AI policy checklist
A practical starting point for deciding how your team can use AI safely and consistently. Tick items off as you review them, then copy or print the result and adapt it to your business.
This is not legal advice. Treat it as a starter framework, not a compliance document. Have your operations lead, attorney, or compliance team review before adopting it across your team.
Use cases where AI typically helps with low risk when reviewed by staff.
Things AI should not do in your business without explicit approval and review.
Questions to answer before approving a new AI tool.
Define who reviews what — before AI is allowed to send anything.
Make sure every staff member knows what is allowed and how to flag issues.
The starter checklist is a baseline. Regulated industries need additional guardrails — and in some cases, specific vendor agreements before any AI tool touches client data.
Anything that touches PHI (patient names, conditions, dates of service, identifiers) requires a Business Associate Agreement with the AI vendor and HIPAA-aligned safeguards. Default to de-identified examples for any AI testing. Clinical judgment stays with licensed clinicians.
Confidentiality and privilege rules apply to any tool that processes client information. Do not paste client matter details into general-purpose AI tools. Document your approved tools, retention behavior, and when AI-assisted output requires attorney review.
Returns, financial statements, and client communications carry confidentiality and IRS Section 7216 obligations. Vendors that touch return data need clear data-handling terms. Treat AI output as a draft to be reviewed by a credentialed preparer.
Customer financial information falls under GLBA and state privacy laws. Review trails and access controls are non-negotiable. Avoid AI in any decisioning workflow (lending, suitability, advice) without compliance review and documented human oversight.
These are general cautions, not regulatory guidance. Confirm specifics with counsel and any industry-specific compliance lead before deploying AI in regulated workflows.
The Deskwire AI assessment ends with a 90-day plan that includes guardrails, vendor review, and human-review checkpoints tailored to your business — so policy and rollout move together.