Gap summary

What is missing today

No list of approved AI tools. Staff use ChatGPT and Microsoft Copilot on their own accounts, so the firm cannot say which tools touch client work.
No rule on client data. Nothing written says which client information may or may not go into an AI tool. Client names, tax figures and bank details could be pasted into a personal account today.
No review step. AI-written client emails and spreadsheet summaries can reach clients without anyone checking them.
No owner for the topic. Nobody is named to approve new tools or answer staff questions.

Draft

This is a draft starting point. Review and adapt before use. Not legal, financial, or compliance advice.

AI Usage Policy — Harbor Lane Bookkeeping

Owner: Managing partner · Applies to: all staff and contractors · Review: every 6 months

1. Approved tools

Tool	Allowed for	Account
Microsoft Copilot (firm Microsoft 365)	Drafting emails, summarizing our own spreadsheets	Firm account only
ChatGPT	General questions with no client information	Firm workspace only, not personal accounts

Any other AI tool needs the managing partner's approval before it is used for firm work.

2. Client information

Never paste client names, account numbers, tax IDs, payroll figures or bank details into an AI tool, unless the tool is listed above for that use and the firm account is used.
Remove client identifiers before asking for help with a formula or a summary.
Personal AI accounts are never used for firm work.

3. Review before anything leaves the firm

Every AI-assisted email, letter or report is read and corrected by the staff member who sends it.
Figures produced or summarized by AI are checked against the source before they are shared.
If you are unsure whether a draft is accurate, ask a second person to check it.

4. Questions and changes

Ask the managing partner before using a new tool or a new kind of data. If client information goes into a tool by mistake, tell the managing partner the same day so the firm can decide what to do.

[End of draft. Customize this document before sharing or publishing it.]

90-day checklist

Next 90 days

Week 1: Managing partner approves this policy and names the tool owner.
Week 2: Move all AI use to firm accounts; staff stop using personal accounts for work.
Week 3: 20-minute team walkthrough of sections 2 and 3, with two real examples.
Month 2: Check one week of AI-assisted client emails against the review rule.
Month 3: Review the approved-tools table and update it.

See a sample draft

Pick a sample business and see the gap summary, draft and 90-day checklist the AI Orchestrator produces. The businesses are fictional; nothing you do here is stored.

What Harbor Lane Bookkeeping told the Orchestrator