Sample AI Policy & Risk Pack: United States
Excerpts from all 8 documents of a real pack, generated for a fictional accounting firm in the US with 20 staff that uses Microsoft Copilot for Microsoft 365, ChatGPT and an AI receipt-capture tool.
The excerpts are copied word for word from the generated pack. We've left parts out for length, but haven't reworded anything. Your pack is written from your own answers, so it will differ.
Generated on 30 October 2026. A starting point for your organization to review and adopt, not legal advice.
1. AI Acceptable Use Policy
Which tools staff may use, for what, and with which data.
Approved AI tools and how they may be used
Three tools are approved. Any other tool, account or use is not approved until it passes the approval steps in this policy. Tool names below match the AI Tool Inventory.
- ChatGPT: May be used on the firm-approved account only, to draft client letter wording from generic templates and anonymized text, and for general wording. Must not be used on a personal account, to decide a tax treatment, or to send a letter without the file check. Must never receive client names, tax identifiers, income details, tax or financial records, bank statements or client correspondence in identifiable form.
- AI receipt-capture tool: May be used to extract and categorize expense data from receipts, expense images and bank statement transaction lines for bookkeeping and return preparation, with account numbers masked. Must not be used to finalize an expense treatment without the checks set out in this policy. Must never receive tax identifiers, full bank statements or income details beyond individual transaction amounts.
Prohibited uses
- Using any AI account other than the firm-approved ChatGPT account, or any personal AI account, for firm work. Data entered into a personal account leaves the firm's control. Example: a staff member pastes a client's bank statement into a personal ChatGPT account on a weekend to speed up a letter.
- Entering a data type that the data rules in this policy do not permit for that tool. Example: an unmasked bank statement is pasted into ChatGPT to draft a letter about a late payment, exposing the account number outside the firm's environment.
- Using AI to make a final decision on a client's tax position, filing position, eligibility or liability. Any AI-assisted decision that affects a client's return MUST have documented human review by the Licensed Tax Accountant before it is relied on.
Excerpt. Other parts of this document are left out.
2. AI Risk Checklist
Yes/no questions across ten risk areas, each with the action to take if the answer is no.
Data privacy
- Are client names, tax identifiers and income details kept out of ChatGPT, with letter drafts built only from generic templates or anonymized correspondence in which client names are replaced with placeholders and tax identifiers, income figures and account details are removed? If no: Client Services Lead stops using the draft, rebuilds it from anonymized text, and reports the event to the Practice Manager within one business day. Example: a letter to a sole trader is drafted from a pasted email that still contains a full client name and tax identifier.
- Are unmasked tax identifiers kept out of Microsoft Copilot for Microsoft 365, with masking applied before any client tax document or correspondence is summarized? If no: the user stops the summary, the Practice Manager confirms the masking step is applied, and the IT Administrator checks that Copilot access is limited to the firm's Microsoft 365 tenant.
- Is every ChatGPT session run on the firm-approved account, with no personal ChatGPT account used for client work? If no: IT Administrator removes the personal account from any firm device where possible, and the Practice Manager records the event as an incident and reviews it with the user.
Excerpt. Other parts of this document are left out.
3. AI Risk Register
14 risks in this pack, drawn from the organization's own AI use. Three are shown. Also downloadable as an Excel file.
| Risk description | Context / Relevance | Potential impact | Likelihood | Existing or recommended controls | Owner |
|---|---|---|---|---|---|
| R2: Staff use a personal ChatGPT account for client work outside the firm-approved account. | Personal accounts have no firm-controlled settings, and client letters may be drafted on them when the approved account is inconvenient. | Client information processed under terms the firm has not reviewed and cannot audit or delete. | Medium | IT Administrator reviews user accounts for all approved tools quarterly. Practice Manager covers the personal-account prohibition in the 60-minute induction and 45-minute annual refresher. | IT Administrator |
| R3: AI receipt-capture tool categorizes a client's personal meals as business expenses, and the error flows into a signed return. | The receipt tool categorizes receipts and bank transaction lines for return preparation. Meals and mixed personal purchases are common misclassification points. | Overstated deductions on a client return, amended filings, client complaint and professional exposure for the Licensed Tax Accountant. | Medium | Bookkeeping Lead checks 25 categorized items against receipts monthly, including any meal lines. Licensed Tax Accountant checks every AI-categorized line against source records before signature. | Bookkeeping Lead |
| R4: Microsoft Copilot for Microsoft 365 summary of client correspondence omits an amended income figure, and a letter drafted from it misstates income. | Summaries of client tax documents and correspondence feed client letters. Amended figures sent late in correspondence are easily missed in a summary. | Incorrect income stated to the client, wrong advice, a corrected return and loss of client confidence. | Medium | Practice Manager checks 10 Copilot summaries against source documents monthly. Client Services Lead checks each letter against the client file before sending. | Practice Manager |
Excerpt. Other parts of this document are left out.
4. Transparency & Disclosure Notices
When to tell customers, staff and suppliers about AI use, with wording to adapt.
