AI use policy template for brokerages, agencies and lenders
A free, plain-language AI use policy you can adapt: approved tools, what AI is never used for, client data rules, checks on client-facing messages, escalation and the record.
An AI use policy for a brokerage, agency or lender needs eight sections: purpose and scope, approved AI tools, permitted uses, prohibited uses, client data rules, checks on anything sent to clients, escalation to a named person, and acceptance and review. The template below covers each in a few lines you can adapt to your firm and regulator.
In ISACA’s 2026 survey of more than 3,400 governance, audit and security professionals, 90% said employees at their organization use AI, but only 38% said the organization has a formal, comprehensive AI policy, and 25% have none.
Copy the sections below into a document, replace the words in capitals with your firm’s details, and have your compliance lead or counsel check it against your regulator’s rules. Short is better: a policy people actually read beats a long one nobody opens.
1. Purpose and scope
This policy sets how everyone at FIRM NAME uses AI tools for work, including brokers, agents, assistants and contractors, on any device. It applies to AI that drafts, summarises, analyses or sends anything connected to our clients or our business.
2. Approved AI tools
- Only these tools may be used for work: LIST APPROVED TOOLS AND ACCOUNT TYPES (for example, the firm’s business accounts of Claude, ChatGPT or devs.ai).
- Free and personal accounts are not used for client work.
- A new tool is used only after COMPLIANCE LEAD approves it in writing, after checking it against the provider checklist below.
Before approving an AI provider or workflow
Before a tool goes on the approved list, check what the provider commits to in its terms, data processing agreement and security reports, not what its marketing says:
- Your data isn’t used to train its models, and you can control how long it is kept.
- An independent security report, such as SOC 2 Type II or ISO 27001, that you can request.
- Where data is stored, and which other companies it passes data to.
- For workflows that connect AI to your systems: read-only access by default, and an approval and a log for anything it changes or sends.
The full checklist: how to choose an AI provider or workflow platform.
3. What AI may be used for
- First drafts of client emails, texts and social posts, which a licensed person reads before they are sent.
- Summaries of the person’s own notes, checklists, and research on products and rules.
- Internal work: scheduling, task lists, marketing ideas.
4. What AI is never used for
- Sending anything to a client, lender, carrier or regulator without a licensed person approving it first.
- Final advice, suitability or eligibility decisions, or coverage and approval promises.
- Anything the firm’s licence, privacy or anti-money-laundering rules reserve for a person.
5. Client data
- Never enter government ID numbers, account numbers or full financial details into an AI tool unless the firm has approved that tool for that data.
- Use only accounts whose terms say your data is not used to train the vendor’s models.
- If client data is entered by mistake, tell COMPLIANCE LEAD the same day.
6. Checks on anything sent to clients
Every client-facing message drafted with AI follows the firm’s communication rules: required licence and company details, required disclosures, no promises of approval, rates or coverage, and no targeting that fair-lending or human-rights rules forbid. Where the firm has a checking tool, drafts go through it before they are sent.
7. When to stop and ask a person
- A client asks to change where money or documents are sent.
- A complaint, a vulnerable client, or a possible money-laundering concern.
- Anything the AI produces that the person isn’t sure is accurate. Escalate to NAMED PERSON.
8. Acceptance and review
Everyone accepts this policy before using AI for work, and again when it changes. Each acceptance is recorded with the person, the date and the policy version. COMPLIANCE LEAD reviews the policy at least every REVIEW PERIOD, and whenever a regulator, vendor or tool changes.
Writing the policy is the easy part
The hard part is showing it was followed: that only approved tools were used, that each person accepted the current version, and that client messages were checked. Broker AI does that part: approved tools are checked on every request, every acceptance is recorded against a version, and client-facing drafts are checked against the firm’s rules, without Broker AI ever storing client data. See it for firms.
General information, not legal or compliance advice. Rules differ by state, province and regulator; check with your compliance team or counsel.
Questions people ask
- Do small brokerages need an AI use policy?
- Yes, if anyone uses AI for work. Even a one-page policy should name the approved tools, the uses that are never allowed and the client data rules, and record who accepted it.
- How long should an AI use policy be?
- One to three pages for most firms. It should be short enough that everyone reads it, and specific enough to name the tools and the uses that are never allowed.
- Should the policy ban ChatGPT?
- Bans are hard to enforce on personal phones. Most firms approve specific business accounts and forbid free personal ones for client work.
- Is this legal advice?
- General information, not legal or compliance advice. Rules differ by state, province and regulator; check with your compliance team or counsel.
By DisruptionIO, the team behind Broker AI. Published October 28, 2026.