Writing an AI policy for an advice firm: what to cover

In most advice firms, AI arrived before anyone wrote down the rules for it. One adviser uses a chat assistant to tidy emails, a paraplanner has tried it on a valuation, and somebody is wondering whether it is acceptable to paste in a fact find. Nobody is doing anything reckless. They simply do not know where the lines are, because the firm has not drawn them.

An AI policy for an advice firm fixes that. It does not need to be long. Two pages that people read and follow are worth far more than twenty that sit in a shared drive. This article sets out what a workable policy covers and gives a sample outline you can adapt.

Why an AI policy for an advice firm is worth writing

The FCA has not created AI-specific rules. Its AI approach page says: "We do not plan to introduce extra regulations for AI. Instead, we'll rely on existing frameworks." Its AI Update is direct about where responsibility sits. Paragraph 3.45: "Firms that use AI as part of their business operations remain responsible for ensuring compliance with our rules, including in relation to consumer protection." Paragraph 3.40 says SM&CR "emphasises senior management accountability and is relevant to the safe and responsible use of AI".

On the data side, the Information Commission (formerly the ICO) says in its guidance on AI and data protection that in the vast majority of cases AI use will trigger the legal requirement for a DPIA.

So the obligations already exist. A policy is how the firm turns them into everyday instructions: which tools, which data, who checks, who answers for it.

The ten things a short AI policy covers

1. Purpose and scope

Say what the policy is for and who it applies to: all staff, contractors and anyone working on the firm's clients. Define AI broadly enough to include chat assistants, AI features inside other software and purpose-built apps.

2. Accountability

Name the person who owns AI use in the firm, normally a senior manager under your SM&CR arrangements. That person approves tools, signs off DPIAs and reviews the policy.

3. Approved tools

Keep a register of approved tools, with the account and plan each one uses. Anything not on the register is not approved for client work. A simple table works:

4. Data rules

This is the section people will consult most, so make it concrete:

• client personal data goes only into approved tools, on firm accounts;
• never into personal accounts or free consumer plans;
• share only the documents the job needs;
• special care with health, vulnerability and family information.

5. New tools need a DPIA first

No new AI tool touches client data until its DPIA is complete and signed off. Our article on AI vendor due diligence lists the supplier questions that feed it.

6. Human review and sign-off

Every AI output that reaches a client, or that the firm relies on for a decision, is reviewed by a named person before use. State what review means: figures checked against source documents, statements about the client checked against the file or meeting, judgement added or confirmed by the adviser.

7. Records

Keep the approved version of any AI-assisted client document and a note of who approved it and when. SYSC 9.1.1R requires "orderly records to be kept of its business and internal organisation" (SYSC 9.1).

8. Transparency with clients

Check that your privacy notice reflects the AI providers you use and the purposes. If a client would be surprised to learn how their data is handled, the notice needs work.

9. Training

Everyone covered by the policy reads it, is shown the approved tools and confirms they understand it. Repeat when the policy changes.

10. Errors, incidents and review

Say what to do when an AI output is wrong or data goes somewhere it should not: who to tell, how quickly, and how it is recorded. Set a review date, at least annually and whenever a tool or provider changes.

A sample outline you can adapt

Here is a compact structure, in the order staff will read it. The wording in quotation marks is our suggested example, not regulatory text.

1. Why we use AI. "We use AI to save time on reading and drafting. People make every decision and approve every client document."
2. Who owns this policy. The named senior manager, and how to contact them.
3. What you may use. The approved tools register, and where to find it.
4. What you must never do. "Never put client information into a personal account, a free plan or any tool not on the register."
5. How to check AI output. The review steps and who signs off.
6. What to keep. Approved versions, approver and date.
7. When something goes wrong. Who to tell, and how fast.
8. Asking for a new tool. The request route, DPIA and approval.
9. Review date and version. So everyone knows which version applies.

Making the policy workable

A policy fails when it is either too vague to act on or too rigid to follow. A few habits help:

• Use examples. "Rewriting a newsletter paragraph in a chat assistant: fine. Pasting a client's fact find into a personal account: not allowed."
• Keep the register separate. Tools change more often than principles. Update the register without reissuing the whole policy.
• Prefer tools that support review. A tool that shows the source of each figure or finding makes the review step realistic. Scrutineer, for example, ties each finding to a named FCA rule and quotes the passage from the file.
• Version it. Date each version, so you can say which rules applied when a document was produced.

Checking the policy is followed

Once the policy is live, test it lightly and regularly. During your normal file checks, note whether AI-assisted documents carry a reviewer and approval date. Ask the team, every few months, what they use AI for and whether anything is missing from the register. Keep a short log of AI errors caught at review, by type. That log shows whether the review step is working, and it is useful management information for the senior manager who owns the policy. For the first rollout, our practical plan for introducing AI in an advice firm sets out the order of work.

Frequently asked questions

Does the FCA require advice firms to have an AI policy?

The FCA has not written AI-specific rules. It relies on existing frameworks, including the Consumer Duty and SM&CR, and firms remain responsible for compliance when they use AI. A written policy is a practical way to show how the firm meets those responsibilities.

How long should an AI policy be?

Short enough that everyone reads it. Two pages plus a separate register of approved tools works well for most small and mid-sized firms.

Can staff use AI for non-client work?

Many firms allow it on approved firm accounts, for tasks such as drafting newsletters or internal notes, provided no client information is involved. Write that boundary into the policy with examples.

To see what a reviewable AI output looks like on a compliance file, look at Scrutineer or book a demo: twenty minutes on Microsoft Teams with Adam Booth, run live on a demo firm with its own clients, meetings and files, with nothing for you to prepare.