Ready-to-use notice wording
Client engagement letter notice:
[INSERT FIRM NAME] uses AI tools to help summarize client documents, draft correspondence and categorize expenses. A Licensed Tax Accountant reviews and signs every tax return, and no return is filed based solely on AI output. Your records are handled only in the ways described in our engagement terms.
Client question response (for use by staff answering a client directly):
Yes, we use AI tools to help prepare some of our work for you, including summarizing documents, drafting letters and sorting expenses. Every figure in your return is checked against your records by a Licensed Tax Accountant before it is signed.
Excerpt. Other parts of this document are left out.
5. Rollout Plan and Adoption Guide
Why the pack exists, who owns it, and what to do in the first 30 days, within 90 days and ongoing.
Purpose of this pack
This pack sets out which AI tools the practice may use, what information may go into each one, how AI output is checked before it reaches a client or a tax return, and who is accountable for each control. The firm uses AI in three places. Microsoft Copilot for Microsoft 365 summarizes client tax documents and correspondence, ChatGPT drafts client letters and general wording, and the AI receipt-capture tool categorizes expenses that flow into returns. Each use carries a different risk, so each has its own check.
First 30 days
- Confirm the Managing Partner has approved this pack and the list of approved AI tools (Owner: Managing Partner)
- Create the AI Tool Inventory for Microsoft Copilot for Microsoft 365, ChatGPT and the AI receipt-capture tool (Owner: Practice Manager)
- Assign business owners: Client Services Lead for client correspondence summaries and letter drafting, Bookkeeping Lead for receipt-capture output, Licensed Tax Accountant for categorization in returns (Owner: Managing Partner)
- Add a marking step so every AI-categorized expense line is flagged and checked against source records before the return is signed (Owner: Licensed Tax Accountant)
- Check every ChatGPT letter draft against the client file before it is sent (Owner: Client Services Lead)
Excerpt. Other parts of this document are left out.
6. AI Tool Inventory
Each approved tool with its uses, owner, data rules and review frequency.
| Tool | Approved uses | Business owner | Data rules | Review |
|---|---|---|---|---|
| Microsoft Copilot for Microsoft 365 | Summarizing client tax documents and client correspondence inside the firm's Microsoft 365 environment | Client Services Lead | May: client names, client correspondence, tax documents, bank statements, and income and financial records held in the firm's tenant, with tax identifiers masked first; Never: unmasked tax identifiers. | Monthly check of 10 summaries against source documents (Practice Manager); account access quarterly (IT Administrator); vendor review annually (IT Administrator) |
| ChatGPT | Drafting client letters and general wording on the firm-approved account only, using anonymized text with client names replaced by placeholders | Client Services Lead | May: anonymized text and generic templates only; Never: client names, tax identifiers, income details, tax or financial records, bank statements, or client correspondence in identifiable form. | Monthly check of 10 drafts against the client file (Client Services Lead); every letter checked before sending (Client Services Lead); account access quarterly (IT Administrator); vendor review annually (IT Administrator) |
Excerpt. Other parts of this document are left out.
7. Staff Acknowledgment Form
Signed by each person before they first use an AI tool.
I confirm that I have read the AI Acceptable Use Policy and that:
- I will use ChatGPT only on the firm-approved account, and I will not use a personal ChatGPT account for any client work.
- I will use Microsoft Copilot for Microsoft 365 only inside the firm's Microsoft 365 environment, and only with client names, client correspondence, tax documents, bank statements, and income and financial records held in the firm's tenant.
- I will mask tax identifiers before entering any client document into Microsoft Copilot for Microsoft 365, and I will never enter an unmasked tax identifier into any AI tool.
- I will enter only anonymized text into ChatGPT, with client names replaced by placeholders and tax identifiers, income figures and account details removed. I will never enter a bank statement or client correspondence in identifiable form.
Name: ____ Role: ____ Signature: ____ Date: ____
Excerpt. Other parts of this document are left out.
8. Management Summary
One page for leaders: the main risks, the decisions needed and the review dates.
The firm uses AI to summarize client tax documents and correspondence, draft client letters and categorize expenses that feed into tax returns. Errors in any of these outputs can reach a client's letter or signed return, and account numbers or tax identifiers can be exposed if they are entered into the wrong tool. This pack sets the approved tools, the data each may receive, and the checks that catch errors before they reach a client.
What the pack puts in place:
- Approved tools: Microsoft Copilot for Microsoft 365, ChatGPT on the firm-approved account only, and the AI receipt-capture tool, all recorded in the AI Tool Inventory (Owner: Practice Manager).
- Monthly output checks: 10 Copilot summaries (Practice Manager), 10 ChatGPT drafts (Client Services Lead), and 25 receipt categorizations (Bookkeeping Lead).
- Letter control: every ChatGPT letter is checked against the client file before sending (Client Services Lead).
- Return control: the Licensed Tax Accountant checks every AI-categorized line against source records and marks it before signature (Licensed Tax Accountant).
- Access and vendor control: account access reviewed quarterly and vendor data handling reviewed annually (IT Administrator).
Excerpt. Other parts of this document are left out.