How to Write Your Law Firm's AI Use Policy: A Clause-by-Clause Guide
Most AI policies fail because they're generic templates copied from a vendor's blog. Here's a clause-by-clause policy built directly from real enforcement cases in India, the UK and Singapore.
We’ve already made the case for why your firm needs an AI governance policy. The harder problem, and the one most firms get wrong, is what actually goes in it. Search for a template and you’ll find dozens, most written for a generic US market, built around a single regulatory opinion, and light on the specifics that actually matter once a real failure happens. This is a different approach: a clause-by-clause policy built directly from what recent enforcement actions in India, the UK and Singapore have actually revealed was missing, not from a checklist someone assembled before any of these cases existed.
Every clause below traces to a specific, documented failure. That’s deliberate. A policy built from real cases tells you what to actually check for. A policy built from a generic template tells you what sounds responsible.
1. Mandatory Disclosure, Not Just Permitted Use
Most policies address what a lawyer is allowed to use AI for. Almost none address what happens when a junior lawyer uses it and says nothing. In Cork v Smith, a Pinsent Masons associate used AI to draft two separate court letters without telling the supervising partner AI was involved at all, and the partner, with fourteen years’ experience, had no way of knowing there was anything to review. Your policy needs an affirmative clause requiring anyone using AI in preparing a court document, opinion or client advice to state that fact to their supervisor, in writing, before the work goes out. Verification obligations are meaningless if the supervisor doesn’t know there’s anything to verify.
2. A Verification Protocol That Names the Standard
“Verify AI output before relying on it” is not a clause, it’s a slogan. Two separate Singapore cases have now established what verification actually has to mean in practice. In Tan Hai Peng Micheal v Tan Cheong Joo, the court fined both counsel and the assisting solicitor personally for citing AI-fabricated cases, making clear that using an AI tool isn’t the problem, failing to verify what it produces is. In the earlier SGHCR 33 case, the court rejected the idea that a lawyer can discharge this duty by having a second AI tool check the first one’s output. Your clause should say explicitly: every citation, quotation or factual claim drafted or sourced with AI assistance must be checked against a primary source by a human before filing, and cross-checking one AI tool against another does not satisfy this requirement.
3. Defined Scope, Tied to Your Jurisdiction’s Actual Guidance
MinLaw’s Guide for Using Generative AI in the Legal Sector sets out three principles worth building directly into policy language rather than paraphrasing loosely: professional ethics (AI use does not reduce your responsibility for the work product), confidentiality (you must understand how your specific AI tools handle data, not assume), and transparency (client-facing judgement calls about disclosure). If your firm operates across India, the UK and Singapore, your scope clause should map explicitly to whichever of these frameworks, and the SRA’s compliance tips, applies to each matter, rather than writing one global standard and hoping it satisfies all three regulators.
4. Vendor and Data-Handling Due Diligence, in Writing
A confidentiality clause that doesn’t name specific questions is not enforceable in any meaningful sense. Require, in writing, that before any AI tool touches client data: retention practices are confirmed (does the vendor keep uploaded documents after the engagement ends), training use is confirmed (is data used to fine-tune any model), and hosting location is confirmed (relevant for cross-border transfer analysis under India’s DPDPA section 16 or Singapore’s PDPA section 26 transfer limitation obligation). If a vendor can’t answer these clearly in the contract, the policy should say plainly that the tool isn’t approved for client data until they can.
5. Technical Controls for Anything Agentic, Specifically
If your firm uses or is considering any tool that acts across multiple steps with limited human review, contract review agents, compliance monitoring, document processing pipelines, a generic AI policy does not cover it. Singapore’s IMDA Model AI Governance Framework for Agentic AI sets out the specific controls worth lifting directly into your own policy: least-privilege access limiting each agent to only the tools and data it needs, mandatory human approval before any high-stakes or irreversible action, and continuous logging covering every step of an agent’s workflow including agent-to-agent interactions. A single clause saying “agentic tools require additional safeguards” is not a policy. Naming the specific safeguards is.
6. An Incident Response Clause, Not Just a Prevention Clause
Cork v Smith is instructive here too, and this is the part most policies miss entirely. The firm’s problem didn’t end when the first AI-fabricated citation was caught. It got worse because the response to being caught was itself another AI-drafted letter that the judge found “impossible to accept.” Your policy needs a clause covering what happens after an AI error is discovered, not just how to prevent one: immediate escalation to a named senior lawyer, a prohibition on using AI to draft the correction or explanation, and a requirement to disclose the full circumstances rather than characterising a fabrication as a “clerical error,” the exact framing the Singapore court rejected in SGHCR 33.
7. A Review Cadence, Because the Regulatory Ground Keeps Moving
MinLaw has committed to updating its Guide as practice evolves. IMDA updated its own agentic AI framework within four months of first publishing it. A policy adopted once and left untouched for two years will not reflect the standard a regulator or court actually expects by the time it matters. Build in an explicit review date, not “as needed,” an actual calendar commitment, ideally tied to your firm’s annual compliance cycle, with responsibility assigned to a named person for tracking regulatory developments in each jurisdiction you operate in.
What to Leave Out
Resist the temptation to include a blanket prohibition on AI use as a substitute for the clauses above. A ban that nobody follows, because the productivity pressure to use these tools is real, is worse than a permissive policy that’s actually enforced, because it creates exactly the disclosure gap that made Cork v Smith possible in the first place. The goal isn’t to look cautious on paper. It’s to build a policy specific enough that when something goes wrong, your firm can show precisely what was required, and precisely where it broke down.
This is the practical companion to our earlier piece on whether your firm needs an AI governance policy at all, and it’s the exact structure we walk through, clause by clause, against your own firm’s practice areas, in the Compliance and Governance module of The AI Bar Foundation for Lawyers. A policy copied from a vendor’s blog protects the vendor’s credibility. A policy built from what actually happened in Cork v Smith, Tan Hai Peng, and the Indian Supreme Court’s September rulings protects your firm.