The governance wedge · Article 2 of 7
Verbal norms don’t survive a dispute
The two most popular AI policies are a blanket ban and a shrug. Neither is written down, and both fail the same way. What holds up is a rulebook tiered to the risk of the work.
1 · Two policies, neither of them written
Most firms we meet already have an AI policy. It is simply not on paper, and it is one of two.
The first is the ban. At some point in a partner meeting it was agreed that the firm does not use AI for client work, the agreement was announced, and everyone nodded. A ban does not solve the Tuesday-afternoon deadline. It relocates it. The associate who would have asked whether a tool was safe for a particular document now asks nobody, opens a personal account on a personal phone, and mentions it to no one. The firm still has AI in its workflow. What it has lost is any sight of where, which is the one thing the announcement was supposed to buy. Bans do not reduce usage. They reduce reporting, which is a different problem and a worse one.
The second is the shrug. Nothing was ever decided, so twelve people are running twelve private policies assembled from headlines, habit, and guesswork. The paralegal has one rule. The senior editor has another. The freelance designer has none. On an ordinary week this is merely inconsistent. On the week a client asks a pointed question, the firm discovers that its real policy was whatever its least careful person did most recently.
Both failures have the same root, which is that the norms are verbal. Verbal norms don’t survive a dispute. When something goes wrong the questions arrive in writing, from a client or an insurer or a regulator, and they ask for the one thing you cannot produce: the policy, the date people acknowledged it, the rule that covered this situation. “We all understood” is not a document. In a dispute, the firm with a written policy it mostly followed occupies a completely different world from the firm with a perfect unwritten one.
2 · Tier the work, not the tools
The appeal of a blanket rule, ban or allow, is the fantasy of one sentence that settles everything. AI risk does not come in one size, because your work does not. Summarizing a published article and drafting language for a live acquisition are not the same act. A policy that treats them alike will be ignored exactly where you needed it obeyed.
What works is a short set of tiers keyed to the sensitivity of the work rather than the brand of the tool. Tools change monthly. The shape of your risk does not.
Tier one is routine work. Internal drafts, research on public material, first-pass thinking, boilerplate: nothing that identifies a client or a matter. Be permissive here on purpose. This is where the productivity actually lives, and generosity in tier one is what buys you compliance in tier three. The rule is ordinary professional care. You own what you produce, whatever helped you produce it.
Tier two is client work. Anything touching a client’s matter, manuscript, or account, even with the names filed off. Here the rules earn their keep: sanctioned business-tier accounts only, model training switched off, a qualified human reading the output before it goes anywhere. The next article explains why the account tier matters as much as the tool choice. The short version is that a business workspace and a personal free account are two products wearing one logo.
Tier three is the short list. Privileged communications, regulated records, anything a contract explicitly restricts, anything where the discovery of AI involvement would itself be the problem. Write this tier in your own nouns, naming the actual matter types and document classes your firm handles, and keep it short. The rule is a named tool list, explicit approval per use, or simply no. A tiered policy is what makes that “no” credible, because it has stopped being the answer to everything.
One design constraint governs all three. Any member of staff should be able to place a task in the right tier in under ten seconds. If classification needs a meeting, the policy loses to the deadline every time.
3 · Cover the people your org chart forgets, then make it real
A policy that binds employees and nobody else governs roughly half of a modern professional firm. The other half is contractors, freelancers, of-counsel arrangements, production vendors, and agencies. They are also, statistically, your riskiest population, because they work on their own machines, in their own accounts, for six other clients whose rules differ from yours.
The fix is not elaborate. State that the policy covers anyone producing work under your name, and have your standard contractor terms pick up a sentence requiring conformance, the way confidentiality terms already flow down. A freelancer running a manuscript through a personal account is your problem whether or not they are your employee, because the client sees your name on the deliverable. Your policy should see what the client sees.
Then the mechanics, which are what turn a document into a practice.
- Name the tools. The policy points at the living inventory from the previous article: these accounts are sanctioned, these are prohibited, this is who to ask about anything not listed. Vague policies produce confident violations. Named lists produce questions, which is what you wanted.
- Make the ask-first path fast. Somebody who wants to try a new tool should have an answer within days, from the named owner, through a light review. If asking takes three weeks, people stop asking, and you have rebuilt the shrug with extra paperwork.
- Collect acknowledgments. Staff and contractors read the policy and say so in writing, once a year and at every material change. Thirty minutes of administration transforms the document’s standing. An acknowledged policy is evidence of a governed firm. An unacknowledged one is a memo.
- Version it, then revisit it. Date it, number it, and put a review on the calendar twice a year. A policy last touched in 2024 reads, to a client or an underwriter, exactly like the shrug it replaced.
Keep the whole thing to five pages of plain language with no appendix of vendor legalese. The measure of success is that a new hire reads it on their first morning and knows what to do on their first deadline.
4 · The outside world has started checking
For a long time the honest case for an AI policy was internal: consistency, trust, sleep. That era is ending. In July 2024 the American Bar Association’s ethics committee put the obligation on the firm rather than the individual. Its opinions are advisory until a state adopts them, so what they set is the professional standard rather than a rule with a penalty attached, and the professional standard is what a court, an insurer, or an opposing counsel measures you against. Managerial lawyers, it wrote, “must establish clear policies regarding the law firm’s permissible use of GAI,” and supervisory lawyers must “make reasonable efforts to ensure” that the people around them comply. On the question of who carries the result, it left no room: “regardless of the level of review the lawyer selects, the lawyer is fully responsible for the work on behalf of the client.”
Then came the part that gives the guidance teeth. In September 2025 a California appeals court fined a lawyer $10,000 over briefs full of invented citations, published the opinion so the profession would read it, and sent the file to the State Bar. Five months later a State Bar Court judge recommended a stayed one-year suspension and ten hours of continuing education, half of it on the risks of using AI.
Bar rules govern lawyers. The accounting boards, the publishing contracts, and the professional liability underwriters are all moving in the same direction, and they are reading the legal profession’s experience as the preview. Sit with the phrase clear policies. Not good intentions. Not a verbal norm. Something you can hand over when somebody asks. Firms that can hand it over find audits, renewals, and client questionnaires boring, and boring is the goal.
Where this fits
Policy is the second of eight domains in our AI Governance Readiness Checklist, sitting directly on the first, because you can only write real rules for tools you have actually met. Four boxes:
☐ We have a written AI usage policy, not just informal expectations.
☐ The policy is risk-tiered rather than a blanket ban or a free-for-all.
☐ It covers contributors, freelancers, and vendors, not only employees.
☐ Staff have read and acknowledged it, and it names the tools they may and may not use.
The next article follows the data: what actually happens to a prompt after you paste it, and why the account it travels under decides more than the logo on the tool.
A fairness note to close. A policy is a management document rather than a legal opinion, and nothing here substitutes for your counsel’s advice on the obligations particular to your practice. What we bring is the operational half. We write the policy before we build the pipeline, and we have written enough of them to know where they bend.