Governance
The firm AI policy, in one page
2026-10-12
Short answer
A workable firm AI policy fits on one page: it lists where AI may be used, where it may not (final sign-off, causal claims, identifying data), the three data tiers, the verification routine (label authority vs reasoning, check every citation), disclosure wording, who verifies and signs off, and a review on every model update.
What the one page contains
- Permitted uses
- Prohibited uses
- Data tiers and approved tools
- Verification routine
- Disclosure wording
- Accountability and sign-off
- Review on model updates
Why one page
A policy is only useful if the team knows it. One page, in plain English, that everyone has read beats a fifty-page manual nobody opens. The register and the review are what make it real.
How it protects the firm
When a client asks ‘who verified this?’, the register answers. When an insurer asks about AI, the policy is the answer.