A rule such as “use approved AI tools” can leave staff unsure whether a particular account is suitable for a particular task. Make the decision explicit by pairing information categories and work types with each named product, account or tier, including settings that matter to your firm’s decision.
Build a usable tool-and-data map
Start with the tools people actually use, including AI features built into other software. For each entry, record the product name, account or tier, intended users, approved work types and relevant settings. A product name alone may not be enough: different accounts, configurations or uses may call for different rules.
Define information categories in terms staff can recognise. Your internal categories might distinguish public material, routine internal information, commercially sensitive firm information, and client or matter information. Add distinctions that matter to your work, such as personal information or information subject to a client restriction. Treat these labels as internal handling cues, not as a decision about whether a proposed use is acceptable. Where a restriction may affect the use, refer it to the person your firm has assigned to assess it.
For each combination, state whether the use is permitted, prohibited or needs approval. Include the work type, such as summarising public material, drafting internal text or analysing client documents. If a rule depends on a setting, name it and say who checks it. Mark combinations the firm has not assessed as unresolved rather than implying approval.
Assign ownership and exceptions
Name an owner for the map and for keeping its entries current. Depending on the firm, contributors may include the person responsible for the workflow, technology or information security, and someone assigned to assess client or contractual restrictions. Set out who can approve an exception, what information they need, and how the decision is recorded. Staff should know what to do while they wait for a decision.
Keep a concise record of the decision, its scope, the approver and date, any conditions, and the evidence or assumptions considered. This helps the firm revisit the decision; it is not a substitute for assessing a later use in its own context.
Review when something changes
Choose review triggers that fit your operations. These might include a new product or account tier, a change to settings or intended use, a new workflow, a client restriction, an incident or near miss, or a change in who owns the decision. A scheduled review can also catch changes that do not reach the owner through an exception request.
As a first step, ask teams which AI tools and accounts they use for which work. Compare that list with the policy. Prioritise combinations where staff cannot tell what is allowed, relevant settings are unknown, or no one owns the decision.
Source and scope
Firstier’s commercial guidance for professional-services firms, published 30 April 2026, asks whether an AI usage policy defines permitted data categories per tool. That is the narrow prompt used here. It is not authoritative UK legal guidance; the mapping approach and review suggestions above are practical recommendations, not statements of legal duties.
Discuss your decision
If you are deciding how to map AI tools to specific work in your firm, you can book a 30-minute AI Automation Discovery Call with Rohit to discuss whether there is a useful, safe automation opportunity, what next step makes sense, and what may not be worth doing yet.