More than half of solo and small law firms have no AI policy in place
Most solo and small law firms use AI without an AI policy in place.
The firm-level number comes from law. Clio's 2026 Solo and Small Legal Trends Report says 57% of solo firms and 55% of small firms have no AI policy in place, compared with 30% of mid-market firms and 24% of enterprise firms. The same report says 71% of solos and 75% of small firms use AI, most often generic tools like ChatGPT or Microsoft Copilot.
A few caveats on that number. Clio surveyed 1,702 US legal professionals, lawyers and support staff alike, and the sample leans toward Clio customers. Clio sells practice-management software, which makes this a vendor survey, so weigh it that way. It covers law firms only, so it says nothing about small accounting or financial planning firms.
The report also says small firms can get a policy across with verbal instructions or a team discussion. So the policy doesn't need to be long.
What the rules expect from law, accounting and financial firms
None of the sources below asks for a long document. Law and accounting bodies expect a firm to set the rules and keep a person responsible for the work. Treat these as starting points, because your regulator's text is what counts.
An AI policy for law firms. The American Bar Association's Formal Opinion 512 (July 2024) applies the existing Model Rules to generative AI. It is persuasive, not binding, because states decide what binds their lawyers. According to a National Law Review summary, it points lawyers to weigh disclosure risks before putting client information into a tool, to evaluate the output independently, and to set clear policies and training for lawyers and staff. Pennsylvania's 2024 joint opinion from the state and Philadelphia bar associations says lawyers must not put confidential client information into AI that lacks adequate confidentiality and security protections, and must check the citations. Pennsylvania's opinion is one state's view; other states differ, so check your state bar.
An AI policy for accounting firms. A July 2026 Journal of Accountancy column by Nicole L. Graham, a risk consultant at Aon, lists building blocks for a firm policy. They include an approved-tool list, a named AI lead or committee, limits on entering sensitive information, human review of output with the signing CPA staying responsible, and a scheduled review. That's one author's view, not a rule. The AICPA also offers a small-firm generative AI policy template to its members. For the tax-practice rules, such as IRS guidance and the FTC Safeguards Rule, see AI Agents for Accounting Firms.
Financial planners and advisers. Start with whether you're SEC-registered. If you are, the SEC Division of Examinations said in its fiscal year 2026 priorities that it will assess whether firms have adequate policies and procedures to monitor or supervise their use of AI. FINRA Regulatory Notice 24-09 creates no new rules, but says existing rules apply when member firms use generative AI, including through embedded features in third-party products. That applies to FINRA member broker-dealers. An unregistered planner or a state-registered adviser is in a different spot, so ask your regulator.
AI also shows up as features inside software your firm already uses, not just in a chatbot window, so cover both in the policy.
A one-page AI policy for small business: the starter
Copy this into a document, then fill in the brackets. It's a starting point, not legal advice. It covers the four things the sources above keep coming back to, plus an owner and a review date.
[Firm name] AI use policy Owner: [name]. Last reviewed: [date]. Next review: [date].
- Approved tools. Staff use only these tools, on firm accounts, never a personal or free consumer account: [list]. This includes AI features built into software the firm already uses: [list]. Not on the list? Not approved.
- Client data. Never goes in: [list it, for example client names, tax IDs, account numbers, case details]. May go in: [list it, for example public information and drafts with identifying details removed]. Before any client data goes into a tool, check the tool's privacy policy and terms. If the work is legal, ask the owner whether the client needs to consent first.
- Human review. [Named role] reviews anything AI helped produce before a client sees it. The person who signs the work stays responsible for it, not the tool. Check citations, figures and quotes against the original source.
- New tools and new uses. Ask [owner] before trying a new tool, or a new use of an approved one. The answer comes back in writing, yes or no.
- Questions and mistakes. Not sure? Ask [owner]. If something went in that shouldn't have, tell [owner] the same day.
If you want one, add a line each staff member signs to say they've read it. The Journal of Accountancy column suggests signed acknowledgments.
Compared with the voluntary NIST AI Risk Management Framework, this page is roughly the Govern function at small-firm size, which is TGC's reading and not NIST's.
What the SBA says
The Small Business Administration's AI for small business page tells owners to have a person review what AI generates and to keep sensitive data out of it. It has no policy template and no requirement.
What this page isn't
This page is not legal advice, and it doesn't replace your regulator's rules or your state bar's guidance. TGC is not a law firm, a CPA firm or an investment adviser.
Once the page exists, your people have to actually learn it. How to Train Employees on AI is a first-month plan for that.
