence of the engagement is confidential.
The more precisely the middle tier is described, the less traffic gets diverted. Say clearly where client data may go and you have to explain less often where it may not.
Who checks the output?
The BRAK guidelines on the use of AI from December 2024 treat human final review as mandatory. That poses the question rather than answering it. The policy has to say who exercises that review at which step of the work and how it will later be apparent that it happened. Without that assignment, final review dissolves into good intentions: everyone takes it for granted, nobody is named.
The assignment that works best runs along the steps the work already has. Whoever owns the draft checks the AI output before it goes into the file or out the door; the check becomes part of the existing sign-off. It helps to know that the dangerous output is not the obviously wrong one but the plausible one. A review that only looks at form and language will not find it. The work can be delegated; the responsibility cannot.
What happens when something goes wrong?
This point is missing from almost every policy, and it is the one that shows whether the policy works. What is meant is the case where client data has ended up in a system that was not approved: by accident, under time pressure, out of ignorance.
The policy names a reporting route for that. To whom, how quickly, and what to do immediately, for instance secure the account and the history rather than deleting them, so the extent can still be established later. It should also make clear that the report itself carries no sanction. People who fear a report do not report, and then firm management hears about incidents either not at all or from the other side.
What follows depends on the case: whether the incident is notifiable under data protection law, whether the client has to be informed, and whether the policy needs tightening at the point where the error arose.
What the policy does and does not do
The AI literacy duty under Art. 4 of the AI Act has applied since 2 February 2025. A document naming systems, data categories and control steps belongs in the evidence, but it does not replace the training. Reading a policy does not create competence.
And the policy stays a living document, because the list of approved systems changes as soon as a tool is added or a contract expires. So the date and version belong on the first page, so it stays visible which rule applied when a matter was handled.
Answer the four questions and you have a policy. Paraphrase them and you have a document.
The content of this blog was created partly with the support of AI.